MikroTik: Basic router settings

Model situation: We want to set up MikroTik router for local LAN 192.168.25.0/24 with ports 2-4 in bridge, port 1 serves as WAN ( 10.0.0.139) and the gateway will be 10.0.0.138. We set up NAT masquerade, DHCP server with 100-200 pool and basic firewall rules.


First we will perform a full router reset = System - Reset configuration - No default config - Reset

Interfaces
- comment on individual interfaces for clarity
- set port 1 as WAN
- set ports 2-4 as bridge
- Bridge - Add bridge1
- Bridge - Add ports (2,3,4)

IP-addresses
- we add the range 192.168.25.1/24 to the int bridge
- Add - Address: 192.168.25.1, Network: 192.168.25.0, iface: bridge1
- PS: Then we get to tic via IP 192.168.25.1

- add 10.0.0.139/24 // network 10.0.0.0 to the WAN port
- Add - Address: 10.0.0.139, Network: 10.0.0.0, iface: ether1
- PS: If there is a dynamic IP (DHCP client Add) on the WAN, we do not set the WAN address

IP - Routes
- set the default routing to the gateway
- Add - Dst. address: 0.0.0.0/0, Gateway: 10.0.0.138
PS: If we have a dynamic IP on WAN (DHCP client Add), the router does not need to be configured

IP-DNS
- set DNS servers
- Add-Servers: 10.0.0.138, 8.8.8.8
- check Allow remote requests

IP-DHCP
- set the DHCP server
- DHCP setup - Iface: Bridge
- DHCP Address Space: 192.168.25.0/24
- Gateway + DHCP Relay: 192.168.25.254
- Addresses to Give Out: 192.168.25.100-192.168.25.200
- DNS servers: 10.0.0.138, 8.8.8.8, Lease Time: 1d 00:00:00

IP-Firewall
- set NAT masquerade
- NAT - Add - srcnat - Src. Address 192.168.25.0/24 -> action masquerade

- disable DNS request from outside, SSH and HTTP
- Add-Chain: Input, Hence: UDP, Dst.Port: 53, In.Iface: ether1, Action: Drop
- Add-Chain: Input, Hence: TCP, Dst.Port: 22, In.Iface: ether1, Action: Drop
- Add-Chain: Input, Hence: TCP, Dst.Port: 80, In.Iface: ether1, Action: Drop

- disable all service ports that we do not need
- IP service ports - I recommend leaving only ssh + winbox and changing their ports

System
- set the router password
System-Password

Wifi settings
Wireless:
- Interfaces - wlan1 - enable
- Mode ap_bridge
- SSID name
Security Profiles - Add:
- Mode dynamic keys
- Authentication types - WPA2 PSK
- set WPA2 Pre-Shared Key

Important

Check your package and routerboard for updates regularly !!!
1.) System - Packages - Check for updates
2.) System - Routerboard - Upgrade

Additions

System - SNTP client - 192.113.144.21 + 147.228.57.10
System - Identity (set your router name)