Packet Flow Diagram · Topic 2 of 2

Routing, Bridging and Complex Flows

Trace routed, bridged and router local traffic through the RouterOS packet flow diagram, then work through port forwarding and marking examples.

  • 5 min
In a nutshell
  • Bridged traffic does not reach the IP firewall unless use-ip-firewall=yes is set in the bridge settings.
  • Traffic switched by hardware is not seen by any firewall.
  • When a packet moves from a bridge port to the IP layer, the in-interface is the bridge.

What it is

This page applies the diagram to routed traffic, bridged traffic, traffic to the router and a few harder cases.

The first page showed the main stages. Real networks mix several kinds of path, and each kind uses a different part of the diagram. You need to know which part a packet takes before you can place a rule.

Frame inbridge portbridgedBridge decisionsame bridgeFrame outother portFrame inbridge portroutedIP layerprerouting to postroutingFrame outrouted interface

There are three paths to learn: bridged, routed and local.

How it works

The path depends on where the packet came from and where it is going.

Bridging

A bridge joins several ports into one Layer 2 segment. A frame that enters a bridge port goes to the bridge decision first.

If the destination is another host on the same bridge, the frame is switched to the right port. It does not travel through the IP firewall by default. Only the bridge filter and bridge NAT can act on it.

/interface bridge settings set use-ip-firewall=yes

With use-ip-firewall=yes, bridged IP traffic is also passed to the IP firewall. Without it, the IP firewall never sees traffic that stays inside a bridge. Traffic switched by a hardware switch chip does not reach the CPU either, so no firewall can see it.

From a bridge to routing

If the frame is addressed to the router, or must be routed, it moves up to the IP layer. At that point the in-interface is the bridge itself. The real port can be matched with the in-bridge-port condition.

The same applies in the other direction. A routed packet leaves through the bridge, and out-bridge-port can match the final port.

Packet isPathRules that can see it
Bridged inside one bridgeBridge decision onlyBridge filter, bridge NAT
Routed through the routerPrerouting, forward, postroutingMangle, dstnat, filter, srcnat
For the routerPrerouting, inputMangle, dstnat, filter
From the routerOutput, postroutingMangle, filter, srcnat

Routing

After prerouting, the routing decision picks the next hop and the out-interface. In version 6 a routing mark set in mangle can select an alternative routing table. In version 7 the mark action names a routing table directly.

Because routing comes after mangle prerouting, a prerouting mark can change the route. A mark made in forward or postrouting is too late to do that.

Connection to the router

Traffic for the router's own services, such as SSH, DNS or DHCP, takes the input path. Replies and any traffic the router starts, such as DNS queries or NTP, take the output path.

ClientSSH to routerPreroutingtrack, manglefor routerInputfilter drop or acceptSSH servicelocal process

A common firewall design relies on this split. The input chain protects the router. The forward chain protects the networks behind it.

More complex example: port forwarding

An internet client reaches a web server on the LAN through a dstnat rule on the router.

/ip firewall nat add chain=dstnat dst-address=203.0.113.10 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50
/ip firewall filter add chain=forward connection-nat-state=dstnat action=accept
Internet clientto 203.0.113.10Preroutingdstnat rewrites destinationRouting decisionforwardForwardfilter sees 192.168.88.50Web server192.168.88.50

Dstnat runs in prerouting, so the routing decision already sees the LAN address. The forward chain then sees the translated destination. The reply returns through connection tracking, which reverses the translation without a second rule.

More complex example: marking for a queue

A mangle rule marks traffic so that a queue can treat it differently later.

/ip firewall mangle add chain=prerouting in-interface=ether2 protocol=tcp dst-port=80 action=mark-packet new-packet-mark=web passthrough=no

The mark is made in prerouting and is carried with the packet. A queue near the end of the path matches that mark. A queue cannot use a mark that is set after the queue has already handled the packet.

Exam tip

To place a rule, trace the packet on the diagram from the input interface and stop at the first stage that has all the information your rule needs.

What to remember for the exam

Eight facts cover most questions on this topic.

  • Bridged traffic does not reach the IP firewall unless use-ip-firewall=yes is set in the bridge settings.
  • Traffic switched by hardware is not seen by any firewall.
  • When a packet moves from a bridge port to the IP layer, the in-interface is the bridge.
  • in-bridge-port and out-bridge-port match the real bridge ports.
  • Traffic for the router uses prerouting and input. Traffic from the router uses output and postrouting.
  • A mangle mark made in prerouting can influence routing. A mark made later cannot.
  • Dstnat happens before routing, so the forward chain sees the translated destination.
  • Replies are translated back by connection tracking, with no extra rule.
Watch out

Do not assume the IP firewall sees everything. Check the bridge settings and hardware offload before you debug a rule that never matches.

Common mistakes

These four mistakes appear often.

Expecting firewall rules to see bridged traffic. By default only bridge filter and bridge NAT apply inside a bridge.

Matching a bridge port in the in-interface condition. After the frame moves up to the IP layer the in-interface is the bridge, so use in-bridge-port for the port.

Marking too late for routing. A routing decision made before the mark exists ignores it.

Writing a second rule for replies. Connection tracking handles the reply direction, so one dstnat or srcnat rule is enough.

Check yourself

Work through these three questions.

  • Why does a firewall rule not match traffic between two ports of the same bridge?

    Bridged traffic stays at the bridge decision and does not reach the IP firewall unless use-ip-firewall=yes is set.

  • Which condition matches the real port when the in-interface shows the bridge?

    in-bridge-port matches the real bridge port the packet arrived on.

  • In a port forward, what destination address does the forward chain see?

    The translated LAN address, because dstnat runs in prerouting before the routing decision.

Topic 2 of 2 in Packet Flow Diagram

Test yourself on Packet Flow Diagram

The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.