Firewall Rules Configuration Explained

Firewall rules are essential for controlling network traffic and ensuring security on a MikroTik router. Understanding how to configure these rules is crucial for the MikroTik Certified Network Associate (MTCNA) certification.

Key Concepts

1. Firewall Chains

Firewall chains are sequences of rules that determine how packets are processed. Common chains include:

• Input: Processes packets destined for the router itself.
• Forward: Processes packets passing through the router.
• Output: Processes packets originating from the router.

2. Rule Actions

Rule actions define what happens to packets that match a rule. Common actions include:

• Accept: Allows the packet to pass through.
• Drop: Silently discards the packet.
• Reject: Discards the packet and sends an error message to the sender.

3. Rule Criteria

Rule criteria specify the conditions under which a rule is applied. Common criteria include:

• Source IP: The IP address of the sender.
• Destination IP: The IP address of the receiver.
• Protocol: The type of protocol (e.g., TCP, UDP).
• Port: The port number used by the protocol.

4. Rule Order

The order of rules is crucial, as the first matching rule determines the packet's fate. Rules are processed in the order they are listed, from top to bottom.

5. Logging

Logging allows you to record packets that match specific rules. This is useful for monitoring and troubleshooting network traffic.

6. Default Policies

Default policies are applied when no rule matches a packet. Common default policies include:

• Accept: Allows all unmatched packets.
• Drop: Discards all unmatched packets.

Detailed Explanation

Firewall Chains

To configure a firewall chain on a MikroTik router, you would use the command:

/ip firewall filter add chain=input

This command creates a new rule in the input chain, which processes packets destined for the router itself.

Rule Actions

To configure a rule action on a MikroTik router, you would use the command:

/ip firewall filter add chain=forward action=drop

This command creates a rule in the forward chain that drops packets passing through the router.

Rule Criteria

To configure rule criteria on a MikroTik router, you would use the command:

/ip firewall filter add chain=output src-address=192.168.1.10 protocol=tcp port=80

This command creates a rule in the output chain that applies to packets originating from the IP address 192.168.1.10 using the TCP protocol on port 80.

Rule Order

To change the order of rules on a MikroTik router, you would use the command:

/ip firewall filter move [find where chain=input] before=1

This command moves the first matching rule in the input chain to the top of the list.

Logging

To enable logging for a rule on a MikroTik router, you would use the command:

/ip firewall filter add chain=forward action=accept log=yes

This command creates a rule in the forward chain that logs accepted packets.

Default Policies

To configure default policies on a MikroTik router, you would use the command:

/ip firewall filter set [find where chain=input] action=drop

This command sets the default policy for the input chain to drop unmatched packets.

Examples and Analogies

Example: Firewall Chains

Think of firewall chains as conveyor belts in a factory. Each belt (chain) processes items (packets) in a specific way, depending on their destination (input, forward, output).

Example: Rule Actions

Consider rule actions as traffic lights. Green (accept) allows traffic to pass, red (drop) stops traffic, and yellow (reject) stops traffic with a warning.

Example: Rule Criteria

Imagine rule criteria as filters in a water purification system. Each filter (criteria) removes specific impurities (conditions) from the water (packets).

Example: Rule Order

Think of rule order as a checklist. The first item (rule) on the list is checked first, and if it matches, the rest are ignored.

Example: Logging

Consider logging as a security camera. It records (logs) all activities (packets) that match specific conditions (rules).

Example: Default Policies

Imagine default policies as the final step in a manufacturing process. If an item (packet) doesn't meet any specific criteria (rules), it is processed according to the default policy (accept or drop).

By mastering firewall rules configuration, you can effectively control network traffic and enhance security on your MikroTik router.