The firewall decides three things: what may reach the router itself (the input chain), what may pass through to another network (the forward chain), and how traffic to the outside changes address (NAT). This section is on by default and is the one section you should not switch off.
Where it sits
In the wizard the router roles get a short firewall step: port forwards, VLAN isolation, management from the management VLAN only, and brute-force protection. In advanced the whole Firewall & NAT section is open.
Two firewalls to choose from
At the top you pick which firewall you want. This tool's is the default: MikroTik's rules plus the options below. MikroTik's own default firewall is literally what a factory device has, defconf: comments and all, so you can hold it against a real device line by line. Choose that one and the options below do not apply: you get the stock rules and nothing else. A note above the script says so too.
The order, and why it is that order
RouterOS walks the rules from top to bottom and stops at the first one that matches. The default rules therefore start with the cheapest decision:
- accept established, related, untracked: traffic belonging to a connection that has already been judged. The vast majority of packets leave here and never see the rest of the list.
- drop invalid: packets that belong to no connection at all. Those are never useful.
- Only then the rules that look at new connections: ICMP, your own rules, whatever you open from the internet.
- drop all not coming from LAN to close the input chain, and drop all from WAN not DSTNATed to close the forward chain.
Those last two do the real work. Everything you open is an exception placed above them; anything you say nothing about goes away. Rules you add are placed before the closing drop automatically.
FastTrack
FastTrack gives existing connections a short path through the router. On small routers that is the difference between a few hundred megabit and gigabit. It is on by default, but it is left out automatically as soon as QoS or PCC load balancing is active, because fasttracked traffic bypasses exactly those. Instead of the rule you then get a comment in the script explaining why it is missing.
NAT to the internet
Masquerade is the choice for a dynamic WAN address and always works. With a fixed address from your ISP, src-nat to a fixed address is slightly more efficient, because the router does not have to look the address up every time. No NAT is for routers working with public addresses or sitting somewhere in the core. For switches and access points there is also protect the device itself only: the script then holds input rules, no forward rules and no NAT.
Ping from the internet
Blocking ping is off by default, deliberately. ICMP is not only ping: it also carries the error messages that find the right packet size. Block ICMP entirely and websites load halfway while downloads hang. Switch the option on and only the echo request from WAN is dropped, while the rest of ICMP stays allowed.
Bogons in raw
Addresses that can never come from the internet (private ranges, documentation ranges, reserved blocks) are dropped in /ip firewall raw, before connection tracking. That saves the router work. The rules for the destination address deliberately carry in-interface-list=WAN, so multicast on your LAN keeps working: otherwise mDNS, SSDP and printer discovery die along with them.
If your router sits behind a modem that still routes, its WAN address is private. The bogon rules then drop traffic coming from that modem network. Put the modem in bridge, or switch bogons off for that device.
Isolation between VLANs
With VLANs there are two ways to decide who may reach whom. Open, except isolated VLANs follows the Isolated tick per VLAN: such a VLAN may only reach the internet. Only what is ticked in the matrix gives you a grid: a row starts the connection, a column receives it, replies always come back. Anything not ticked goes away, for IPv6 too. When you switch to the matrix it starts from what is open today, so the change itself never cuts anything off. The Isolated tick is then no longer used.
Next to that there is router manageable only from the management VLAN. That rule lets DNS, DHCP and NTP from the whole LAN reach the router, allows full management from the management VLAN and from an offbridge port if you have one, and drops the rest. See Management access.
Brute-force protection
This option builds the escalating address lists from the manual: first attempt, second, third, then a day on the blacklist, on the SSH and WinBox ports you chose under Management access. Be honest about when it helps: with the default input drop on and management not reachable from the internet, that traffic is gone anyway and the lists only track addresses of packets that get nowhere. The tool says as much. And note: the rules match new TCP connections, so someone with a spoofed source address can put an address on the ban list, including yours.
Logging and custom rules
Log dropped input packets puts a drop-in prefix on the closing drop, handy when you want to see what is knocking. Do not leave it on permanently on a busy device.
At the bottom sit address lists and custom filter rules. A custom rule picks a chain, an action, protocol, ports, source and destination address, a source address list and an in or out interface (or the WAN and LAN lists, optionally negated). Input rules land before the closing input drop, the others before the closing forward drop.
Right at the bottom you can lower tcp-established-timeout. Leaving it empty means the RouterOS default of one day; on a router with little memory something like 2h makes more sense.
IPv6 comes along regardless
Even when you do not use IPv6, the IPv6 firewall is included in the script. A device without IPv6 rules only becomes unsafe at the moment the stack comes up anyway, after an update for instance, and then everything is open. If you really want IPv6 gone, read IPv6.
What you can check
/ip firewall filter printshows the rules in order;print statsshows which rule actually counts packets./ip firewall nat printfor masquerade and your forwards./ip firewall raw printfor the bogons.- Switch the default rules off and the tool gives you an error: without an input drop the router is reachable from the internet.
Further reading: Opening a port, VLANs and When something goes wrong.