MikroTik Firewall Rules: From Beginner to Advanced

If a MikroTik router’s firewall has never been configured, the default rule effectively means “allow everything.” This leaves both the management interface and the internal network exposed. A properly configured firewall, on the other hand, stops brute-force attempts, blocks unauthorized management access, and brings traffic between segments under control. This article shows how to start from scratch and build a production-ready rule set.

Firewall Logic: In 2 Minutes

In RouterOS, every packet passes through one of three chains:

[INTERNET] → Router → [INTERNAL NETWORK]
                ↕
           Router OS
         (input chain)

Chain	What It Controls	Example
input	Traffic to the router	SSH connection, ping, VPN
forward	Traffic through the router	LAN → Internet, between VLANs
output	Traffic from the router	Packets generated by the router itself

Critical point: Packets are checked against rules from top to bottom, the first matching rule is applied, and processing stops. That is why rule order is decisive.

Default Policy

In RouterOS, if no rule is written, the action is accept. Adding a drop as the final rule is good practice:

/ip firewall filter
add chain=input action=drop comment="Catch-all drop: final rule"
add chain=forward action=drop comment="Catch-all drop: final rule"

Caution: Add these rules at the very end. To avoid cutting off currently active connections, add the established,related rule first.

---

Chains: What Do They Do?

Input Chain

Manages traffic destined for the router itself. If misconfigured, management access to the router can be left open.

What goes into input:

• SSH, Telnet, WinBox access
• SNMP queries
• DNS queries (if the router is used as a recursive resolver)
• VPN tunnel initiation (IKEv2, L2TP)
• ICMP (ping)

Forward Chain

Where most rules are written. It controls traffic passing through the router.

What goes into forward:

• Internet access for LAN devices
• Traffic between VLANs
• Access attempts from the DMZ to the internal network
• Port-forwarded (dstnat) traffic reaching its internal destination

Output Chain

Packets generated by the router itself. Few rules are usually written here, but monitoring, DNS and NTP traffic passes through it.

---

Basic Security Rules

The minimum rule set that every MikroTik router should have:

/ip firewall filter

# 1. Allow established and related connections
# Prevents active connections from being dropped
add chain=input action=accept connection-state=established,related \
    comment="01 - Accept established/related"

add chain=forward action=accept connection-state=established,related \
    comment="02 - Accept established/related (forward)"

# 2. Drop invalid packets
# TCP state machine error: spoofed or malicious packets
add chain=input action=drop connection-state=invalid \
    comment="03 - Drop invalid"

add chain=forward action=drop connection-state=invalid \
    comment="04 - Drop invalid (forward)"

# 3. Allow the loopback interface
add chain=input action=accept in-interface=lo \
    comment="05 - Accept loopback"

# 4. ICMP rate limit: ping flood protection
add chain=input action=accept protocol=icmp \
    limit=50/5s,10:packet \
    comment="06 - ICMP rate limited"

add chain=input action=drop protocol=icmp \
    comment="07 - Drop excess ICMP"

# 5. Management access: only from trusted IPs
# Put your own IP or VPN subnet here
add chain=input action=accept src-address=192.168.88.0/24 \
    protocol=tcp dst-port=22,8291,443 \
    comment="08 - Management access from LAN only"

# 6. Block WinBox and SSH from the internet
add chain=input action=drop in-interface-list=WAN \
    protocol=tcp dst-port=22,23,8291 \
    comment="09 - Block management from WAN"

# 7. Drop all other input traffic
add chain=input action=drop \
    comment="10 - Catch-all drop (input)"

# 8. Allow LAN to internet
add chain=forward action=accept in-interface-list=LAN \
    out-interface-list=WAN \
    comment="11 - LAN to WAN"

# 9. Drop all other forward traffic
add chain=forward action=drop \
    comment="12 - Catch-all drop (forward)"

Do not forget to create the interface lists:

/interface list
add name=WAN
add name=LAN

/interface list member
add interface=ether1 list=WAN
add interface=bridge-lan list=LAN

---

Using Address Lists

An address list simplifies rules by grouping IP addresses. It can also be updated dynamically.

Static Whitelist (Management Access)

/ip firewall address-list
add address=203.0.113.10 list=mgmt-whitelist comment="Off-site management IP"
add address=192.168.88.0/24 list=mgmt-whitelist comment="Internal network"

/ip firewall filter
add chain=input action=accept src-address-list=mgmt-whitelist \
    protocol=tcp dst-port=22,8291 \
    comment="Management: whitelist only"

Dynamic Brute-Force Protection

Automatically blacklist an IP after 3 failed logins:

/ip firewall filter

# Stages: count the first and second failed login
add chain=input action=add-src-to-address-list \
    protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-stage2 \
    address-list=ssh-blacklist address-list-timeout=10d \
    comment="SSH BF: 3rd attempt -> blacklist"

add chain=input action=add-src-to-address-list \
    protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh-stage1 \
    address-list=ssh-stage2 address-list-timeout=1m \
    comment="SSH BF: 2nd attempt -> stage2"

add chain=input action=add-src-to-address-list \
    protocol=tcp dst-port=22 connection-state=new \
    address-list=ssh-stage1 address-list-timeout=1m \
    comment="SSH BF: 1st attempt -> stage1"

# Drop the IPs on the blacklist
add chain=input action=drop src-address-list=ssh-blacklist \
    comment="SSH BF: Drop blacklisted"

Practical tip: Place these rules before the SSH rules. Rule order is critical.

---

Layer 7 Protocol Filtering

L7 filtering scans every packet with regex. Because it is CPU-intensive, use it carefully at high traffic.

When to Use It?

• When port-based blocking is not enough (if BitTorrent uses different ports)
• When you need to distinguish specific protocols within the traffic

Example: Blocking Torrents

/ip firewall layer7-protocol
add name=bittorrent regexp="^(\x13bittorrent|azaq|\x04-?\x00\x00\x00)"

/ip firewall filter
add chain=forward action=drop layer7-protocol=bittorrent \
    comment="L7: Drop BitTorrent"

Performance Warning

The L7 filter inspects the first 10 packets or the first 2KB. As bandwidth increases, the CPU load rises proportionally. At 100+ Mbps traffic, connection mark or Simple Queue may be preferable to L7.

---

NAT Rules

srcnat: Masquerade

For internet access of LAN devices:

/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN \
    comment="Masquerade: LAN to WAN"

dstnat: Port Forwarding

Access to an internal server from outside:

# Web server (80/443) -> forward to 192.168.88.100
/ip firewall nat
add chain=dstnat action=dst-nat \
    protocol=tcp dst-port=80,443 in-interface-list=WAN \
    to-addresses=192.168.88.100 to-ports=80,443 \
    comment="Port forward: Web server"

# RDP -> allow only traffic coming from the VPN
add chain=dstnat action=dst-nat \
    protocol=tcp dst-port=3389 in-interface=ovpn-server \
    src-address-list=vpn-users \
    to-addresses=192.168.88.50 to-ports=3389 \
    comment="Port forward: RDP (VPN only)"

Hairpin NAT

Scenario: a PC on the internal network tries to connect to company.com (83.45.12.10). This IP actually forwards to a server on the same network. If the router does not support this, the connection fails.

/ip firewall nat
add chain=srcnat action=masquerade \
    out-interface=bridge-lan \
    dst-address=192.168.88.100 \
    comment="Hairpin NAT: internal server via public IP"

---

Connection Tracking

The ConnTrack table tracks all active connections. On large networks it affects performance.

# View the current connection tracking table
/ip firewall connection print

Timeout Settings (ISP/Large Network)

/ip firewall connection tracking
set tcp-established-timeout=1d
set tcp-time-wait-timeout=10s
set tcp-syn-received-timeout=5s
set udp-timeout=10s
set udp-stream-timeout=1m

On small networks the default values are sufficient. At 10,000+ concurrent connections the table fills up and packet loss begins.

---

Firewall Log Analysis

Logging rules makes troubleshooting easier, but if too many rules are logged, disk and CPU are affected.

Selective Logging

# Log only dropped and suspicious packets
/ip firewall filter
add chain=input action=log log-prefix="[DROP-INPUT] " \
    connection-state=new in-interface-list=WAN \
    comment="Log: New connections from WAN (debug)"

Graylog Integration

/system logging action
add name=remote target=remote remote=192.168.88.200 remote-port=514 \
    bsd-syslog=yes syslog-facility=local0 syslog-severity=info

/system logging
add action=remote topics=firewall

Patterns to watch for during log analysis:

• Hundreds of connection attempts from the same IP in a short time, indicating a port scan
• dst-port=22,3389,23,445, indicating brute-force against management ports
• Large outbound data transfer from the internal network during night hours, indicating data exfiltration

---

Common Mistakes and Their Fixes

Problem: “I can’t reach the internet”

Most likely there is a catch-all drop in the forward chain, but the LAN to WAN rule is missing or the wrong interface list was used.

# Check:
/ip firewall filter print where chain=forward
# Is there a LAN to WAN rule? Is the interface list correct?

/interface list print
/interface list member print
# Is ether1 in the WAN list? Is the bridge in the LAN list?

Problem: “I can’t connect to the VPN”

The ports required for IKEv2/IPSec are not open in the input chain:

/ip firewall filter
add chain=input action=accept protocol=udp dst-port=500,4500 \
    comment="IKEv2: UDP 500/4500"
add chain=input action=accept protocol=ipsec-esp \
    comment="IPSec ESP"

Problem: “The rule doesn’t work”

Check the rule order. Look at the rule numbers in the print output:

/ip firewall filter print
# Check whether the rule is before or after the drop rule

A rule added after the catch-all drop will never run.

Problem: “WinBox suddenly won’t connect”

Brute-force protection blacklisted your own IP:

/ip firewall address-list print where list=ssh-blacklist
# Is your own IP there?
/ip firewall address-list remove [find where address=YOUR_IP]

---

Production-Ready Rule Set

SMB Router (50 Employees, 3 VLANs)

Scenario: 3 VLANs (management: 192.168.10.0/24, staff: 192.168.20.0/24, guest: 192.168.30.0/24). VPN access from outside is available.

/ip firewall filter

# === INPUT CHAIN ===
add chain=input action=accept connection-state=established,related comment="01-Input: Accept established"
add chain=input action=drop connection-state=invalid comment="02-Input: Drop invalid"
add chain=input action=accept in-interface=lo comment="03-Input: Accept loopback"
add chain=input action=accept protocol=icmp limit=50/5s,10:packet comment="04-Input: ICMP rate-limit"
add chain=input action=drop protocol=icmp comment="05-Input: Drop excess ICMP"
add chain=input action=drop src-address-list=ssh-blacklist protocol=tcp dst-port=22 comment="06-Input: Block SSH BF"
add chain=input action=add-src-to-address-list src-address-list=ssh-stage2 address-list=ssh-blacklist address-list-timeout=10d protocol=tcp dst-port=22 connection-state=new comment="07-Input: SSH BF stage3"
add chain=input action=add-src-to-address-list src-address-list=ssh-stage1 address-list=ssh-stage2 address-list-timeout=1m protocol=tcp dst-port=22 connection-state=new comment="08-Input: SSH BF stage2"
add chain=input action=add-src-to-address-list address-list=ssh-stage1 address-list-timeout=1m protocol=tcp dst-port=22 connection-state=new comment="09-Input: SSH BF stage1"
add chain=input action=accept src-address=192.168.10.0/24 protocol=tcp dst-port=22,8291,443 comment="10-Input: Management from mgmt VLAN"
add chain=input action=accept protocol=udp dst-port=500,4500 comment="11-Input: IKEv2"
add chain=input action=accept protocol=ipsec-esp comment="12-Input: IPSec ESP"
add chain=input action=drop in-interface-list=WAN comment="13-Input: Drop all WAN"

# === FORWARD CHAIN ===
add chain=forward action=accept connection-state=established,related comment="14-Fwd: Accept established"
add chain=forward action=drop connection-state=invalid comment="15-Fwd: Drop invalid"
add chain=forward action=accept in-interface=vlan10 out-interface-list=WAN comment="16-Fwd: Mgmt VLAN to WAN"
add chain=forward action=accept in-interface=vlan20 out-interface-list=WAN comment="17-Fwd: Staff VLAN to WAN"
add chain=forward action=accept in-interface=vlan30 out-interface-list=WAN comment="18-Fwd: Guest VLAN to WAN"
add chain=forward action=drop in-interface=vlan30 comment="19-Fwd: Guest VLAN isolation (no LAN access)"
add chain=forward action=accept in-interface=vlan10 out-interface=vlan20 comment="20-Fwd: Mgmt to Staff (admin access)"
add chain=forward action=drop in-interface=vlan20 out-interface=vlan10 comment="21-Fwd: Staff to Mgmt block"
add chain=forward action=drop comment="22-Fwd: Catch-all drop"

# === NAT ===
/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN comment="Masquerade"

---

Practical Tip

Before applying a new rule set, use Safe Mode:

1. In WinBox or SSH, enable Safe Mode with Ctrl+X
2. Apply the rules
3. If you do not confirm within 9 minutes, RouterOS automatically reverts to the previous state

This prevents you from cutting off your own access during remote configuration.

# Starting safe mode from SSH
/system safe-mode
# The message "Revert in: 9 minutes" appears
# Press Ctrl+D to confirm, or Ctrl+C to revert

If firewall configuration will be tested on a live system, do not skip this step.