Firewall Basics in MikroTik

1. Understanding Firewall Basics

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. In MikroTik RouterOS, firewalls are used to protect networks from unauthorized access, malicious attacks, and other security threats.

2. Key Concepts

There are several key concepts related to firewall basics in MikroTik:

• Filter Rules: These are the core of the firewall. They define what traffic is allowed or denied based on criteria such as source IP, destination IP, protocol, and port number.
• NAT (Network Address Translation): NAT rules are used to modify the source or destination IP addresses of packets. This is commonly used for IP masquerading, where internal IP addresses are translated to a public IP address when accessing the internet.
• Mangle Rules: Mangle rules are used to alter packet headers, such as changing the TOS (Type of Service) field or marking packets for QoS (Quality of Service) purposes.
• Address Lists: Address lists are used to group IP addresses or ranges, making it easier to manage firewall rules. For example, you can create an address list for "Blocked IPs" and apply it to multiple firewall rules.

3. Filter Rules

Filter rules are the most common type of firewall rule. They are used to allow or deny traffic based on various criteria. For example, you can create a rule to block all incoming traffic from a specific IP address:

This rule tells the firewall to drop (block) all incoming traffic from the IP address 192.168.1.10.

4. NAT Rules

NAT rules are used to modify the IP addresses of packets. For example, you can create a NAT rule to allow internal devices to access the internet using a single public IP address:

This rule tells the firewall to replace the source IP address of outgoing packets with the public IP address of the router's ether1 interface.

5. Mangle Rules

Mangle rules are used to alter packet headers. For example, you can create a mangle rule to mark all incoming packets from a specific IP address with a specific TOS value:

This rule tells the firewall to mark all incoming packets from 192.168.1.10 with a high-priority routing mark, which can be used for QoS purposes.

6. Address Lists

Address lists are used to group IP addresses or ranges. For example, you can create an address list for "Blocked IPs" and apply it to multiple firewall rules:

This rule tells the firewall to drop all incoming traffic from any IP address in the "BlockedIPs" address list.

7. Practical Example

Imagine you have a small office network with multiple departments. You want to ensure that only authorized devices can access the internet and that certain types of traffic (like VoIP) are prioritized. You can achieve this by configuring filter rules to allow only specific IP addresses, NAT rules to provide internet access, and mangle rules to prioritize VoIP traffic.

By mastering firewall basics in MikroTik, you can create a secure and efficient network environment. This knowledge is essential for anyone aiming to become a MikroTik Certified Routing Engineer.