Firewall Filter in Action, Protecting the Router and the Customers

What it is

Filter rules turn the principles of the firewall into real protection.

Two jobs matter most. The first is to protect the router itself, using the input chain. The second is to protect the customers, which means the hosts behind the router, using the forward chain.

Both jobs follow the same pattern: accept the traffic you expect, drop the traffic you do not, and put the rules in the right order.

How it works

Start with the safe replies, add the explicit allows, and finish with a drop for everything else.

Filter actions

Use drop for traffic from the Internet, because it gives an attacker no information. Use reject on an internal network where users should learn that access was refused.

Protecting the router with the input chain

The input chain sees everything addressed to the router. The usual pattern has five rules.

/ip firewall filter add chain=input connection-state=established,related action=accept comment="allow replies"
/ip firewall filter add chain=input connection-state=invalid action=drop comment="drop invalid"
/ip firewall filter add chain=input protocol=icmp action=accept comment="allow ping"
/ip firewall filter add chain=input in-interface=bridge1 action=accept comment="allow LAN"
/ip firewall filter add chain=input action=drop comment="drop everything else"

Read them from the top:

1. Replies to traffic that the router started or accepted are allowed.
2. Packets that belong to no valid connection are dropped.
3. ICMP is allowed so that ping and path discovery keep working.
4. Traffic from the LAN interface is accepted, so the administrator can still manage the router.
5. Everything else is dropped. This is the rule that does the real protecting.

The order is critical. The final drop must come last, or it blocks the allow rules below it.

You can narrow the allow rules further. For instance, allow management only from one address list instead of the whole LAN.

Protecting the customers with the forward chain

The forward chain sees traffic that crosses the router. The goal is to stop unwanted traffic from reaching the LAN while letting replies and LAN initiated traffic through.

/ip firewall filter add chain=forward connection-state=established,related action=accept
/ip firewall filter add chain=forward connection-state=invalid action=drop
/ip firewall filter add chain=forward connection-state=new connection-nat-state=!dstnat in-interface=ether1 action=drop

The first rule lets replies and related traffic through. The second drops invalid packets. The third drops new connections that arrive from the WAN, except those that were created by a destination NAT rule.

The connection-nat-state=!dstnat condition keeps port forwarding working. Without it, the drop rule would also block the servers that you published on purpose.

New connections that come from the LAN are not matched by that drop, so the LAN hosts can still reach the Internet.

Blocking unwanted services for customers

You can also block specific services in the forward chain. For example, a rule can drop file sharing ports that should never cross to the Internet.

/ip firewall filter add chain=forward protocol=tcp dst-port=135-139,445 out-interface=ether1 action=drop

A rule like this belongs above the general accept rules for LAN traffic, so that it is checked first.

Checking the rules

Use the counters to confirm that the rules work as you intend.

/ip firewall filter print stats

The drop rule at the end of input should show a growing counter if the Internet is probing the router. If it stays at zero, either no traffic reaches it, or an earlier rule is accepting it.