The MikroTik firewall is powerful but unforgiving: rules run top to bottom, and one wrong drop rule can lock you out of the router. This guide explains the chains, gives a safe basic rule set for a typical office or hotel router on RouterOS 7, and lists the mistakes we see most often.
Traffic addressed to the router itself - WinBox, SSH, web, DNS, ping. This chain protects the router.
Traffic passing through the router between networks, for example from the LAN to the internet. This chain protects your network and users.
Traffic the router itself sends. Rarely filtered.
Rules in a chain are checked from the top; the first rule that matches decides. NAT (masquerade, port forwarding) lives in a separate NAT table, and connection tracking lets you accept replies to traffic that was already allowed.
This assumes the LAN is on a bridge or interface list called LAN and the internet port is in an interface list called WAN. Add the rules in this order, and keep a second session open (or use Safe Mode) while you test, so a mistake cannot lock you out:
input: accept established,related,untracked → drop invalid → accept ICMP → accept from LAN (in-interface-list=LAN) → drop everything else (so nothing from the WAN can reach the router's services).
forward: accept established,related,untracked → drop invalid → drop new connections from WAN that are not port-forwarded (connection-nat-state=!dstnat, in-interface-list=WAN) → accept the rest.
NAT: masquerade on out-interface-list=WAN so LAN devices share the public address.
RouterOS's own default configuration follows the same pattern - if you reset a router with its default config, compare your rules with it.
Keep trusted management addresses in an address list and allow WinBox/SSH only from that list.
A fasttrack-connection rule for established traffic in forward speeds up routing a lot on small routers; it bypasses queues and some features, so check before using it with hotspot speed limits.
Drop forward traffic from the guest network to your office, CCTV and server networks.
Rules that add repeat offenders to an address list and drop them - helpful, but no substitute for closing management ports on the WAN.
The order matters - an early drop in the input chain is the classic lockout.
WinBox, SSH, web and API exposed on the WAN are attacked within minutes. Close them and manage through a VPN - see MikroTik remote management.
Without dropping invalid packets, odd traffic slips through.
The hotspot adds its own dynamic rules; put your rules so they do not bypass the hotspot login.
A MikroTik filter is a stateful firewall. Offices and hotels that also need website blocking, intrusion prevention or gateway antivirus are looking for a UTM - see UTM firewall and firewall for small business. iberry configures, hardens and monitors MikroTik firewalls as part of MikroTik services.
input (traffic to the router), forward (traffic through the router) and output (traffic from the router). NAT rules are in a separate table.
In input: accept established/related, drop invalid, accept ICMP, accept from LAN, drop the rest. In forward: accept established/related, drop invalid, drop new WAN traffic that is not port-forwarded. Masquerade on the WAN.
Use Safe Mode in WinBox or the terminal while editing; if the connection drops, the changes are undone. Add accept rules before drop rules.
No. Close management ports on the WAN and manage the router through a VPN or from trusted addresses only.
No. RouterOS has a strong stateful firewall; full UTM features such as gateway antivirus and intrusion prevention are a different class of device - see UTM firewall for what each type covers.
Send us your RouterOS version and what the router does - we harden and monitor MikroTik routers in India and abroad. Published plans in India start at ₹30,000 one-time plus a ₹15,000 yearly subscription from the 2nd year (1st year included; ₹20,000 with DNS security and/or PMS integration); outside India every project is quoted on its own.
Get your MikroTik firewall checked