Firewall Filter, NAT and Mangle · Topic 2 of 6

Filter Chains, Actions and Conditions

Learn the RouterOS filter: input, forward and output chains, custom chains with jump and return, every filter action and the most common conditions.

5 min

In a nutshell

The default filter chains are input, forward and output.
Rules are checked from top to bottom, and the first deciding match wins.
A custom chain only runs when a rule uses action=jump with a jump-target.

What it is

The firewall filter decides which packets are accepted, dropped or rejected.

A filter rule has three parts: a chain, some conditions and an action. RouterOS reads the rules in a chain from top to bottom. The first rule whose conditions all match decides the packet, unless its action lets processing continue.

Filter works with connection tracking, so it can be stateful. The rules are in /ip firewall filter.

How it works

Filter uses three default chains, and you can add your own.

Default chains

Chain	Traffic it sees
input	Packets sent to the router itself
forward	Packets passing through the router
output	Packets the router creates

Input protects the router. Forward protects the networks behind it. Output controls what the router itself can send, and it is used rarely.

Custom chains

You create a custom chain simply by using a new name in the chain parameter. A custom chain only runs when another rule jumps to it.

/ip firewall filter add chain=forward protocol=tcp action=jump jump-target=tcp-checks
/ip firewall filter add chain=tcp-checks protocol=tcp dst-port=23 action=drop
/ip firewall filter add chain=tcp-checks action=return

The jump action sends the packet to the named chain. If no rule in the custom chain decides the packet, or a rule uses return, processing goes back to the rule after the jump. Custom chains keep long rule sets tidy and save CPU, because the packet only enters the chain when it needs to.

Filter actions

These are the actions available in the filter table.

Action	Effect
accept	Allow the packet and stop processing the chain
drop	Silently discard the packet
reject	Discard the packet and send back an ICMP error, chosen with `reject-with`
tarpit	Accept a TCP connection and hold it, so that a scanner wastes time
jump	Go to a custom chain named in `jump-target`
return	Go back to the chain that jumped here
passthrough	Count the packet and move on to the next rule
log	Write a log entry and move on
add-src-to-address-list	Put the source address in a list, with a timeout if set
add-dst-to-address-list	Put the destination address in a list, with a timeout if set
fasttrack-connection	Mark the connection for fasttrack

Accept, drop, reject and tarpit end the processing of the chain. Log, passthrough and the two address list actions let the packet continue to the next rule.

Exam tip

Use drop on the internet side so scanners get no answer, and reject inside your own network so users see an error at once.

Most common conditions

Conditions narrow down which packets a rule matches. A rule matches only when every condition it contains matches.

Condition	Matches
src-address, dst-address	Source or destination address or network
protocol	IP protocol such as tcp, udp or icmp
src-port, dst-port	TCP or UDP port numbers
in-interface, out-interface	The interface the packet arrived on or leaves by
in-interface-list, out-interface-list	Any interface that belongs to a list
connection-state	Tracked state such as new or established
src-address-list, dst-address-list	A named address list
connection-mark, packet-mark	Marks set earlier by mangle

Add an exclamation mark before a value to negate it. In the console, dst-port=!80 means any port except 80. Ports need a protocol of tcp or udp to be used.

A small ruleset

/ip firewall filter add chain=input connection-state=established,related action=accept
/ip firewall filter add chain=input connection-state=invalid action=drop
/ip firewall filter add chain=input protocol=icmp action=accept
/ip firewall filter add chain=input in-interface-list=LAN action=accept
/ip firewall filter add chain=input action=drop

The last rule drops everything that no earlier rule accepted. Any new rule must go above it, or it will never be reached. The place-before parameter lets you insert a rule at a given position.

What to remember for the exam

Eight facts cover most questions on this topic.

The default filter chains are input, forward and output.
Rules are checked from top to bottom, and the first deciding match wins.
A custom chain only runs when a rule uses action=jump with a jump-target.
return goes back to the chain that jumped, and the end of a custom chain also returns.
drop is silent. reject sends an ICMP error.
log and passthrough do not stop processing.
Address lists are filled by add-src-to-address-list and add-dst-to-address-list.
A rule matches only if all its conditions match, and ! negates a value.

Watch out

A rule placed under a final catch all drop rule is never evaluated. Check the order before you blame the conditions.

Common mistakes

These four mistakes appear often.

Using the wrong chain. Traffic to the router belongs in input, and traffic through it belongs in forward.

Putting a new rule below the final drop. It will never match, so insert it higher up.

Using ports without a protocol. dst-port only works when protocol is tcp or udp.

Expecting a custom chain to run alone. It does nothing until a jump rule sends packets there.

Check yourself

Work through these three questions.

What is the difference between drop and reject?
drop discards silently, while reject discards and sends back an ICMP error.
When does a rule in a custom chain run?
Only after another rule sends the packet there with action=jump and a jump-target.
Which actions let the packet carry on to the next rule?
log, passthrough and the two address list actions do not stop processing.

Topic 2 of 6 in Firewall Filter, NAT and Mangle

Test yourself on Firewall Filter, NAT and Mangle

The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.