[ASK] Block ping through filter & nat

RouterOS General
1

Hi,

My topology:
Internet — Modem (Bridge) — MikroTik (pppoe) — Switch — LAN

Modem = 10.0.0.1
MikroTik ether1 (to Modem) = 10.0.0.2
MikroTik ether2 (to LAN) = 192.168.1.2
LAN = 192.168.1.xxx/24

I have 2 questions:

  1. How to block ping from Internet to MikroTik, and MikroTik still able to ping Internet (google.com)?
    I tried with ip firewall filter chain=input action=drop protocol=icmp in-interface=pppoe-out1
    It works with blocking ping from Internet but MikroTik became unable to ping Internet. I want MikroTik is still able to ping Internet. LAN is also able to ping Internet.
    The purpose is to block intruder/hacker from Internet trying to ping to my network.

  2. How to block ping from LAN to ether1 (Modem (Bridge) & MikroTik)? Not blocking with ip, but blocking with interface ether1.
    I tried with
    ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.1 in-interface=ether2
    ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.2 in-interface=ether2
    It works, but it is blocking with IP which is not efficient, if I have many devices on 10.0.0.0/24 then I should add them all. I think it is much simpler just block ether1, is it possible?

2

Solved question 1: just adding connection-state=new

Thanks…
waiting for answer to question 2…

3

Remove the dst-address, just block ICMP inputs to the router from the required interface. Add the rule in “/ip firewall filter” not “NAT”

/ip firewall filter chain=input action=drop protocol=icmp in-interface=ether2
4

The command above block only from ether2 to ether1, and by blocking from ether2 to any devices behind ether1, i use
/ip firewall filter chain=forward action=drop protocol=icmp in-interface=ether2 out-interface=ether1

and it works…
thanks…