Securing MikroTik: Basic Firewall Rules for RouterOS 7

A MikroTik router with its default configuration is reasonably protected, but after a configuration reset or on a CHR cloud router the firewall is empty, and a device with a public IP address comes under attack within minutes. Below is a minimal rule set that closes the router and the network behind it, with every step explained.

How the RouterOS firewall works

Rules are processed top to bottom until the first match, so order matters. There are three main chains:

• input — traffic addressed to the router itself: WinBox, SSH, DNS, VPN;
• forward — traffic passing through the router: from the local network to the internet and back;
• output — traffic the router itself generates.

In the examples ether1 is the provider-facing interface (WAN) and bridge is the local network 192.168.88.0/24. Substitute your own values.

Step 1. Interface lists

It is easier to write rules for lists than for specific ports:

/interface list
add name=WAN
add name=LAN
/interface list member
add list=WAN interface=ether1
add list=LAN interface=bridge

Step 2. Protecting the router itself (input)

/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="Established"
add chain=input action=drop connection-state=invalid comment="Drop invalid"
add chain=input action=accept protocol=icmp comment="ICMP"
add chain=input action=accept in-interface-list=LAN comment="From LAN"
add chain=input action=drop comment="Drop everything else"

What the rules do:

1. accept packets of established connections — the bulk of the traffic, handled first so it does not load the CPU;
2. drop invalid packets;
3. allow ping — you need it for diagnostics;
4. allow access to the router from the local network;
5. drop everything else, including any connection from the internet.

Step 3. Protecting the local network (forward)

/ip firewall filter
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes comment="FastTrack"
add chain=forward action=accept connection-state=established,related,untracked comment="Established"
add chain=forward action=drop connection-state=invalid comment="Drop invalid"
add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="Drop from WAN not DSTNAT"

The last rule blocks any new connection from the internet into the local network, except those you have explicitly set up port forwarding for. FastTrack speeds up established connections several times over.

Step 4. NAT

If the router shares the internet with the local network, it needs a masquerade rule:

/ip firewall nat
add chain=srcnat action=masquerade out-interface-list=WAN comment="Masquerade"

Step 5. Reaching the router from outside

The rules above close management from the internet completely. If you need remote access, there are three ways — from most to least desirable.

Through a VPN

Run WireGuard on the router and manage it only through the tunnel. Allow the VPN port, placing the rule above the drop rule:

/ip firewall filter
add chain=input action=accept protocol=udp dst-port=13231 place-before=[find comment="Drop everything else"] comment="WireGuard"

From trusted addresses

/ip firewall address-list
add list=admins address=198.51.100.7
/ip firewall filter
add chain=input action=accept src-address-list=admins protocol=tcp dst-port=8291,22 place-before=[find comment="Drop everything else"] comment="Admins"

With brute-force protection

If the administrator’s address is not static, add protection: after three new connections within a minute, the address is blocked for a day.

/ip firewall filter
add chain=input action=drop src-address-list=blacklist place-before=0 comment="Blacklist"
add chain=input action=add-src-to-address-list protocol=tcp dst-port=22,8291 connection-state=new src-address-list=stage2 address-list=blacklist address-list-timeout=1d place-before=[find comment="Drop everything else"]
add chain=input action=add-src-to-address-list protocol=tcp dst-port=22,8291 connection-state=new src-address-list=stage1 address-list=stage2 address-list-timeout=1m place-before=[find comment="Drop everything else"]
add chain=input action=add-src-to-address-list protocol=tcp dst-port=22,8291 connection-state=new address-list=stage1 address-list-timeout=1m place-before=[find comment="Drop everything else"]
add chain=input action=accept protocol=tcp dst-port=22,8291 place-before=[find comment="Drop everything else"] comment="Management"

Step 6. Disable unused services

The firewall is not the only line of defence. Turn off everything you do not use:

/ip service
disable telnet,ftp,www,api,api-ssl
set ssh address=192.168.88.0/24
set winbox address=192.168.88.0/24

The address parameter additionally restricts the addresses a service accepts connections from. If you need access from outside, add your addresses or the VPN subnet to the list.

Disable neighbour discovery and MAC-based connections on the external interface:

/ip neighbor discovery-settings set discover-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

Close the router’s DNS server to queries from the internet. The Drop everything else rule in the input chain already does that; if you do not use it, block port 53 on the external interface explicitly — open DNS resolvers are abused for DDoS attacks.

Step 7. Accounts

• Create a new administrator with a strong password and remove the default admin account:

/user add name=myadmin group=full password="a_strong_password"
/user remove admin

• Use keys instead of passwords for SSH.
• Disable unused packages and interfaces.

Step 8. Updates

Most mass compromises of MikroTik devices happened through vulnerabilities in outdated RouterOS versions. Check for updates regularly:

/system package update check-for-updates
/system package update install
/system routerboard upgrade

The last command updates the boot loader on hardware routers; a reboot is needed afterwards.

Verification

Look at the rule counters — they show which rules are matching:

/ip firewall filter print stats

Check that the router does not answer on management ports from the internet: run nmap -Pn IP-address from an external computer or use an online port scanner.

Configuration backup

After setup, save the configuration as text:

/export file=firewall-backup

The file appears under Files — download it and keep it away from the router.

Next steps

• Telegram notifications about events on the router.
• Port knocking as an extra way to hide management ports.
• Containers on RouterOS for small services on the router itself.