Security

Final security checklist for a MikroTik network: baseline, VLANs, firewall, Wi-Fi, IPv6, VPN, DNS, monitoring, backups, and DR.

DNS policy on MikroTik: DNS cache, DoH upstream, enforcement by VLAN, and the limits of blocking client DoH.

Isolating IoT in a separate VLAN with DHCP/DNS, firewall policy, address-lists, and controlled access from trusted segments.

A baseline firewall hardening model for MikroTik: input, forward, WAN drop, management access, and rules between VLANs.

RouterOS 7 baseline setup: access, users, services, updates, time, backup/export, and minimal management protection.

Reusable GitHub Actions workflows for Terraform, Python, and IaC repositories.