Chapter 2 of 6 · MikroTik MTCTCE
Firewall Filter, NAT and Mangle
Connection tracking, filter rules, NAT, NAT helpers, UPnP and mangle, with how each sits in the packet path.
- 6topics
- 30 minfast track
- 5diagrams and exhibits
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Connection TrackingLearn how RouterOS connection tracking follows connections, what the new, established, related and invalid states mean, and how…Diagram5 min
- 2Filter Chains, Actions and ConditionsLearn the RouterOS filter: input, forward and output chains, custom chains with jump and return, every filter action and the most…5 min
- 3NAT Chains, Actions and ConditionsLearn RouterOS NAT: the dstnat and srcnat chains, custom chains, every NAT action such as masquerade, dst-nat, redirect and…Diagram5 min
- 4NAT Helpers and UPnPLearn how RouterOS NAT helpers fix protocols such as FTP and SIP behind NAT, and how UPnP lets LAN applications open ports on the…5 min
- 5Mangle Chains and ActionsLearn RouterOS mangle: its five chains, custom chains, every mangle action including mark-connection and mark-packet, passthrough…Diagram5 min
- 6Mangle Advanced and Extra ConditionsLearn the advanced and extra RouterOS conditions: address lists, connection bytes, PCC, nth, time, limits, address type and…Diagram5 min
About this chapter
What this chapter covers
This chapter covers the three firewall tables in RouterOS and the connection tracking engine they all depend on.
Filter decides whether a packet may pass. NAT rewrites addresses and ports. Mangle marks and changes packets so that other features, such as queues and routing, can act on them.
It also covers NAT helpers and UPnP, which exist to make applications work through NAT.
How the topics fit together
Connection tracking comes first, because the other tables use its connection states and its connections.
The line above shows the path of a forwarded packet. The order is different for packets to or from the router, so keep the packet flow diagram from the previous chapter in mind.
- Connection tracking gives every packet a state and ties packets into connections.
- Filter uses those states to build a stateful firewall for the router and for the networks behind it.
- NAT only evaluates the first packet of each connection. Later packets follow the tracked connection.
- Mangle attaches marks that the next chapter on queues will use.
- Helpers and UPnP adjust NAT for protocols that do not work well with plain address translation.
Every table has the same shape. A rule has a chain, some conditions and an action, and RouterOS reads rules from top to bottom.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and example commands.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Build the rules in a lab and watch the packet counters in /ip firewall filter print stats. Counters show immediately whether a packet reached your rule. Learn the list of actions for each table by heart, because exam questions often ask which action does what.
Ready for more practice?
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.