How to Configure Zerotrust on Mikrotik

mamet zeroshell

April 08, 2024

To configure Zero Trust for MikroTik, you can integrate it with Cloudflare Zero Trust services. Here are some steps you can follow:

1. Cloudflare Zero Trust Tunnel:

Register for a free Cloudflare account.
Configure your domain to use Cloudflare DNS services.
Set up a Cloudflare Zero Trust Tunnel by obtaining a token and configuring public hostnames.
Adjust MikroTik settings to work with the tunnel.

2. Cloudflare WARP-to-WARP:

Enable proxy settings and split tunneling in Cloudflare Zero Trust.
Generate WireGuard configurations for Cloudflare WARP.
Configure MikroTik to connect to Cloudflare's Points of Presence (PoPs) using WireGuard.

3. DNS over HTTPS (DoH):

Set up Cloudflare Gateway DNS Locations.
Import root certificates into MikroTik.
Configure MikroTik to use DNS over HTTPS for secure DNS queries.


# Zero Trust Basic Configuration for MikroTik
/interface wireguard
add name=wg-zerotrust listen-port=13231 private-key="your_private_key"

/ip firewall filter
# Zero Trust: Default deny all inbound
add chain=input action=drop comment="ZTNA: Block all inbound by default"
# Allow WireGuard for ZTNA
add chain=input protocol=udp port=13231 action=accept comment="ZTNA: Allow WireGuard"
# Allow established/related
add chain=input action=accept connection-state=established,related comment="ZTNA: Allow established"

# Zero Trust: Strict outbound control
add chain=output action=drop comment="ZTNA: Block all outbound by default"
add chain=output dst-address=192.168.88.0/24 action=accept comment="ZTNA: Allow LAN"
add chain=output dst-address=8.8.8.8 action=accept comment="ZTNA: Allow DNS"
add chain=output dst-address=1.1.1.1 action=accept comment="ZTNA: Allow DNS Alt"

# Zero Trust: Microsegmentation
/ip firewall filter
add chain=forward action=drop comment="ZTNA: Block all inter-VLAN by default"
add chain=forward src-address=192.168.88.10 dst-address=192.168.88.20 action=accept comment="ZTNA: Allow specific device access"

# Zero Trust: Identity-based access
/ip firewall mangle
add chain=prerouting src-address=192.168.88.50 action=mark-connection new-connection-mark=zt-trusted comment="ZTNA: Mark trusted device"
/ip firewall filter
add chain=input connection-mark=zt-trusted action=accept comment="ZTNA: Allow trusted device"

Share

Related Posts

Scroll to top

Code Copied!

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/2806328968-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AOuZoY4F4MO9soQmtmGupvRZkwyAWbZFUA:1743650391649';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d3175217394038098022','//www.mamet.my.id/2024/04/how-to-configure-zerotrust-on-mikrotik.html','3175217394038098022');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '3175217394038098022', 'title': '.rsc config', 'url': 'https://www.mamet.my.id/2024/04/how-to-configure-zerotrust-on-mikrotik.html', 'canonicalUrl': 'https://www.mamet.my.id/2024/04/how-to-configure-zerotrust-on-mikrotik.html', 'homepageUrl': 'https://www.mamet.my.id/', 'searchUrl': 'https://www.mamet.my.id/search', 'canonicalHomepageUrl': 'https://www.mamet.my.id/', 'blogspotFaviconUrl': 'https://www.mamet.my.id/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-89318309-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22.rsc config - Atom\x22 href\x3d\x22https://www.mamet.my.id/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22.rsc config - RSS\x22 href\x3d\x22https://www.mamet.my.id/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22.rsc config - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/3175217394038098022/posts/default\x22 /\x3e\n\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22.rsc config - Atom\x22 href\x3d\x22https://www.mamet.my.id/feeds/7205622301380715142/comments/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-5488749288224376', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'adsenseAutoAds': true, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/f83aabf0a8426f66', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': true, 'jumpLinkMessage': 'More \xbb', 'pageType': 'item', 'postId': '7205622301380715142', 'pageName': 'How to Configure Zerotrust on Mikrotik', 'pageTitle': '.rsc config: How to Configure Zerotrust on Mikrotik'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'How to Configure Zerotrust on Mikrotik', 'description': 'To configure Zero Trust for MikroTik, you can integrate it with Cloudflare Zero Trust services. Here are some steps you can follow: 1. Cloud...', 'url': 'https://www.mamet.my.id/2024/04/how-to-configure-zerotrust-on-mikrotik.html', 'type': 'item', 'isSingleItem': true, 'isMultipleItems': false, 'isError': false, 'isPage': false, 'isPost': true, 'isHomepage': false, 'isArchive': false, 'isLabelSearch': false, 'postId': 7205622301380715142}}, {'name': 'widgets', 'data': [{'title': '.rsc config (Header)', 'type': 'Header', 'sectionId': 'header', 'id': 'Header1'}, {'title': '', 'type': 'LinkList', 'sectionId': 'section', 'id': 'LinkList134'}, {'title': 'For you', 'type': 'Label', 'sectionId': 'label_menu_tab', 'id': 'Label1'}, {'title': '', 'type': 'HTML', 'sectionId': 'billboard_ads1', 'id': 'HTML2'}, {'title': 'Continue Reading?', 'type': 'HTML', 'sectionId': 'continue_reading', 'id': 'HTML334'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'main', 'id': 'Blog1', 'posts': [{'id': '7205622301380715142', 'title': 'How to Configure Zerotrust on Mikrotik', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'pada tanggal'}]}, 'footerBylines': [{'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': 'pada tanggal'}, {'name': 'labels', 'label': ''}]}, {'title': 'Advertisement', 'type': 'HTML', 'sectionId': 'top_ads', 'id': 'HTML90'}, {'title': 'Advertisement', 'type': 'HTML', 'sectionId': 'middle_ads_1', 'id': 'HTML91'}, {'title': 'Advertisement', 'type': 'HTML', 'sectionId': 'middle_ads_2', 'id': 'HTML93'}, {'title': 'Advertisement', 'type': 'HTML', 'sectionId': 'bottom_ads', 'id': 'HTML94'}, {'title': 'Advertisement', 'type': 'HTML', 'sectionId': 'matched_content_ads', 'id': 'HTML75'}, {'title': 'Left Bar Ads', 'type': 'HTML', 'sectionId': 'sidebar_ads', 'id': 'HTML33'}, {'title': 'Right Bar Ads', 'type': 'HTML', 'sectionId': 'sidebar_ads', 'id': 'HTML44'}, {'title': 'Support', 'type': 'LinkList', 'sectionId': 'additional_widgets', 'id': 'LinkList6'}, {'title': '', 'type': 'LinkList', 'sectionId': 'bottom_bar_menu', 'id': 'LinkList1'}, {'title': '', 'type': 'HTML', 'sectionId': 'custom_script', 'id': 'HTML5'}]}]);
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList134', 'section', document.getElementById('LinkList134'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LabelView', new _WidgetInfo('Label1', 'label_menu_tab', document.getElementById('Label1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML2', 'billboard_ads1', document.getElementById('HTML2'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML334', 'continue_reading', document.getElementById('HTML334'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/3366830891-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/1964470060-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML90', 'top_ads', document.getElementById('HTML90'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML91', 'middle_ads_1', document.getElementById('HTML91'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML93', 'middle_ads_2', document.getElementById('HTML93'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML94', 'bottom_ads', document.getElementById('HTML94'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML75', 'matched_content_ads', document.getElementById('HTML75'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML33', 'sidebar_ads', document.getElementById('HTML33'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML44', 'sidebar_ads', document.getElementById('HTML44'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList6', 'additional_widgets', document.getElementById('LinkList6'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList1', 'bottom_bar_menu', document.getElementById('LinkList1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML5', 'custom_script', document.getElementById('HTML5'), {}, 'displayModeFull'));
</script>
</body>