Packet Flow Diagram · Topic 1 of 2
Why the Packet Flow Diagram Matters
Learn why the RouterOS packet flow diagram matters, which stages a packet passes through, and how simple examples trace across prerouting and postrouting.
- 5 min
- Includes a diagram
- The diagram shows the order in which RouterOS applies each feature to a packet.
- There are five chains: prerouting, input, forward, output and postrouting.
- Dstnat runs in prerouting, before the routing decision. Srcnat runs in postrouting, after it.
What it is
The packet flow diagram is the official picture of the order in which RouterOS processes every packet.
RouterOS has many features that touch a packet: connection tracking, mangle, NAT, filter, routing, bridging and queues. Each runs at a fixed point. If you do not know the order, you cannot predict what a rule will see.
Here is why the order matters in practice:
- A dstnat rule changes the destination address before the routing decision, so routing sees the new address.
- A srcnat rule changes the source address after routing, so the router still routes on the original source.
- A filter rule never sees the original destination of a packet that dstnat already changed.
The diagram answers questions such as "why does my mangle mark not match here?" and "why can my firewall not see this traffic?".
How it works
A packet moves through named stages, and each stage has its own chains.
The five chains
The diagram uses five chain names. They are the same names used in the firewall menus.
| Chain | Where the packet is | Used by |
|---|---|---|
| prerouting | Just arrived, before the routing decision | mangle, raw, dstnat |
| input | Routed to the router itself | filter, mangle |
| forward | Routed through the router to another host | filter, mangle |
| output | Created by the router itself | filter, mangle |
| postrouting | About to leave, after routing | mangle, srcnat |
NAT uses its own chain names. They are dstnat (the prerouting stage) and srcnat (the postrouting stage).
Order inside prerouting
Several features run in prerouting, and the order between them matters.
- The raw table runs first, before connection tracking, so it can exempt traffic from tracking.
- Connection tracking identifies the connection the packet belongs to.
- Mangle prerouting runs next.
- Dstnat runs after mangle prerouting.
After that the router makes the routing decision. A packet for one of the router's own addresses goes to the input chain. Any other packet goes to the forward chain.
Order inside postrouting
On the way out, mangle postrouting runs and then srcnat runs. After that the packet goes to the output interface and its queue.
/ip firewall mangle add chain=prerouting in-interface=ether2 action=mark-connection new-connection-mark=lan-conn passthrough=yes
/ip firewall filter add chain=forward connection-state=established,related action=accept
/ip firewall nat add chain=srcnat out-interface=ether1 action=masqueradeEach command above lives on a different part of the diagram. The mangle rule runs in prerouting, the filter rule in forward, and the NAT rule in postrouting.
Simple example: LAN host to the internet
A LAN host opens a web page on a server beyond the router.
The packet enters on the LAN interface and passes prerouting. The routing decision says the destination is not a router address, so it goes to forward. After the filter rules, it reaches postrouting, where srcnat replaces the private source with the router's public address.
The reply arrives on the WAN interface. Connection tracking recognises it as part of the same connection and reverses the NAT automatically. The reply is then forwarded to the LAN host.
Simple example: ping to the router
A host pings the router address.
The routing decision sends this packet to input. Only input rules apply, and forward rules never see it. The router's reply is created locally and travels through output and then postrouting.
Filter rules for traffic to the router belong in input. Filter rules for traffic through the router belong in forward.
What to remember for the exam
Seven facts cover most questions on this topic.
- The diagram shows the order in which RouterOS applies each feature to a packet.
- There are five chains: prerouting, input, forward, output and postrouting.
- Dstnat runs in prerouting, before the routing decision. Srcnat runs in postrouting, after it.
- Mangle prerouting runs before dstnat, and mangle postrouting runs before srcnat.
- Raw runs before connection tracking.
- Packets for the router go to input. Packets for other hosts go to forward.
- Packets created by the router start at output and also pass postrouting.
A rule in the wrong chain never matches. Check the chain before you check the conditions.
Common mistakes
These four mistakes appear often.
Using forward for traffic to the router. Packets for the router never enter forward, so the rule never matches.
Matching the original address in forward. After dstnat, the filter sees the new destination, not the address the client originally used.
Expecting srcnat before routing. Srcnat runs after the routing decision, so it cannot change which route is chosen.
Forgetting local traffic. The router's own packets use output and postrouting, so a rule in forward does not affect them.
Check yourself
Work through these three questions.
Which chain handles a packet addressed to the router itself?
The
inputchain, because the routing decision sends packets for the router's own addresses there.Which runs first in the path, dstnat or the routing decision?
Dstnat runs first, in prerouting, so the routing decision sees the translated destination.
Where does srcnat run for traffic leaving through the WAN interface?
In postrouting, after the routing decision and after mangle postrouting, just before the packet leaves.
Topic 1 of 2 in Packet Flow Diagram
Test yourself on Packet Flow Diagram
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.