+++++++++++Good work, eric_tan for creating this user group. +++++++++++

ok back to firewall.


As eric_tan said
you start with a clean slate and no one complete rules fits all situation or user needs.

Maybe we can start with the must do, for start, and we add in as we specify our requirement together.

1. as a start, make sure you change router default password,

2. make sure you close all services you are not using, so that it cannot be access, and specify ip address where it is allowed to be access.

[admin@HSE.AP] /ip service> print
Flags: X - disabled, I - invalid
# NAME PORT ADDRESS CERTIFICATE
0 X telnet 23
1 X ftp 21
2 X www 80
3 X ssh 22
4 X www-ssl 443 none
5 X api 8728
6 winbox 8291

On firewall, I think Demitry example is a bit complicated. I think you don't need to mangle to do firewall, Just filter straight away.
first thing first, you should have at least this on your first entry of firewall rules. allow router to accept only clean packet. ie ; meant for you.

/ip firewall filter
add chain=forward connection-state=established comment="allow established connections"
add chain=forward connection-state=related comment="allow related connections"
add chain=forward connection-state=invalid action=drop comment="drop invalid connections"

Next what did we want to filter,objective?? Hey guys, maybe we can come out with the list together and move from here

TO BE CONTINUE ........

Wa, you all sifu so advance, me just starting. need to RTFM more.

My RB750GL says CPU Frequency 400MHz, don't know where to set also.