Basic setup for home/home office. Firewall and nat rules.

Please help me to setup my home router. I have 500/500 connection.
I use following firewall rules.

ip firewall filter
add action=accept chain=forward connection-state=established
add action=accept chain=input connection-state=established
add action=accept chain=forward connection-state=related
add action=accept chain=input connection-state=related
add action=drop chain=forward comment="invalid connections" connection-state=invalid
add action=drop chain=input connection-state=invalid
add action=drop chain=input in-interface=!lan
add action=accept chain=forward in-interface=lan src-address=192.168.1.0/24
add action=accept chain=input in-interface=lan src-address=192.168.1.0/24
add action=drop chain=forward in-interface=!lan

I get only 230 Mbps up and down.

When I put fasttrack rules at the top of my firewall rules list.

add chain=forward action=fasttrack-connection connection-state=established,related
add chain=forward action=accept connection-state=established,related

I am getting 630-700 Mbps up and down.

I am afraid that my connection is open to outside attacks(at least in theory).

I use Powerbox Pro RB960PGS-PB.

Please help me to setup my firewall and nat rules.
Other rules.

I would like my connection to be safe and relatively fast.

Many thanks!

Using fasttrack is reportedly safe to do (and is enabled by default in ROS versions released for last few years). Just make sure you’re running recent versions of ROS (either latest stable, 6.43 at this time, or latest long-term, 6.42 at this time).

With the options used in your action=fasttrack-connection … namely connection-state=established,related you’re instructing firewall to still evaluate all the rest of firewall rules for new connections. And all connections are new at the beginning, because this is the state of connection tracking engine in your RB (and only vaguely relates to the apparent IP connection state).

BTW, the second rule you’ve added (the same as action=fasttrack-connection but with action=accept) completely overlaps two of your previous rules:

add action=accept chain=forward connection-state=established
add action=accept chain=forward connection-state=related

You only need one (either the new one or the pair of old ones).

I am very new to networking(mikrotik), I don’t really understand what I am doing. mostly copy and paste from the internet and this forum.
Could you please edit my firewall rules or maybe suggest better ones.

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
    established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward connection-state=established
add action=accept chain=input connection-state=established
add action=accept chain=forward connection-state=related
add action=accept chain=input connection-state=related
add action=drop chain=forward comment="invalid connections" connection-state=\
    invalid
add action=drop chain=input connection-state=invalid
add action=drop chain=input in-interface=!lan
add action=accept chain=forward in-interface=lan src-address=192.168.1.0/24
add action=accept chain=input in-interface=lan src-address=192.168.1.0/24
add action=drop chain=forward in-interface=!lan
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.1.0/24

sorry, but in didn’t get what you mean

BTW, the second rule you’ve added (the same as action=fasttrack-connection but with action=accept) completely overlaps two of your previous rules:

Remove the rules I marked in red.

You can also replace the rules I marked in blue with the following single rule:

add action=accept chain=input connection-state=established,related

If you do, then make sure this rule comes near the top of list (3rd place would be fine).
This step is optional, it doesn’t change anything with regard to functionality, it only makes firewall filter list a tiny bit more readable (and shorter).

The rest of setup works, but it’s not according to the best practice (as used by majority users on this forum). We can go through it if you want to learn about RouterOS … if not, then it’s not worth the trouble.

Can you do the same for the following code? please

/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=fasttrack-connection chain=forward comment="Fasstrack DNS TCP" \
    dst-port=53 protocol=tcp
add action=fasttrack-connection chain=forward comment="Fasttrack DNS UPD" \
    dst-port=53 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=input comment=\
    "Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \
    tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" \
    src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
    address-list-timeout=1w chain=input comment="Port Scanner Detect" \
    protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" \
    src-address-list=Port_Scanner
add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
    ICMP protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except t\
    o support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUP\
    PORT ADDRESS LIST" dst-port=8291 protocol=tcp src-address-list=!support
add action=jump chain=forward comment="Jump for icmp forward flow" \
    jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
    bogons
add action=add-src-to-address-list address-list=spammers \
    address-list-timeout=3h chain=forward comment=\
    "Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
    25,587 limit=30/1m,0:packet protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
    protocol=tcp src-address-list=spammers
add action=accept chain=input comment="Accept DNS - UDP" port=53 protocol=udp
add action=accept chain=input comment="Accept DNS - TCP" port=53 protocol=tcp
add action=accept chain=input comment="Accept to established connections" \
    connection-state=established
add action=accept chain=input comment="Accept to related connections" \
    connection-state=related
add action=accept chain=input comment="Full access to SUPPORT address list" \
    src-address-list=support
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS \
    RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
    icmp-options=8:0 limit=1,5:packet protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
    3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
    protocol=icmp

Let me ask a question, do you know the purpose of all the rules you added and how they work.
In other words, unless you do you should stick with the default rules and then add one by one ensuring you know what each one does and how they may interact.
It seems that you have copied a bunch of rules from somewhere and added them to the config.
Also they are not in any order which makes it more suspect.

Almost all firewall rules you added either don’t make much sense [1] or don’t perform as you expected [2]. Either way you’re not enhancing security (much) and you probably should revert to default firewall rules. Those internet guides you’ve been following are not relevant with ROS versions since about 6.0 as since quite a few years ago it includes very decent default firewall rule set.

[1] your second and third fast-track rule accelerate DNS to fast-track explicitly while normal rule (the first one together with implicit accept all not dropped allowing outbound connections) would do the same after 2 or 3 packets exchanged (and most DNS requests don’t need much more than that to complete). In addition it opens your router to become public DNS recursive resolver which is considered as poor configuration practice.

[2] if you follow the default philosophy of using interface lists (and keep membership current), then most rules created on chain=input after rule

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

will just mess with connections originating from your LAN as the quoted rule takes care about most unwanted connections from evil internet already.


I’ll repeat: recent routeros versions come with very decent firewall rules and unless one knows what he’s doing it’s not wise to change them.

Thank you for helping me to correct my firewall rules. I hope they sufficient for soho use.

I have one question about hardware. I use powerbox pro. Is it normal that system health showing temperature: 77 С?