Generally I like to follow the principal of “don’t firewall on your routers and don’t route on your firewalls”
But in saying that, there is a use case whereby you want to limit ip access to the router itself.
An example would be limiting ip access to your BGP peers and your management network.
These are all INPUT rules, but once enabled, fastpath is obviously disabled.
I looked at fasttrack, but I’m worried about the performance impact of a connection tracking table size of 700k - 1M entries..
Is there a solution to restrict ip access to the mikrotik router itself while still having fastpath for routed packets?
