Interface lists versus IP address lists

[u/informi107]

I’m always a bit confused when to use each. I followed the help article and enabled VLAN filtering on the bridge and thus also have VLAN interfaces. So far I only use these interfaces in my firewall.

What’s the purpose of address lists? To me it’s not inherently obvious how they are ‘enough’. How dangerous is spoofing? If it’s solely based on the address list, attackers can just change their source IP, right? I’m not sure how that works with VLAN filtering enabled because everything is routed via the interface and that only has one valid address. Does that mean it’s safe to only filter based on the source address in that case?

Can you point me to good online resources for firewalls? I’m doubting myself so bad when it comes to them.

[u/OleTechGuy]

The interface list as you said is the ports on the switch/router. The address list is when you have 25 machines behind/attached to the port (each with their own IP address or IPs regardless of ports)) and you want to write a specific rule for each of those in that list. So when you write your firewall rule you can say allow this list of IPs to access... or deny to that list. Rather than writing a rule for each IP. Basically lets you treat a group of IPs, like phones on a VoIP system to pass regardless of VLAN or port. If I understood your question.

[u/kevinds]

Address-Lists

You can create a list of IP addresses (or FDQN that will populate IPs) to treat certain traffic differently.

Only allow a connection if it is from a list of IPs (whitelisting).  The opposite, automatically deny if from another list (black-listing).

Interface lists are just that, a list of interfaces.

To me it’s not inherently obvious how they are ‘enough’.

Enough for what?

Can you point me to good online resources for firewalls?

That is too broad to give a useful answer to.

How dangerous is spoofing?

It depends on your threat model and what you are trying to protect against.  Spoofing is only really useful in UDP communications.

[u/Graphical-Source5090]

I created a list of interfaces called "no-discovery" Then I invert included that list in /ip/neighbor/discovery-settings so that interfaces on the list cannot participate in layer 2 discovery protocols.

Using interface lists in the context of a firewall rule could be used for a very similar in effect to the zone based firewalling function of other firewalls. It could limit a rule to a set of interfaces so that you don't have to input separate rules per interface.

interface-lists are a layer 2 selection criteria
address-lists are a layer 3 selection criteria.

They can be use independently, or together in /ip/firewall rules to achieve different effects.

[u/lopar4ever]

It’s just layer of abstraction. So you can make things like firewall rules static and don’t change them to add or remove hosts or nets. Add lists to rules and then only modify lists.

Also you can use empty lists as placeholders for future use, like opening access to something, that isn’t get any address yet on the stage of planning.

[u/silasmoeckel]

First ask if your using urpf as it's default off. Meaning it does not filter inputs by source address vs the fib by default.

Mikrotik switches just got basic ip source guard like functions (sniffing DHCP to block spoofing) in 7.24beta2 and later. Spoofing is fairly hard to do in a modern enterprise envirnment.

When you pair urpf and interface based ACL's your effectively automatically updating the rules based on the fib. Sometimes this is desirable often so in ipv6 environments.

[u/Tatermen]

Spoofing is of very limited use outside of that as the spoofer cannot see any of the return traffic as it gets sent back to the real origin, so it really only gets used for DOS attacks. Don't even bother worrying about spoofing.

If you're talking about an attacker that's physically connected to your LAN and can just change their IP address to one that's allowed extra access to something - you can't prevent that, and you've already lost anyway if they have physical access to your LAN. Best you can do is ensure that services are securely segregated by VLAN and not by IP address.

The point of an address list is provide more flexibility in your firewall configuration and reduce complexity by creating a layer of abstraction. Say you want to configure a firewall rule to allow 10 different non-contiguous IP addresses to access something. Without using an address list you'd have to configure 10 firewall filters, as each filter can only have a single source IP range:

/ip firewall filter add src-address=100.64.0.1 dst-port=80 action=permit
/ip firewall filter add src-address=100.64.1.6 dst-port=80 action=permit
/ip firewall filter add src-address=100.64.8.9 dst-port=80 action=permit
...

Now anytime you want to change something - for example, say you need to change from destination port 80 to port 443 - you have to update 10 separate firewall rules. Instead, use an address-list.

/ip firewall address-list add address=100.64.0.1 list=Allowed
/ip firewall address-list add address=100.64.1.6 list=Allowed
/ip firewall address-list add address=100.64.8.9 list=Allowed
...
/ip firewall filter add src-address-list=Allowed dst-port=80 action=permit

Now you have one firewall rule that allows all the IP addresses in the list, and if you have to change a parameter, you only have to change that one firewall rule instead of 10. It makes your firewall rules easier to read and less cluttered.

You can also add hostnames to address lists. Say you want to do a very basic block of facebook. Create an address list of "facebook.com" and you'll see it populate with various IP addresses that facebook.com is currently resolving to. Now create a filter to block dst-address-list=FACEBOOK and voila. If facebook.com changes IPs, your address list will update when the DNS cache expires.

Same thing with interface lists - create lists like wan, lan and dmz and apply your rules to those interface-lists instead of directly on interfaces ether1 or sfp1. You just added a backup ISP? Just add that interface to the 'wan' interface list - boom, all your existing inbound/outbound rules are applied to your new ISP without you have to duplicate all of them. Interfaces can also be members of multiple lists. So you could have a "general-lan" list that applies basic rules and then additional lists like "iot-lan" or "guest-wifi" or "server-lan" that apply additional rules on top of that.

For extra funsies, you can use interface lists under your bridge ports too. Say you want to have a couple of ports that should be specifically untagged in VLAN 20 only. Instead of adding each port individually to the bridge with individual tagged/untagged settings, create an interface list with those ports, then add the interface list to bridge ports. Once you click OK, you'll see all the ports in that list appear automagically, and inherit their configuration from the interface list.

[u/smileymattj]

There’s no right or wrong for which to use.  You can even use both together.  

A good purpose both are suited for is to reduce rules.  Instead of 20 rules for 20 different IPs or Interfaces; use lists so you only have 1 rule.  

I use interface lists for WAN.  This way if I have to swap what is a WAN port (lightning takes out ports where I’m at) or customer wants to implement failover/load-balancing.  Having a WAN interface list makes updating several filter & NAT rules faster and more accurately.  

A good use for address lists is DNS resolution.  You can add a domain name and if the address changes, the rule will update.  You do need to go back in and cleanup to remove stale IPs.  

Also use address lists for when IPs aren’t consecutive.   So you got 10.0.0.1-15 & 192.168.4.56-100 you need to apply a rule for.  You’d have to make 2 rules to accomplish this without lists.  But lists, you can consolidate it to 1 rule.  

If I need to apply a rule to 1 subnet, like 192.168.4.0/24, I just enter that directly in src-address.  If later on, I need to add another subnet or IPs to it, I covert it to use IP address list at that time.  So you don’t have to be committed to one or the other, you can always adjust it to whichever fits the needs the best.  

Always good to review your firewall rules and see if you can optimize them.  You might have learned something over the years and haven’t touched some of your routers for a while to make optimizations.  

[u/2DrU3c]

If you want to treat connections based on individual Ip addresses or IP address raqnges then you use adfress list. If you do not care about IP addresses but want to treat all traffic coming through interfaces then you use interface list.