MikroTik RouterOS 7 Firewall Basics

Which chain sees the packet?

Switching within a bridge is not automatically routed traffic. Do not expect an IP forward rule to isolate clients on the same LAN. The list LAN is a policy choice: adding an IoT VLAN to it can grant all permissions assigned to that list. Use separate lists and rules where trust differs.

A small IPv4 baseline, with assumptions

For a single trusted wired LAN, use WAN and LAN lists, 10.42.50.0/24 and an administration host at 10.42.50.10. WAN uses DHCP. LAN clients use this router for DNS and DHCP. This is a policy example for empty chains; on a configured router compare each rule with the existing order before changing anything.

/ip/firewall/filter
add chain=input action=accept connection-state=established,related comment="Return traffic to router"
add chain=input action=drop connection-state=invalid comment="Reject invalid state"
add chain=input action=accept in-interface-list=WAN protocol=udp src-port=67 dst-port=68 comment="WAN DHCP reply"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=67 comment="LAN DHCP requests"
add chain=input action=accept in-interface-list=LAN protocol=udp dst-port=53 comment="LAN DNS UDP"
add chain=input action=accept in-interface-list=LAN protocol=tcp dst-port=53 comment="LAN DNS TCP"
add chain=input action=accept in-interface-list=LAN src-address=10.42.50.10 protocol=tcp dst-port=22,8291 comment="Admin workstation only"
add chain=input action=accept protocol=icmp comment="IPv4 diagnostics and errors"
add chain=input action=drop comment="Deny other router input"
add chain=forward action=accept connection-state=established,related comment="Return traffic through router"
add chain=forward action=drop connection-state=invalid comment="Reject invalid forwarding"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="LAN Internet access"
add chain=forward action=drop comment="Deny other forwarding"

Established/related admits replies and associated traffic. Invalid drops packets connection tracking cannot classify usefully. The final drops make unmatched traffic explicit. Output remains unrestricted in this small baseline; a router-originated ping succeeding does not prove that LAN forwarding works. There is no FastTrack rule and no permissive “accept everything from WAN” exception.

IPv6 needs its own policy

Globally addressed IPv6 clients can be reachable without any port-forward mapping. Apply explicit input and forward protection before enabling IPv6 service. The example keeps management on the allowed IPv4 path, permits ICMPv6 for discovery and path-MTU operation, allows direct-link DHCPv6 client replies, and permits LAN Internet traffic.

/ipv6/firewall/filter
add chain=input action=accept connection-state=established,related
add chain=input action=drop connection-state=invalid
add chain=input action=accept protocol=icmpv6 comment="Neighbor discovery and IPv6 errors"
add chain=input action=accept in-interface-list=WAN src-address=fe80::/10 protocol=udp src-port=547 dst-port=546 comment="Direct-link DHCPv6 replies"
add chain=input action=drop comment="IPv6 management uses no implicit LAN trust"
add chain=forward action=accept connection-state=established,related
add chain=forward action=drop connection-state=invalid
add chain=forward action=accept protocol=icmpv6 comment="Allow IPv6 diagnostics and PMTU"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN
add chain=forward action=drop

This deliberately allows ICMPv6, including diagnostics. More restrictive deployments should select required ICMPv6 types using RFC 4890, not block it wholesale. If you run a DHCPv6 server or DNS service over IPv6, add the corresponding scoped input permits before the drop. A relay may send DHCPv6 replies from a non-link-local address.

Address lists, ordering and FastTrack

/ip/firewall/address-list/add list=admin-v4 address=10.42.50.10 comment="Wired administrator"

An address list lets several rules share a reviewed set of sources; it does not authorize them on its own. Replace a source-address match with the appropriate src-address-list only after confirming the list’s contents.

FastTrack can bypass much of normal firewall, queue and accounting processing for eligible traffic. Exclude flows that need IPsec, policy routing or queue treatment before enabling it. Do not add FastTrack while debugging rule counters: packets on the fast path are not evidence of normal-chain processing.

Prove the policy

Test a new allowed management session, a blocked session from another LAN address, LAN-to-WAN traffic and an external inbound attempt. Read filter counters before and after each test. Repeat for IPv6 where provisioned. Check that an earlier broad accept or established connection is not making a new rule appear to work.

/ip/firewall/filter/print stats
/ipv6/firewall/filter/print stats

Build the single-LAN topology · Add a scoped port forward · Separate VLAN trust boundaries