Chapter 6 of 9 · MikroTik MTCNA
Firewall
Connection tracking, chains and actions, filter rules, address lists, source and destination NAT, and FastTrack.
- 6topics
- 32 minfast track
- 3diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Firewall Principles, Connection Tracking, Chains and ActionsLearn how the RouterOS firewall tracks connections and their states, how its tables and chains are organised, and how rules are…Diagram6 min
- 2Firewall Filter in Action, Protecting the Router and the CustomersBuild RouterOS filter rules that protect the router with the input chain and protect the hosts behind it with the forward chain…5 min
- 3Firewall Address ListsGroup addresses into named firewall address lists, use them in filter rules, and fill lists automatically with timeouts to build…5 min
- 4Source NAT with Masquerade and src-natLearn how source NAT rewrites private source addresses on RouterOS, and when to choose the masquerade action or the src-nat…5 min
- 5Destination NAT with dst-nat and RedirectLearn how destination NAT publishes an internal server with the dst-nat action, how redirect targets the router itself, and how…Diagram6 min
- 6FastTrack and Faster ForwardingLearn what RouterOS FastTrack does, how the fasttrack-connection action and its companion accept rule work, and which features it…Diagram5 min
About this chapter
What this chapter covers
The firewall decides which packets may enter, cross and leave a RouterOS device, and it can rewrite their addresses.
The chapter starts with the principles: connection tracking, states, chains and actions. It then uses them for filter rules, address lists and the two kinds of NAT, and it ends with FastTrack, which speeds up forwarding.
How the topics fit together
The first page gives the model, and the other pages are tools built on it.
Everything depends on connection tracking. The router remembers each connection, which lets rules accept replies and lets NAT translate both directions.
On top of that sit the filter rules, which protect the router and the hosts behind it. Address lists make those rules shorter, and NAT lets private hosts share an address or publish servers. FastTrack comes last, because it deliberately skips parts of the processing you have just learned.
Keep four ideas in mind across the pages:
- Rules are checked from the top, and the first match wins.
- The input chain protects the router, and the forward chain protects the hosts.
- The srcnat chain handles outgoing translation, and the dstnat chain handles incoming translation.
- FastTrack skips filter, mangle and simple queues for established traffic.
A NAT rule changes addresses, but the filter rules still decide whether the packet may pass.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and console examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Practise with a router and two hosts, one on each side. Write a rule, send some traffic, and read the rule counters to see whether the rule matched.
Ready for more practice?
The full MikroTik MTCNA question bank has 558 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.