Firewall filter

RouterOS General
1

I have the last rule turned off. Why when I turn it on firewall rule on single (random) computers is no internet?
I am asking for support.

[admin@MikroTik] > ip firewall filter print 
Flags: X - disabled, I - invalid, D - dynamic 
 0    ;;; akceptuj WinBox
      chain=input action=accept protocol=tcp dst-port=8292 

 1    ;;; Allow Port Forwarding
      chain=forward action=accept connection-nat-state=dstnat 

 2    ;;; akceptuj ICMP
      chain=input action=accept protocol=icmp 

 3    ;;; akceptuj polaczenia zestawione
      chain=input action=accept connection-state=established 

 4    ;;; akceptuj polaczenia powiazane
      chain=input action=accept connection-state=related 

 5 X  ;;; blokuj wszystko inne
      chain=input action=drop log=no log-prefix=""
2

One guess, it’s not random and internet in fact works, only DNS doesn’t. More specifically, those computers that don’t work use router as DNS resolver (it’s probably configured in DHCP server) and those that do work use something else. You can try to add (before the last rule):

/ip firewall filter
add chain=input protocol=udp dst-port=53 in-interface=<LAN> action=accept
add chain=input protocol=tcp dst-port=53 in-interface=<LAN> action=accept

It’s important to limit access only to devices in LAN, that’s the in-interface parameter. Alternatively it can be in-interface-list if you have interfaces defined there.

Other than that, firewall rules are processes in order, so to make it more efficient, it would be better to sort rules differently: #3 and #4 can be merged into one, #2, #0, new ones for DNS, #5. Not that you’d see much difference with only few rules. Also since default action is access, you effectively don’t have any firewall in forward chain.