Firewall · Topic 3 of 7

The RAW Table and SYN Flood Mitigation

Learn how the RouterOS RAW table drops or exempts traffic before connection tracking, and how to limit SYN floods with raw rules and address lists.

  • 5 min
In a nutshell
  • The raw table runs before connection tracking.
  • Its two chains are prerouting and output.
  • It cannot match connection-state, because no state exists yet.

What it is

The RAW table is a firewall table that works before connection tracking.

Because it acts so early, a raw rule costs the router much less than a filter rule. This makes it the best place to drop unwanted traffic during a flood.

The raw table has only two chains, prerouting and output. Packets for the router, through the router and from the router all pass one of them.

PacketarrivesfirstRAW preroutingdrop or notrackthenConnection trackingstates are setthenMangle, NAT, Filternormal rules

How it works

The raw table decides before any state exists, so its rules are limited but fast.

What raw can and cannot do

The raw table can use matchers that look at the packet itself, such as address, port, protocol and TCP flags. It cannot use connection-state, because tracking has not happened yet.

ActionEffect in the raw table
acceptStop raw processing and send the packet on to tracking
dropDiscard the packet before tracking
notrackSkip connection tracking for the packet
jump, return, log, passthroughSame meaning as in other tables

Packets that carry notrack get the state untracked. Such packets also cannot be natted, because NAT needs tracking.

Dropping early

If you know that some sources are never valid, drop them in raw. The router then does no tracking work for them.

/ip firewall address-list add list=bogons address=10.0.0.0/8
/ip firewall address-list add list=bogons address=172.16.0.0/12
/ip firewall raw add chain=prerouting in-interface=ether1 src-address-list=bogons action=drop

This example drops private source addresses that arrive from the outside interface. Do not use it on a network where the outside link legitimately uses private addresses.

SYN flood mitigation

In a SYN flood the attacker sends a large number of TCP connection requests, each with the SYN flag. The server keeps half open connections and runs out of resources.

Raw can limit the rate of SYN packets to a protected service. The first rule accepts SYN packets up to a rate, and the second rule drops the rest.

/ip firewall raw add chain=prerouting protocol=tcp tcp-flags=syn dst-address=203.0.113.10 dst-port=80 limit=500,100:packet action=accept
/ip firewall raw add chain=prerouting protocol=tcp tcp-flags=syn dst-address=203.0.113.10 dst-port=80 action=drop

The limit value has the form rate, burst and mode. The numbers here are examples, and you must tune them to the normal load of your server.

A second approach is to drop SYN packets that are aimed at ports where no service runs.

/ip firewall raw add chain=prerouting protocol=tcp tcp-flags=syn dst-address=203.0.113.10 dst-port=!80,443 action=drop

The ! means not, so the rule drops SYN packets to any port other than 80 and 443.

Dropping known attackers

Sources that were already collected in an address list can be dropped in raw, before tracking.

/ip firewall raw add chain=prerouting protocol=tcp tcp-flags=syn src-address-list=syn-attackers action=drop

The list is filled by a filter rule that detects too many connections from one source. The SYN and UDP attacks page shows that rule.

SYN cookies

RouterOS can also answer SYN requests with a cookie, so that it holds no state for a half open connection. This protects the router itself and is a setting under /ip settings.

/ip settings set tcp-syncookies=yes
Exam tip

Raw is the cheapest place to drop a flood, so use it for traffic that you know is bad. Keep stateful rules in the filter table.

What to remember for the exam

Seven facts summarise the RAW table.

  • The raw table runs before connection tracking.
  • Its two chains are prerouting and output.
  • It cannot match connection-state, because no state exists yet.
  • The notrack action skips tracking, and untracked packets cannot be natted.
  • Dropping in raw saves more CPU than dropping in filter.
  • A SYN flood is a flood of TCP packets with the SYN flag set.
  • Mitigation uses limits, drops for unused ports, and raw drops for address lists of attackers.

Common mistakes

Four mistakes appear with raw rules.

Using connection-state in the raw table. The state does not exist yet, so the rule cannot work as intended.

Using notrack on traffic that needs NAT. The packets skip tracking, so NAT does not apply to them.

Setting limits that are too low. Real users send bursts, and a tight limit drops legitimate connection requests.

Dropping legitimate private sources. Check your network before you drop private ranges on the outside interface.

Watch out

An accept rule in the raw table does not skip the rest of the firewall. It only stops raw processing and lets the packet continue to tracking.

Check yourself

Work through these three questions.

  • Why is dropping packets in the raw table cheaper than in the filter table?

    The raw table runs before connection tracking, so the router does no tracking work for the dropped packets.

  • What does the notrack action do?

    It makes the packet skip connection tracking, so its state is untracked. Such packets cannot be natted.

  • How can raw rules reduce a SYN flood against a web server?

    One rule accepts SYN packets up to a limit and a later rule drops the excess. You can also drop SYN packets to ports that have no service, or drop sources that are already in an attacker address list.

Topic 3 of 7 in Firewall

Test yourself on Firewall

The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.