firewall changes

Author: chkpwd

terraform/mikrotik/firewall.tf

@@ -6,8 +6,6 @@ locals {
     { address = "192.168.0.0/16", comment = "rfc1918", list = "private_addr" },
     { address = "10.0.30.2", comment = "jellyfin access", list = "media_clients" },
     { address = "10.0.30.3", comment = "jellyfin access", list = "media_clients" },
-    { address = "10.0.30.5", comment = "jellyfin access", list = "media_clients" },
-    { address = "10.0.30.17", comment = "jellyfin access", list = "media_clients" },
   ]
 
   # - Uses stable map keys (not array indices) so adding/removing rules doesn't cascade changes
@@ -46,7 +44,7 @@ locals {
     forward_iot_wan                  = { order = 220, chain = "forward", action = "accept", comment = "allow iot -> WAN", in_interface = "iot", out_interface_list = "WAN" }
     forward_iot_drop_local           = { order = 230, chain = "forward", action = "drop", comment = "drop local access on iot net", dst_address_list = "private_addr", in_interface = "iot" }
     forward_iot_drop_all             = { order = 240, chain = "forward", action = "drop", comment = "drop all other forward from iot", in_interface = "iot" }
-    forward_guest_ha_tcp             = { order = 310, chain = "forward", action = "accept", comment = "allow home assistant from guest", protocol = "tcp", dst_address = "10.0.10.8", dst_port = "8123", in_interface = "guest" }
+    forward_guest_ha_tcp             = { order = 310, chain = "forward", action = "accept", comment = "allow home assistant from guest", protocol = "tcp", dst_address = "10.0.20.4", dst_port = "8123", in_interface = "guest" }
     forward_jellyfin_guest           = { order = 315, chain = "forward", action = "accept", comment = "allow jellyfin from media_clients", protocol = "tcp", dst_address = "10.0.45.37", dst_port = "8096", src_address_list = "media_clients", in_interface = "guest" }
     forward_immich_guest             = { order = 320, chain = "forward", action = "accept", comment = "allow immich from media_clients", protocol = "tcp", dst_address = "10.0.45.38", dst_port = "2283", src_address_list = "media_clients", in_interface = "guest" }
     forward_guest_dns_udp            = { order = 400, chain = "forward", action = "accept", comment = "allow guest DNS (UDP)", protocol = "udp", dst_address = var.dns_ip, dst_port = "53", in_interface = "guest" }

terraform/mikrotik/interfaces.tf

@@ -11,14 +11,14 @@ resource "routeros_interface_bridge" "bridge" {
 
 resource "routeros_interface_bridge_port" "bridge_ports" {
   for_each = {
-    ether2       = { pvid = 1, frame_types = "admit-all" }
-    ether3       = { pvid = 1, frame_types = "admit-all" }
-    ether4       = { pvid = 20, frame_types = "admit-only-untagged-and-priority-tagged" }
-    ether5       = { pvid = 1, frame_types = "admit-all" }
-    ether6       = { pvid = 1, frame_types = "admit-all" }
-    ether7       = { pvid = 1, frame_types = "admit-all" }
-    ether8       = { pvid = 1, frame_types = "admit-all" }
-    sfp-sfpplus1 = { pvid = 1, frame_types = "admit-all" }
+    ether1 = { pvid = 1, frame_types = "admit-all" }
+    ether2 = { pvid = 1, frame_types = "admit-all" }
+    ether3 = { pvid = 1, frame_types = "admit-all" }
+    ether4 = { pvid = 20, frame_types = "admit-only-untagged-and-priority-tagged" }
+    ether5 = { pvid = 1, frame_types = "admit-all" }
+    ether6 = { pvid = 1, frame_types = "admit-all" }
+    ether7 = { pvid = 1, frame_types = "admit-all" }
+    ether8 = { pvid = 1, frame_types = "admit-all" }
   }
 
   bridge      = routeros_interface_bridge.bridge.name
@@ -47,7 +47,7 @@ resource "routeros_interface_bridge_vlan" "tagged" {
   comment  = each.key
   bridge   = routeros_interface_bridge.bridge.name
   vlan_ids = [each.value.vlan_id]
-  tagged   = ["bridge", "ether2"]
+  tagged   = ["bridge", "ether1"]
   untagged = each.value.untagged_ports
 }
 
@@ -56,7 +56,7 @@ resource "routeros_interface_list" "wan" { name = "WAN" }
 resource "routeros_interface_list" "lan" { name = "LAN" }
 
 resource "routeros_interface_list_member" "wan" {
-  interface = "ether1"
+  interface = "sfp-sfpplus1"
   list      = routeros_interface_list.wan.name
 }
 
@@ -94,5 +94,5 @@ resource "routeros_ip_address" "wireguard" {
 }
 
 resource "routeros_ip_dhcp_client" "wan" {
-  interface = "ether1"
+  interface = "sfp-sfpplus1"
 }

terraform/mikrotik/leases.json

@@ -64,8 +64,8 @@
   "iot": [
     {
       "name": "print-srv-01",
-      "address": "10.0.20.3",
-      "mac": "e4:5f:01:62:47:f2"
+      "address": "10.0.20.7",
+      "mac": "e4:5f:01:62:47:f3"
     },
     {
       "name": "3d-printer-esp",
@@ -76,6 +76,26 @@
       "name": "ratgdo32-disco-esp",
       "address": "10.0.20.11",
       "mac": "14:33:5c:09:58:a8"
+    },
+    {
+      "name": "haos",
+      "address": "10.0.20.4",
+      "mac": "18:66:DA:14:E7:9F"
+    },
+    {
+      "name": "rlnk-doorbell",
+      "address": "10.0.20.5",
+      "mac": "50:37:CD:F5:EF:9B"
+    },
+    {
+      "name": "slzb-ultima",
+      "address": "10.0.20.6",
+      "mac": "9E:13:9E:33:D2:7C"
+    },
+    {
+      "name": "tesla-charger",
+      "address": "10.0.20.8",
+      "mac": "98:ED:5C:93:F5:85"
     }
   ],
   "lan": [
@@ -89,11 +109,6 @@
       "address": "10.0.10.15",
       "mac": "bc:24:11:ea:6b:79"
     },
-    {
-      "name": "haos-srv-01",
-      "address": "10.0.10.8",
-      "mac": "00:50:56:a7:ca:ff"
-    },
     {
       "name": "pve-srv-01",
       "address": "10.0.10.3",