MikroTik Firewall Basics: Input, Forward, and Output Chains

MikroTik Firewall Chains: Understanding input, forward, and output

The firewall is one of the most important features in RouterOS. It lets you control exactly which traffic is allowed through your router and which is blocked. This lesson covers the fundamental concepts: firewall chains, how packets flow through them, and how to write basic rules.

How Packets Travel Through RouterOS

Before writing firewall rules, you need to understand how RouterOS processes packets. There are three paths a packet can take:

The input Chain

The input chain handles packets destined for the router itself. Examples:

• Someone trying to SSH into your router (port 22)
• Someone trying to connect to Winbox (port 8291)
• Ping requests to your router IP
• DHCP requests received by the router

Rule of thumb: input = traffic going TO the router, not through it.

The forward Chain

The forward chain handles packets that pass through the router from one interface to another. Examples:

• A device on your LAN browsing the Internet (LAN to WAN)
• Traffic between two VLANs
• Any routed traffic that is not for the router itself

Rule of thumb: forward = traffic going THROUGH the router.

The output Chain

The output chain handles packets generated by the router itself. Examples:

• The router sending a ping (/ping 8.8.8.8)
• The router sending DNS queries
• RouterOS sending NTP time sync packets

Rule of thumb: output = traffic FROM the router. Rarely modified by beginners.

The Default-Deny Philosophy

A properly secured router uses a default-deny approach:

1. Explicitly allow what you want to permit
2. Drop everything else at the end

This is much safer than "allow everything except what you explicitly block."

The classic firewall chain order:

1. Accept established/related traffic (connections already in progress)
2. Drop invalid traffic
3. Accept specific wanted traffic
4. Drop everything else (catch-all drop at the bottom)

RouterOS Firewall Rule Order

Rules are evaluated top to bottom. The first rule that matches a packet wins. This is critical — put more specific rules before more general ones.

/ip firewall filter print

Rules are numbered. If rule 0 matches a packet, rules 1, 2, 3 etc. are not checked for that packet.

Connection Tracking

RouterOS tracks the state of connections using connection tracking. Each packet is classified as:

• established — part of an already-accepted connection
• related — related to an established connection (e.g., FTP data channel)
• new — starting a new connection
• invalid — does not match any known connection state

This lets you write simple rules like "accept all established traffic" rather than writing rules for both directions of every connection.

Building a Basic Firewall: input Chain

Here is a safe default configuration for the input chain:

# Accept established and related connections (traffic from sessions already allowed)
/ip firewall filter add chain=input connection-state=established,related action=accept comment=accept-established-related

# Drop invalid packets
/ip firewall filter add chain=input connection-state=invalid action=drop comment=drop-invalid

# Accept ICMP (ping) from anywhere (optional, remove if you want to be stealthy)
/ip firewall filter add chain=input protocol=icmp action=accept comment=accept-icmp

# Accept management traffic from LAN only
/ip firewall filter add chain=input in-interface=bridge action=accept comment=accept-from-lan

# Drop everything else coming into the router (especially from WAN)
/ip firewall filter add chain=input action=drop comment=drop-all-else

This configuration:

• Allows all ongoing connections to continue
• Drops bad/invalid packets
• Allows ping
• Allows full management from LAN
• Blocks everything arriving from the WAN (Internet)

Building a Basic Firewall: forward Chain

# Accept established and related connections
/ip firewall filter add chain=forward connection-state=established,related action=accept comment=accept-established-related

# Drop invalid packets
/ip firewall filter add chain=forward connection-state=invalid action=drop comment=drop-invalid

# Accept LAN to WAN traffic (allow your clients to reach the Internet)
/ip firewall filter add chain=forward in-interface=bridge out-interface=ether1 action=accept comment=lan-to-wan

# Drop everything else
/ip firewall filter add chain=forward action=drop comment=drop-all-else

Viewing Firewall Rules

/ip firewall filter print

To see rules with hit counters (how many packets matched each rule):

/ip firewall filter print stats

This is very useful for troubleshooting — a rule with zero hits may not be placed correctly.

Reordering Rules

Rules are applied in order. You can move them with:

/ip firewall filter move 5 destination=0

This moves rule 5 to position 0 (the top).

Disabling and Enabling Rules

Instead of deleting a rule, disable it for testing:

/ip firewall filter disable 3
/ip firewall filter enable 3

Removing Rules

/ip firewall filter remove 3

Be careful with the default-deny drop rule at the bottom — removing it might open everything.

Logging Traffic

To log packets matching a rule (useful for debugging):

/ip firewall filter add chain=input protocol=tcp dst-port=22 action=log log-prefix=SSH-ATTEMPT

View logs:

/log print

The address-list Feature

You can group IP addresses into named lists for easier rule management:

# Create a list
/ip firewall address-list add list=trusted-admins address=192.168.1.10

# Use the list in a rule
/ip firewall filter add chain=input src-address-list=trusted-admins action=accept

Summary

Firewall chains in RouterOS:

• input — traffic TO the router
• forward — traffic THROUGH the router
• output — traffic FROM the router

Always use the default-deny pattern: accept what you need, drop everything else at the bottom. Use connection-state matching (established, related, invalid) to simplify your rules. Use print stats to verify your rules are actually matching traffic.