Block all Outside IP addresses to NAS using Winbox/Microtik

Question

I am not an expert on networking and firewall rules. I can use the Microtik/Winbox app to the point where I can setup basic firewall rules. I want to basically block all outside IP access to my NAS except what is in my internal network. Seems someone from Romania can still get in since the IP 79.112.. seems to making connections from my NAS to those IPs and snaking up ports from 40k to 60k. There might be rogue program on my machine but in the mean time I'd like to just block all connections in or out to my NAS. Using Winbox how can I do this in the Firewall/Filter Rules section?

Solution

Typically your NAS would not be accessible to any outside access unless you've either a) specifically forwarded a port(s) to it b) do not have a drop rule in your firewall.

Option b should exist from mikrotik default setup/config, option a should only exist if you did it your self.

So passively, your nas is allowed to go out to the 'net (example to check for updates) but nothing can reach (or initiate with) the NAS. If you want to explicitly block any/all in/out to the nas this rule should help:

/ip firewall filter add chain=forward action=drop src-address=192.168.88.7 place-before=0 

Change src-address= to the LAN IP of your NAS. Make sure that place-before is somewhere above your final 'drop' rule.

If you don't have a rule to drop all traffic at the end of your Filter Rules, you should add one immediately. Note it's important that this rule is LAST in your Filter Rules. Anything below it will never be run. If it's first you will likely lock yourself out of the router.

EDIT- Added images:

Comments

[JoelAZ]

Winbox is a powerful tool. In addition to using graphically as you have you can also open a terminal within it and use the command line. Find the 'New Terminal' button on the left side. You can then enter the code above, exactly as typed, in the terminal.

[JoelAZ]

Further - there is a correlation between terminal commmands and Winbox graphical input so for example, using the command above: Go to IP, then Firewall. Go to the Filter tab and click add (the plus button) Set the chain to forward set the src-address to match your NAS lan ip. Switch to the Action tab and set the Action to Drop. Click OK. Back at the Filter Rules, drag this new rule from the bottom of the list to the top.

[JoelAZ]

Added images to my post. Hope that clarifies for you. In the future/for reference, it's expected that you'll put in some effort to solve your own problems as well as the help you get from the community so if an answer is not step by step noob simple, try a little google/ searching first. Anyway, hope this gets you on track.

[JPM]

Hence why I asked it here googled it and most was command line which I am hesitant to do cause I don't want to lock myself out of router. Winbox allows you to test the setup before, and can roll it back. Thanks for the help, I do have a drop all at the end.

[JoelAZ]

No worries, glad it helped. As you continue to learn Mikrotik I encourage you to always bear in mind the correlation between the way things are laid out in the GUI and the way the command lines are constructed. This is a huge help in taking command line answers you find via google or other fora and transposing them into the right clicks to do it via teh GUI. This alone was a huge help for me when learning my way around it.