Empty Chains still exist and do not disappear on reboot.

I have had multiple chains that I have created and no longer use. The rules in the chains were deleted and most disappeared at that time. Some of them that do not have any rules still exist and they did not disappear when I rebooted the router. I have exported the configuration and searched through it, there are no reference to the empty chains.

Has anyone else had this problem? What was the solution to get the empty chains removed.

Please post your /ip firewall filter configuration here.
Empty chains (if there is no reference to it) should be deleted after reboot.

I’m running mipsbe V6.27 on a CRS125-24G-1S-2HnD
They are showing up in winbox, The chains that are blank and will not remove on reboot are, KG,JG,JG, and SERVER. They happen to be in upper case characters, if that could be part of the issue. Attached is my filter list and a screenshoot showing that they still show up in Winbox. I also cleared the Winbox cache.

  1. Please try to use the latest Winbox version (rc5).

  2. I have uploaded firewall rules on my routers and mentioned chains are not present. Perhaps they are kept from older configuration, but reboot+the latest Winbox should clear them.

No luck.

I’ve rebooted many times in the past trying to clear this. I’ve powered off and on the router a number of times as well.

Winbox V3.0RC5 didn’t help. The Empty chains still show up. See attached file showing version and empty chain.

I’ve used Winbox on 3 different systems and they all show the same empty chains.
I would think that this must be within the router and not cached information when using Winbox.

In case this router can run 3 minutes without firewall rules, then do the following.
Remove all firewall rules, reboot router and import all rules to New Terminal in Winbox, it should clear old chains.

serjeis is surely right .. but before, IMO, you should only check those rules in which you set ‘jump’ action ..and later you had edited in some way.. they could still bring inside some references.
This has happened to me working on connections marks and address lists, I’ve reopened some rule ..re-set to previous action ..and here we go .. the old connection mark reappeared. Maybe your old chain is somewhere “hidden” in some edited rule.
Probably you do it faster with export and reimport :smiley:

I have exported all the rules and went through them all. There are no reference to the ones showing up in the drop down box anywhere. If I had any in the jump target fields, they’d show up in the export. Reboot should have cleared any memory cache. These are stored on the disk somewhere. If I have to export all the rules and then import them all back to clear empty chains, then there is surely a bug in the OS.

Even if I get them cleared by exporting and importing them all, me thinks there is a bug?

Sometimes when you hide a field in a rule the value of the field is not deleted. It is not shown in export but the value is still kept in the system. You need to unhide all such fields, find the hidden value, delete it, apply and then you can hide the field again. If you find all hidden occurrences the chain finally vanishes. It’s known bug that I described some times ago on this forum. Use search to find that post…

Please provide the post. If you are talking about the Jump Target field. That I had already un hidden when I first had noticed this issue. Nothing there in Jump Target reference my empty chains for any rules . What other fields or places reference filter chains?

anyway..
if you have local access to the device MAC-Winbox into it, export ..delete filters rules.. ..import ..voilà :slight_smile:
if you have not local access ..open every filter rule ..set action to jump (without save) ..delete eventual hidden chain reference.. reset original action ..save (should work)

..or simply live happy without removing it :slight_smile: IMO it’s not a big problem when you know why it happens (and it doesn’t hurt)

Just live with it, huh?

The empty chains are gone now, but I suggest fixing the bug,

If it could be possible to know, steps how to repeat the same problem, it would be great.
As importing your rules to my router didn’t produced those empty chains (obviously).

Search does not work for you? For me it works:

http://forum.mikrotik.com/t/new-problems-appears-6-19-kernel-failures/80516/5
or
http://forum.mikrotik.com/t/source-of-unused-address-list-name/80214/14

It is some kind of general bug that probably still was not solved…

[quote="sergejs"]If it could be possible to know, steps how to repeat the same problem, it would be great.
As importing your rules to my router didn't produced those empty chains (obviously).[/quote

I was renaming some chains with my script below. The whole reason was to rename those that were in all upper case. Then I went crazy and I started renaming many other chains I have in this router. Was this the cause? You tell me.
This was when I ran across the empty chains that were all in upper case.

Maybe the key to this bug is that all the empty chains were in upper case, SERVERS, KG, JG, RG. All others disappeared.

System_Change_Filter_Chain_Name

Randy Graham

Current chain name

:local fchain "SERVERS"

New chain name

:local fnewchain "Remove"

chain comments to add if they don't exist

:local fcomment

/ip firewall filter

Go through each record one at a time

:local d
:foreach d in=[/ip firewall filter find chain=$fchain] do={
:set fcomment [ get $d comment ]
:if ($fcomment = "") do={set $d comment=$fchain}
set $d chain=$fnewchain

}

=============================
I later found that copying the chains seemed better so I could change the chain name in Jump Targets before removing the previous chain, so I added "add copy-from $d" and it duplicated the lines before renaming the original line.

System_Copy_Filter_Chain

Randy Graham

Current chain name

:local fchain "Servers In Rules"

New chain name

:local fnewchain "SERVERS"

chain comments to add if they don't exist

:local fcomment

/ip firewall filter

Go through each record one at a time

:local d
:foreach d in=[/ip firewall filter find chain=$fchain] do={
:set fcomment [ get $d comment ]
:if ($fcomment = "") do={set $d comment=$fchain}
add copy-from $d
set $d chain=$fnewchain

}