It is a different firewall implementation than some vendors like Cisco, but if you have a working knowledge of iptables, or just firewalls in general, you already know enough to dive in.

Understanding the RouterOS firewall is critical to securing your devices and ensuring that remote attackers cant successfully scan or access your network.

By putting firewalls in place a network can be divided into untrusted, semi-trusted, and trusted network enclaves.

Combined with network separation using VLANs, this creates a robust, secure network that can limit the scope of a breach if one occurs.

The best approach is to whiteboard out your current network design, and draw the network connections that should be allowed.

Allowed traffic will have a rule that allows the traffic to be passed, then a final rule acts as a catch-all and drops all other traffic.

Sometimes this is referred to as the Deny All rule, and those coming from a Cisco background often call it the Deny Any-Any rule.

Allowing what you need and dropping everything else keeps firewall rules simple, and the overall rule count to a minimum.

Once traffic has been matched you can take action on it using rules, which fire off actions - allow, block, reject, log, etc.

Three default Chains exist to match traffic - Input, Output, and Forward.

You can create your own chains, but that is a more advanced topic that well cover in another article.

This could be Winbox traffic, SSH or Telnet sessions, or an administrator pinging the router directly.

Typically most Input traffic to the WAN is dropped in order to stop port scanners, malicious login attempts, etc.

Input traffic from inside local networks is dropped as well in some organizations, because Winbox, SSH, and other administrative traffic is limited to a Management VLAN.

This helps ensure that a malicious insider or someone who gains internal access cant access devices directly and attempt to circumvent organizational security measures.

This could be an administrator sending a ping directly from the router to an ISP gateway to test connectivity.

It could also be the router sending a DNS query on behalf of an internal host, or the router reaching out to mikrotik.com to check for updates.

This is generally considered to be trusted traffic, assuming the device has not been compromised somehow.

This is routed traffic that the device is handing off from one network to another.

For most organizations the bulk of their firewalled traffic is across this chain.

In one interface and out another, directed by the routing table.

There are three main actions that RouterOS firewall rules can take on packets - Accept, Drop, and Reject.

Mikrotik Essential Firewall Rules