RouterOS Firewall/en

With the firewall we can filter packages and enable other kinds of security options, which either block or allow access to the network / router. Used in unison with a NAT, this significantly helps in blocking unauthorized outside access to your internal network.

RouterOS firewall mainly follows the same logic as Linux when it comes to Iptables.

Firewall settings are in the RouterOS system:

 /ip firewall

• 

Filter Rules

With filter rules you can limit the transmission of packages to the router or through the router. Note, that in the RouterOS operating system firewall rules are created from the top down.

Basic firewall

In our example we create a secure and basic RouterOS firewall which suits the needs of all basic users.

First we create a new allow rule, which always allows connecting to the router from whatever network and with whatever protocol. You should do this in order to not accidentally lock yourself outside of the router while you work.

 /ip firewall filter add chain=input action=accept

• 
• 

We create a second firewall rule which allows traffic through the router. The connection must be trusted though.

 /ip firewall filter add chain=forward  connection-state=established,related action=accept 

• 
• 

We block invalid connections from going through the router.

 /ip firewall filter add chain=forward connection-state=invalid action=drop

• 
• 

Next we select the ICMP protocol, the so called ping protocol. This allows the routed to be pinged with a client device, which is connected to the Mikrotik. Useful for troubleshooting.

 /ip firewall filter add chain=input protocol=icmp action=accept

• 
• 

Next we create a rule which blocks incoming traffic from the ether1 (WAN) port.

 /ip firewall filter add chain=input in-interface=ether1 action=drop

• 
• 

Now we have the basic firewall configurations set up. The firewall works from the top to down (0 ->) along the list. By default everything is allowed unless otherwise is mentioned.

 /ip firewall filter print

• 

Block outside access to the management ports

We block outside network access to the management ports, 21, 22, 23 and 80. An attacker would first have to access your internal network to access the router.

 /ip firewall filter add chain=input protocol=tcp dst-port=21,22,23,80 in-interface=ether1 action=drop

NAT

We have a separate article on RouterOS NAT.

Mangle

With Mangle you can mark different packets with different signs. You can tag some packets with the mark and use them for instance in RouterOS Queue, NAT and routing. Mangle's marks are just the router's own marks so they aren't transferred forward across the network in the packets.

Marking Packets

We mark, for instance the packets going through the interface ether1-gateway port 80.

 /ip firewall mangle add chain=forward protocol=tcp dst-port=80 in-interface=ether1-gateway action=mark-packet new-packet-mark=HTTP

• 
• 

Related info

• RouterOS Queue
• RouterOS NAT

Sources

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle