Interface lists efficiency for firewall

[ColinM9991]

My rules of thumb for traffic flow rules.

a. For traffic to or from a single subnet USE: SRC or DST address x.x.x.0/24
b. For traffic to or from two or more whole subnets USE: interface lists
c. For traffic to or from remote subnets (not known to the router) USE: firewall address lists
d. For traffic to or from a group of users ( less than a subnet or from various subnets ) WITH OR WITHOUT other whole subnets USE: firewall address lists

An exception to b, is that the management interface list entry may contain only only one subnet ( interface list used in neighbours discovery and in mac-server mac-winbox )

I like that approach. It wouldn’t be too bad if RouterOS allowed you to reuse existing subnet/network definitions rather than having to re-enter them across different spaces, such as /ip addresses and ip firewall address-list.

Coming from a software engineering background, if I have many instances of the same thing and I make a conscious decision to update one - then I have to update them all. Having a single instance and referencing that many times is much easier to tweak.

Additionally, being able to specify multiple interfaces in firewall rules would be nice to reduce the number of interface lists based on permutations - though I believe RouterOS uses iptables rather than nftables. The latter supports comma-separated in/out interfaces.