Chapter 2 of 6 · MikroTik MTCSE
Firewall
Packet flow, stateful rules, RAW table, default setup, attack detection, advanced filters and bridge filter.
- 7topics
- 35 minfast track
- 1diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Packet Flow and Firewall ChainsLearn how packets travel through RouterOS, which chains exist in the raw, mangle, nat and filter tables, and how firewall rules…Diagram5 min
- 2Stateful Firewall and Connection TrackingUnderstand RouterOS connection tracking and connection states new, established, related, invalid and untracked, and how to build…5 min
- 3The RAW Table and SYN Flood MitigationLearn how the RouterOS RAW table drops or exempts traffic before connection tracking, and how to limit SYN floods with raw rules…5 min
- 4Default Configuration and Management AccessRead the RouterOS default firewall configuration and learn best practices to limit management access with address lists, service…5 min
- 5Detecting an Attack on Critical Infrastructure ServicesLearn how to spot an attack on services such as DNS or web on RouterOS using counters, logging, Torch, the profiler and address…5 min
- 6Advanced Filter Options and ICMP FilteringUse advanced RouterOS filter matchers such as address lists, limits, time and TCP flags, plus actions like tarpit, and filter…5 min
- 7Bridge Filter and Layer 2 FirewallingLearn how the RouterOS bridge filter checks Ethernet frames at Layer 2, its chains, and how to block rogue DHCP servers, MAC…5 min
About this chapter
What this chapter covers
The Firewall chapter is the core of the MikroTik security course, because most defences are built from firewall rules.
It starts with how a packet travels through RouterOS and which chains it meets. It then covers stateful filtering, the RAW table, the default rule set and the way to limit management access. The last pages deal with detecting attacks, advanced filter options, ICMP filtering and the Layer 2 bridge filter.
You should already know how to add an IP address, a route and a simple NAT rule before you begin.
How the topics fit together
The pages build from the path of a packet to the tools that defend it.
Packet flow comes first because every later rule needs a chain. The stateful page then shows the standard accept and drop pattern that protects the router and the clients. The RAW page moves the cheap drops before connection tracking, and uses it against SYN floods.
The default configuration page shows a finished example and adds best practice for management access. The detection page teaches you to notice trouble.
The advanced options and ICMP page give you finer matchers and actions. The bridge filter page ends the chapter with the Layer 2 view.
The IP firewall sees only routed traffic by default. Traffic that is only switched in a bridge needs the bridge filter.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and console examples.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Firewall skills come from practice. Build each example on a lab router, then read the rule list from top to bottom and predict what happens to a packet before you test it. Use safe mode while you work, so that a wrong rule does not lock you out.
Ready for more practice?
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.