MikroTik’s Firewall Filter Rules

MikroTik’s firewall filter rules allow you to control traffic passing through your router. These rules are processed in the Firewall Filter section of IP > Firewall and help in securing networks by blocking or allowing specific traffic.

Firewall Filter Basics

Filter rules work in a chain-based manner. The three main chains are:

• Input – Handles traffic directed to the router itself.
• Output – Manages traffic generated by the router.
• Forward – Filters traffic passing through the router.

Basic Firewall Rule Structure

Each rule consists of:

• Chain (input, output, forward)
• Source/Destination Address (IP ranges to filter)
• Protocol (TCP, UDP, ICMP, etc.)
• Action (accept, drop, reject, log, etc.)

---

Common Firewall Rules

Here are some useful MikroTik firewall filter rules:

1. Block All Incoming Traffic to Router (except SSH/Winbox)

🔹 This ensures only SSH and Winbox access is allowed, while other incoming traffic is blocked.

2. Protect Against Ping Flood (ICMP Rate Limit)

🔹 The first rule allows up to 5 pings per second, while the second rule drops excess pings.

3. Block Access to Specific Website (via DNS)

🔹 This rule blocks access to facebook.com at the DNS request level.

4. Allow Only Certain IPs to Access a Server

🔹 Only IP 192.168.1.100 can reach 192.168.1.200, while others are blocked.

5. Block Specific Port (e.g., Torrent)

🔹 Blocks torrent traffic that uses ports 6881-6889.

---

Firewall Rule Management

To view active firewall rules:

To remove a rule: