Basic Firewall Configuration

Basic firewall configuration is essential for securing a network by controlling incoming and outgoing traffic based on predefined rules. Understanding how to configure a firewall is crucial for network administrators, especially when preparing for the MikroTik Certified Network Associate (MTCNA) certification.

Key Concepts

1. Firewall Rules

Firewall rules define the conditions under which traffic is allowed or denied. These rules are typically based on criteria such as source IP address, destination IP address, protocol, and port number.

2. Chains

Chains are sequences of firewall rules that are applied to traffic. Common chains include "input" for incoming traffic, "output" for outgoing traffic, and "forward" for traffic passing through the router.

3. Actions

Actions determine what happens to traffic that matches a firewall rule. Common actions include "accept" to allow traffic, "drop" to silently discard traffic, and "reject" to send a rejection message.

Detailed Explanation

Firewall Rules

Firewall rules are the building blocks of a firewall configuration. Each rule specifies a set of conditions and an action to take if those conditions are met. For example, a rule might allow HTTP traffic (port 80) from a specific IP address.

Example: To create a rule that allows HTTP traffic from a specific IP address, you would use the command:

    /ip firewall filter add chain=input protocol=tcp src-address=192.168.1.100 dst-port=80 action=accept
    

Chains

Chains organize firewall rules into logical groups. The "input" chain is used for traffic destined for the router itself, the "output" chain is used for traffic initiated by the router, and the "forward" chain is used for traffic passing through the router.

Example: To apply a rule to the "forward" chain, you would specify "chain=forward" in the command:

    /ip firewall filter add chain=forward protocol=tcp dst-port=443 action=accept
    

Actions

Actions determine the fate of traffic that matches a rule. The "accept" action allows the traffic to pass, the "drop" action silently discards the traffic, and the "reject" action sends a rejection message back to the sender.

Example: To create a rule that drops all incoming ICMP traffic, you would use the command:

    /ip firewall filter add chain=input protocol=icmp action=drop
    

Examples and Analogies

Firewall Rules

Think of firewall rules as security guards at a building entrance. Each guard (rule) checks visitors (traffic) against a list of criteria (conditions) and decides whether to let them in (accept), send them away (reject), or ignore them (drop).

Chains

Consider chains as different rooms in a building. Each room (chain) has its own set of guards (rules) that check visitors (traffic) differently. For example, the lobby (input chain) might have guards checking everyone entering, while the exit (output chain) has guards checking everyone leaving.

Actions

Actions are like the decisions made by the guards. If a visitor (traffic) meets the criteria, the guard (rule) can let them in (accept), send them away (reject), or simply ignore them (drop).

By mastering basic firewall configuration, you can effectively secure your network and control traffic flow, making you a proficient network administrator.