Firewall · Topic 6 of 7

Advanced Filter Options and ICMP Filtering

Use advanced RouterOS filter matchers such as address lists, limits, time and TCP flags, plus actions like tarpit, and filter ICMP by type and code safely.

5 min

In a nutshell

Address lists let one rule match many addresses and can be filled by rules.
connection-limit matches sources with many connections. limit and dst-limit match by rate.
The time matcher restricts a rule to hours and days.

What it is

Advanced filter options are matchers and actions that go beyond address, port and protocol.

They let you build rules that react to rates, time, flags and lists. With them a simple firewall becomes a tool that also fights scans, floods and abuse.

ICMP filtering is the careful use of these options for ICMP. The protocol is needed for diagnosis, but it is also used for scanning and floods.

How it works

Each advanced matcher narrows a rule, and each advanced action changes what the router does next.

Useful matchers

Matcher	What it does
`src-address-list`, `dst-address-list`	Match addresses held in a named list
`connection-limit`	Match when a source has more connections than a number
`limit`	Match up to a packet rate, with a burst
`dst-limit`	Like limit, but counted per address or per address and port
`time`	Match only in a time window and on chosen days
`tcp-flags`	Match packets that have chosen TCP flags set
`src-address-type`, `dst-address-type`	Match local, broadcast, multicast or unicast addresses
`in-interface-list`	Match a group of interfaces
`packet-size`	Match packets by length

Useful actions

Action	Effect
`add-src-to-address-list`	Put the source address in a list, with an optional timeout
`add-dst-to-address-list`	Put the destination address in a list
`reject`	Drop and send an ICMP error, which you can choose with `reject-with`
`tarpit`	Hold the TCP connection open and answer slowly, which wastes the attacker's resources
`jump` and `return`	Move to and from a custom chain

Examples

A time based rule allows management only in office hours.

/ip firewall filter add chain=input protocol=tcp dst-port=22 time=8h-18h,mon,tue,wed,thu,fri action=accept

A rule can also collect sources that make too many connections, and a later rule can drop them. The numbers and timeouts in these examples are only example values.

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new connection-limit=10,32 action=add-src-to-address-list address-list=ssh-abusers address-list-timeout=1d
/ip firewall filter add chain=input src-address-list=ssh-abusers action=drop

A broadcast guard drops packets that are sent to a broadcast address from outside.

/ip firewall filter add chain=forward in-interface-list=WAN dst-address-type=broadcast action=drop

The comment parameter and the disabled setting help you to document and test rules without deleting them.

ICMP types and codes

ICMP messages have a type and a code. In RouterOS you match them with icmp-options in the form type:code.

Message	Type and code
Echo reply	0:0
Destination unreachable	3 with codes such as 0, 1, 3 and 4
Redirect	5
Echo request (ping)	8:0
Time exceeded	11

Code 4 of type 3 is the fragmentation needed message, which path MTU discovery relies on. Time exceeded is what traceroute uses.

A safe ICMP policy

Do not drop all ICMP, because that breaks diagnosis and path MTU discovery. Accept the useful types, limit echo requests, and drop the rest.

/ip firewall filter add chain=input protocol=icmp icmp-options=8:0 limit=5,10:packet action=accept
/ip firewall filter add chain=input protocol=icmp icmp-options=0:0 action=accept
/ip firewall filter add chain=input protocol=icmp icmp-options=3:4 action=accept
/ip firewall filter add chain=input protocol=icmp icmp-options=11:0 action=accept
/ip firewall filter add chain=input protocol=icmp action=drop

The numbers in limit are an example. The same pattern works on the forward chain for traffic through the router.

Exam tip

Limit echo requests instead of blocking them. You keep ping for troubleshooting and still slow down a ping flood.

What to remember for the exam

Eight facts summarise this topic.

Address lists let one rule match many addresses and can be filled by rules.
connection-limit matches sources with many connections. limit and dst-limit match by rate.
The time matcher restricts a rule to hours and days.
tarpit holds a TCP connection and wastes the attacker's time.
reject sends an ICMP error. drop is silent.
ICMP is matched with icmp-options as type:code.
Echo request is 8:0 and echo reply is 0:0.
Do not block all ICMP. Allow the needed types and limit echo requests.

Common mistakes

Four mistakes appear in ICMP and advanced rules.

Dropping all ICMP. Path MTU discovery and traceroute break, and users see strange stalls.

Forgetting that limit matches up to the rate. A rule with limit and action=accept accepts packets within the rate. The packets beyond it fall through to the next rule.

Using tarpit on the wrong traffic. It is meant for hostile TCP connections and not for real clients.

Keeping address list entries forever. Add a timeout, or the list grows and may block users that changed address.

Watch out

A time rule uses the router clock. Set the correct time zone and NTP first, or the window will be wrong.

Check yourself

Work through these three questions.

Which parameter matches an ICMP echo request?
Use icmp-options=8:0. The echo reply is 0:0.
Why should a firewall not drop all ICMP?
Path MTU discovery and traceroute need some ICMP types, so blocking everything breaks them. Allow the needed types and limit echo requests.
What does the tarpit action do?
It holds the TCP connection open and answers slowly. This wastes the attacker's resources.

Topic 6 of 7 in Firewall

Test yourself on Firewall

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.