Firewall filter chain forward vs chain input

RouterOS General
1

Setup - RB411 access point, internet feed on ether1, clients on wlan1, routed. no bridges.
I have a couple rules to drop bogons.

/ip firewall filter
add action=drop chain=forward comment="Drop BOGONS" disabled=no \
    dst-address-list=BOGONS
add action=drop chain=forward comment="Drop BOGONS" disabled=no \
    src-address-list=BOGONS

I’m a little confused with firewall chain input vs chain forward.
Do I need both???
I always thought of chain forward as a “catch all” but I noticed on a new AP that it wasn’t dropping packets when I know it should have.
Chain forward seems to drop bogons from wlan1 but not from ether1.
Attached is a pic showing chain forward dropping some of the packets.
I’ve included a second set of bogon rules with chain input to show the results.
I’ve never used the second set of rules before but did it on an older AP and got the same results.. more packets dropped :smiley:
bogonfilter.jpg

Roadwarrior Rx/Tx ok but no LAN access
2

Basically:
Input chain, filter traffic going to the router. (DST address of the router)
Forward chain, filter traffic going through the router. (SRC and DST is not on the router)

Read more:
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Chains

3

you don’t need to drop bogon IPs for input chain

4

I checked the manual and packet flow chart prior to posting, just to make sure I wasn’t losing my mind.
From log -
17:35:54 firewall,info input: in:ether1 out:(none), src-mac 00:0d:9d:a0:f2:31, proto UDP, 10.36.55.200:68->255.255.255.255:67, len 328

10.36.0.0/16 is on bogon list. (don’t ask, something that needs fixed)

Since the router is going to listen to broadcast traffic, makes sense that input chain would be required to drop it.

5

Do you have problem with unauthorized DHCP servers?

6

Not really a problem.
I provide backhaul for some local schools via eoip but one of the routers went bad. I need to replace the router. soon!!!