MikroTik RouterOS 7 Basic Internet Setup

Choose the right starting point

A factory-configured home router often already has a bridge, DHCP server and firewall. Keep that working configuration and change only what your ISP or LAN needs. The manual build below is for an empty lab configuration, not a reset instruction.

Keep a recovery path. Use a local cable or console and RouterOS Safe Mode (Ctrl+X in the terminal). Confirm management is permitted before any final drop rule. Open a second session to test new access before committing. These examples assume the named objects do not already exist; inspect an existing configuration instead of pasting a second baseline over it.

Topology: ISP → ether1 (WAN) → router → br-lan (ether2–ether4). The LAN is 10.42.50.0/24; the router is .1. Set the local administration computer to .10/24, gateway .1. DHCP leases use .100–.199 so they cannot collide with that computer. Keep the WAN cable disconnected until both firewall families and management restrictions are in place.

1. Create the LAN and interface lists

RouterOS 7

/interface/bridge/add name=br-lan
/interface/bridge/port
add bridge=br-lan interface=ether2
add bridge=br-lan interface=ether3
add bridge=br-lan interface=ether4
/interface/list
add name=WAN
add name=LAN
/interface/list/member
add list=WAN interface=ether1
add list=LAN interface=br-lan
/ip/address/add address=10.42.50.1/24 interface=br-lan
/ip/pool/add name=lan-pool ranges=10.42.50.100-10.42.50.199
/ip/dhcp-server/add name=lan-dhcp interface=br-lan address-pool=lan-pool disabled=no
/ip/dhcp-server/network/add address=10.42.50.0/24 gateway=10.42.50.1 dns-server=10.42.50.1
/ip/dns/set allow-remote-requests=yes

The bridge, not each member port, owns the LAN IP and DHCP server. The DNS cache is reachable only through the LAN rules below. This example later accepts ISP-provided resolvers; if that is unsuitable, set approved DNS servers explicitly and use use-peer-dns=no.

2. Protect the router and transit traffic

This policy permits SSH/WinBox only from the chosen wired admin address. Adjust that address before applying. WebFig is not opened. The forward policy permits outbound LAN traffic and replies; new inbound port forwards need a separate narrow allow rule.

RouterOS 7

/ip/firewall/filter
add chain=input action=accept connection-state=established,related comment="Return traffic to router"
add chain=input action=drop connection-state=invalid comment="Reject invalid state"
add chain=input action=accept in-interface-list=WAN protocol=udp src-port=67 dst-port=68 comment="WAN DHCP reply"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=67 comment="LAN DHCP requests"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=53 comment="LAN DNS UDP"
add chain=input action=accept in-interface-list=LAN protocol=tcp dst-port=53 comment="LAN DNS TCP"
add chain=input action=accept in-interface-list=LAN src-address=10.42.50.10 protocol=tcp dst-port=22,8291 comment="Admin workstation only"
add chain=input action=accept protocol=icmp comment="IPv4 diagnostics and errors"
add chain=input action=drop comment="Deny other router input"
add chain=forward action=accept connection-state=established,related comment="Return traffic through router"
add chain=forward action=drop connection-state=invalid comment="Reject invalid forwarding"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="LAN Internet access"
add chain=forward action=drop comment="Deny other forwarding"

Install the IPv6 baseline too, even if you plan IPv4 first. This does not configure IPv6 addresses, prefix delegation or LAN advertisements. Management remains on the explicit IPv4 path; if using a DHCPv6 relay, check its reply source rather than assuming link-local.

RouterOS 7

/ipv6/firewall/filter
add chain=input action=accept connection-state=established,related
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmpv6 comment="Neighbor discovery and IPv6 errors"
add chain=input action=accept in-interface-list=WAN src-address=fe80::/10 protocol=udp src-port=547 dst-port=546 comment="Direct-link DHCPv6 replies"
add chain=input action=drop comment="IPv6 management uses no implicit LAN trust"
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=invalid
add chain=forward action=accept protocol=icmpv6 comment="Allow IPv6 diagnostics and PMTU"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN
add chain=forward action=drop

3. Limit management and connect the WAN

Set a unique administrator password through the local management session. IP firewall rules do not control MAC-based management, so restrict it separately.

RouterOS 7

/ip/service/disable [find name=telnet]
/ip/service/disable [find name=ftp]
/ip/service/disable [find name=www]
/ip/service/disable [find name=api]
/ip/service/disable [find name=api-ssl]
/tool/mac-server/set allowed-interface-list=none
/tool/mac-server/mac-winbox/set allowed-interface-list=LAN
/ip/neighbor/discovery-settings/set discover-interface-list=LAN
/ip/firewall/nat/add chain=srcnat out-interface-list=WAN src-address=10.42.50.0/24 action=masquerade
/ip/dhcp-client/add interface=ether1 add-default-route=yes use-peer-dns=yes disabled=no

Connect ether1 to the ISP. DHCP supplies the WAN address and, when offered, a default route. Masquerade follows that dynamic WAN address. PPPoE or an ISP VLAN needs a different WAN interface; put the actual routed uplink in the WAN list, not just its underlying cable.

4. Verify from both sides

RouterOS 7

/ip/dhcp-client/print detail
/ip/address/print
/ip/route/print detail
/ip/dhcp-server/lease/print
/ip/firewall/filter/print stats
/ip/firewall/nat/print stats
/ip/dns/print

Check for a bound DHCP client and an active default route. From the admin PC, reach .1, open a second management session, then test a known reachable Internet address and a hostname. From a separate external network, confirm management is blocked. Recheck new sessions after changes: established connections can survive a rule change.

Firewall reasoning · NAT and port forwarding · Check your LAN range

Kernaali Tools is not affiliated with MikroTik.

Technical references

Found an issue? Send a correction with a reproducible example.