Firewall not dropping TCP 25 packets - ROS 3.30/3.x

RouterOS General
1

Hello all,

I have a strange issue where one of our MT’s is refusing to drop smtp/tcp25 packets in the firewall. Can someone look at my rules and tell me if I’m doing something stupid here - or if it is just truly broken?

[*@********] > ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward action=accept protocol=tcp dst-address=205... out-interface=WAN3 dst-port=25

1 chain=forward action=accept protocol=tcp dst-address=66...* out-interface=WAN3 dst-port=25

2 chain=forward action=log protocol=tcp dst-address=0.0.0.0 out-interface=WAN3
dst-port=25 log-prefix=“OTHER-SMTP”

3 chain=forward action=drop protocol=tcp dst-address=0.0.0.0 out-interface=WAN3
dst-port=25

The first two rules are working fine (seem to be at least) and counting packets, as expected - but the last two are not doing anything, at all (I have tested them every which way). This is a basic ~100 user deployment (VLANS/QUEUES/DHCP/ pretty straight forward) and everything else seems to be fine. I’m upgraded to the latest legacy version (which is all we’re really comfortable with, on this production system - given the buggy ROS issues lately). We upgraded last night just to make sure it wasn’t an earlier 3.x bug.

[@********] > system resource print
uptime: 7h49m45s
version: “3.30”
free-memory: 458024kB
total-memory: 506856kB
cpu: “Intel(R)”
cpu-count: 1
cpu-frequency: 2666MHz
cpu-load: 7
free-hdd-space: 57429kB
total-hdd-space: 121215kB
write-sect-since-reboot: 1779108
write-sect-total: 7650180
architecture-name: “x86”
board-name: “x86”
[@********] >

Any input appreciated - Thanks for looking!

2

Don’t set “dst-address=0.0.0.0”

3

Thanks - just tried that and unfortunately, the issue still remains…

Shouldn’t setting the dst-address parameter be valid way to do it though also?

4

OK - setting the src-address to “0.0.0.0/0”, in conjunction with your suggestion seems to work now…

Thank you!

5

Setting src/dst address to “0.0.0.0/0” should be equivalent to not setting it at all. “0.0.0.0/0” matches any possible IPv4 address. Not having address set means that no address filtering is done, so again all addresses pass.

I see no reason why this should not work:

2 chain=forward action=log protocol=tcp out-interface=WAN3 dst-port=25 log-prefix=“OTHER-SMTP”
3 chain=forward action=drop protocol=tcp out-interface=WAN3 dst-port=25

6

That’s what I thought - I’m pretty sure it’s a minor bug - but at least I have it working now…

Thanks again…