pjhtech ToolsFor an empty RouterOS 7 configuration, this example gives wired LAN clients Internet access through a DHCP WAN on ether1. It creates the LAN, DHCP, DNS, firewall and source NAT in that order. On a factory-configured router, edit the existing configuration instead of adding duplicate services.
Connect a DHCP WAN to a new wired LAN
Topology: ISP → ether1 (WAN) → router → br-lan (ether2–ether4). The LAN is 10.42.50.0/24; the router is .1. Set the local administration computer to .10/24, gateway .1. DHCP leases use .100–.199 so they cannot collide with that computer. Keep the WAN cable disconnected until both firewall families and management restrictions are in place.
1. Create the LAN and interface lists
/interface/bridge/add name=br-lan
/interface/bridge/port
add bridge=br-lan interface=ether2
add bridge=br-lan interface=ether3
add bridge=br-lan interface=ether4
/interface/list
add name=WAN
add name=LAN
/interface/list/member
add list=WAN interface=ether1
add list=LAN interface=br-lan
/ip/address/add address=10.42.50.1/24 interface=br-lan
/ip/pool/add name=lan-pool ranges=10.42.50.100-10.42.50.199
/ip/dhcp-server/add name=lan-dhcp interface=br-lan address-pool=lan-pool disabled=no
/ip/dhcp-server/network/add address=10.42.50.0/24 gateway=10.42.50.1 dns-server=10.42.50.1
/ip/dns/set allow-remote-requests=yesKeep the LAN address and DHCP server on br-lan. The example accepts ISP-provided DNS; for your own resolver list, use /ip/dns/set servers=<approved-resolver-IP-list> and change the WAN DHCP client to use-peer-dns=no.
2. Protect the router and transit traffic
This policy permits SSH/WinBox only from the chosen wired admin address. Adjust that address before applying. WebFig is not opened. The forward policy permits outbound LAN traffic and replies; new inbound port forwards need a separate narrow allow rule.
/ip/firewall/filter
add chain=input action=accept connection-state=established,related comment="Return traffic to router"
add chain=input action=drop connection-state=invalid comment="Reject invalid state"
add chain=input action=accept in-interface-list=WAN protocol=udp src-port=67 dst-port=68 comment="WAN DHCP reply"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=67 comment="LAN DHCP requests"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=53 comment="LAN DNS UDP"
add chain=input action=accept in-interface-list=LAN protocol=tcp dst-port=53 comment="LAN DNS TCP"
add chain=input action=accept in-interface-list=LAN src-address=10.42.50.10 protocol=tcp dst-port=22,8291 comment="Admin workstation only"
add chain=input action=accept protocol=icmp comment="IPv4 diagnostics and errors"
add chain=input action=drop comment="Deny other router input"
add chain=forward action=accept connection-state=established,related comment="Return traffic through router"
add chain=forward action=drop connection-state=invalid comment="Reject invalid forwarding"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="LAN Internet access"
add chain=forward action=drop comment="Deny other forwarding"Install the IPv6 baseline too, even if you plan IPv4 first. This does not configure IPv6 addresses, prefix delegation or LAN advertisements. Management remains on the explicit IPv4 path; if using a DHCPv6 relay, check its reply source rather than assuming link-local.
/ipv6/firewall/filter
add chain=input action=accept connection-state=established,related
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmpv6 comment="Neighbor discovery and IPv6 errors"
add chain=input action=accept in-interface-list=WAN src-address=fe80::/10 protocol=udp src-port=547 dst-port=546 comment="Direct-link DHCPv6 replies"
add chain=input action=drop comment="IPv6 management uses no implicit LAN trust"
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=invalid
add chain=forward action=accept protocol=icmpv6 comment="Allow IPv6 diagnostics and PMTU"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN
add chain=forward action=drop3. Limit management and connect the WAN
Run /password in the local administrator session and enter the old password, new password and confirmation at its prompts. IP firewall rules do not control MAC-based management, so restrict it separately.
/ip/service/disable [find name=telnet]
/ip/service/disable [find name=ftp]
/ip/service/disable [find name=www]
/ip/service/disable [find name=api]
/ip/service/disable [find name=api-ssl]
/tool/mac-server/set allowed-interface-list=none
/tool/mac-server/mac-winbox/set allowed-interface-list=LAN
/ip/neighbor/discovery-settings/set discover-interface-list=LAN
/ip/firewall/nat/add chain=srcnat out-interface-list=WAN src-address=10.42.50.0/24 action=masquerade
/ip/dhcp-client/add interface=ether1 add-default-route=yes use-peer-dns=yes disabled=noConnect ether1 to the ISP. DHCP supplies the WAN address and, when offered, a default route. Masquerade follows that dynamic WAN address. PPPoE or an ISP VLAN needs a different WAN interface; put the actual routed uplink in the WAN list, not just its underlying cable.
4. Verify from both sides
/ip/dhcp-client/print detail
/ip/address/print
/ip/route/print detail
/ip/dhcp-server/lease/print
/ip/firewall/filter/print stats
/ip/firewall/nat/print stats
/ip/dns/printCheck for a bound DHCP client and an active default route. From the admin PC, reach .1, open a second management session, then test a known reachable Internet address and a hostname. From a separate external network, confirm management is blocked. Recheck new sessions after changes: established connections can survive a rule change.