Firewall · Topic 2 of 7
Stateful Firewall and Connection Tracking
Understand RouterOS connection tracking and connection states new, established, related, invalid and untracked, and how to build a stateful firewall.
- 5 min
- A stateful firewall decides by the state of the connection.
- RouterOS states are new, established, related, invalid and untracked.
- The parameter is
connection-stateand it accepts a comma separated list.
What it is
A stateful firewall decides what to do with a packet by looking at the connection that the packet belongs to.
A stateless filter looks at each packet alone. A stateful filter remembers the connections it has seen, so it can allow replies without a rule for every direction.
RouterOS does this with connection tracking. The tracker keeps a table of connections, and each packet is given a state.
How it works
The tracker labels every packet with a connection state, and the firewall rules match on that state.
Connection states
| State | Meaning |
|---|---|
| new | The first packet of a connection |
| established | Packets of a connection that has seen traffic both ways |
| related | A new connection that is linked to an existing one, for example a helper or an ICMP error |
| invalid | A packet that does not belong to any known connection and does not start a valid one |
| untracked | A packet that was marked to skip tracking in the raw table |
The state is matched with the connection-state parameter. You can combine states with commas.
The basic stateful rules
A stateful firewall usually has the same first rules on the input and the forward chain. Accept the good states, drop the bad one, then allow only what you choose.
/ip firewall filter add chain=input connection-state=established,related,untracked action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input in-interface-list=LAN action=accept
/ip firewall filter add chain=input action=dropThe last rule drops everything that was not accepted above it. Because the established rule comes first, replies to the router's own requests still get in.
For traffic through the router, the same idea gives clients outbound access and blocks new connections from outside.
/ip firewall filter add chain=forward connection-state=established,related,untracked action=accept
/ip firewall filter add chain=forward connection-state=invalid action=drop
/ip firewall filter add chain=forward in-interface-list=LAN action=accept
/ip firewall filter add chain=forward connection-state=new connection-nat-state=dstnat action=accept
/ip firewall filter add chain=forward action=dropThe fourth rule lets new connections through only when they were redirected by a destination NAT rule. This keeps published servers reachable and blocks the rest.
Looking at the table
/ip firewall connection print
/ip firewall connection tracking printThe first command lists the live connections. The second command shows the tracking settings and lets you turn tracking on or off.
Tracking is normally on auto. It turns on when firewall or NAT rules need it.
Fast path
A rule with action=fasttrack-connection marks an established connection so that later packets skip most of the firewall. This saves processing power. The packets also skip rules such as mangle and queues, so use it with care.
/ip firewall filter add chain=forward connection-state=established,related action=fasttrack-connection
/ip firewall filter add chain=forward connection-state=established,related action=acceptThe accept rule must follow, because the fasttrack rule only marks the connection and the packet then carries on through the chain.
Why state helps against attacks
An attacker often sends packets that look like part of a connection but are not. Without a state check, a stateless rule may pass them. The invalid rule drops them, and the final drop stops unsolicited new connections.
Put the established and related accept rule at the top of the chain. Most packets match it, so the router does less work.
What to remember for the exam
Seven facts summarise this topic.
- A stateful firewall decides by the state of the connection.
- RouterOS states are new, established, related, invalid and untracked.
- The parameter is
connection-stateand it accepts a comma separated list. - Accept established and related, drop invalid, then allow only the new traffic you choose.
- Put the established rule first, because most packets match it.
/ip firewall connection printlists the tracked connections.- Fasttrack skips most of the firewall for an established connection, so it must be used with care.
Common mistakes
Four traps appear on this topic.
Dropping new connections before allowing established ones. The reply packets are then dropped too, and the connection breaks.
Forgetting the invalid rule. Packets that fit no connection pass through to later rules.
Assuming that related means any reply. Related is a separate new connection tied to an existing one. Ordinary replies are established.
Using fasttrack without thought. Fasttracked connections bypass rules that count or shape traffic, so queues and mangle rules may stop working for them.
Disabling connection tracking breaks NAT and any rule that matches connection state. Change it only when you understand the effect.
Check yourself
Work through these three questions.
Which connection state is given to the first packet of a new connection?
The state is new. After traffic goes both ways it becomes established.
Why should the established and related accept rule be first in the chain?
Most packets belong to existing connections, so they match early and the router checks fewer rules. It also lets replies in before any drop rule.
What does the rule
connection-state=invalid action=dropremove?It drops packets that do not belong to any known connection and do not start a valid one.
Topic 2 of 7 in Firewall
Test yourself on Firewall
The full MikroTik MTCSE question bank has 446 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.