| Both sides previous revisionPrevious revision | |
| mikrotik [2022/03/16 08:52] – ww | mikrotik [2026/03/15 12:51] (current) – [IPv4 firewall stub] ww |
|---|
| /ip firewall filter | /ip firewall filter |
| add chain=forward connection-state=established,related action=fasttrack-connection comment="Fasttrack" | add chain=forward connection-state=established,related action=fasttrack-connection comment="Fasttrack" |
| add chain=forward connection-state=established,related,untracked action=accept comment="Allow ESTABLISHED, RELATED, UNTRACKED (FORWARD)" | add chain=forward connection-state=established,related,untracked action=accept comment="FORWARD :: Allow ESTABLISHED, RELATED, UNTRACKED" |
| add chain=forward connection-state=invalid action=drop disabled=yes comment="Drop INVALID (FORWARD)" | add chain=forward connection-state=invalid action=drop disabled=yes comment="FORWARD :: Drop INVALID" |
| add chain=forward connection-nat-state=!dstnat \ | add chain=forward connection-nat-state=!dstnat \ |
| connection-state=new \ | connection-state=new \ |
| in-interface-list=WAN action=drop disabled=yes comment="Drop all from WAN not DST-NATted (FORWARD)" | in-interface-list=WAN action=drop disabled=yes comment="FORWARD :: Drop all from WAN not DST-NATted" |
| add chain=input connection-state=invalid action=drop disabled=yes comment="Drop INVALID (INPUT)" | add chain=input connection-state=invalid action=drop disabled=yes comment="INPUT :: Drop INVALID" |
| add chain=input connection-state=established,related,untracked action=accept comment="Allow ESTABLISHED, RELATED, UNTRACKED (INPUT)" | add chain=input connection-state=established,related,untracked action=accept comment="INPUT :: Allow ESTABLISHED, RELATED, UNTRACKED" |
| add chain=input protocol=icmp action=accept comment="Allow ICMP (INPUT)" | add chain=input protocol=icmp action=accept comment="INPUT :: Allow ICMP" |
| add chain=input in-interface-list=!LAN action=drop disabled=yes comment="Drop all not coming from LAN (INPUT)" | add chain=input in-interface-list=!LAN action=drop disabled=yes comment="INPUT :: Drop all not coming from LAN" |
| |
| ---- | ---- |
