How to enable the being ping from outside

RouterOS Beginner Basics
1

Hello,

The current RB951F-2HnD cannot be ping from WAN. May I know how to enable the router being ping?

Thank you.
BSc

2

That depends on your firewall settings. Do you drop icmp requests?

3

The default settings on RouterBOARD block all input from WAN.

To enable ping, you need only enable ICMP echo requests. Run the following from terminal to enable ping from all interfaces, while still dropping everything else coming in from the WAN:

/ip firewall filter add place-before=[find chain=input] chain=input action=accept protocol=icmp icmp-options=8:0-255
4

Hmmm… not all, at least not for all boards. As far as I remember the default firewall settings for 75x and 951 allow ICMP on the input chain.

5

Fair enough… Make that “most” then. Certainly RB951G-2HnD (which I assume is what was meant… there’s no RB951F-2HnD) has that rule. I have RB951Ui-2HnD which has it, and according to this wiki page, they share common defaults, which include it.

6

Thank you.

But, we I keyed in this parameter, it has prompted the following error message:
/ip firewall filter add place-before=[find chain=input] chain=input action=accept protocol=icmp icmp-options=8:0-255
invalid internal item number

Please advise what should I do. Thank you.

Kind regards,

7

Remove the “place-before=[find chain=input]” and paste the command again. It should be added wothout any errors.
Than open IP->Firewall->Filter in winbox, in the top-right corner choose “input” from the drop down box, and then move the last visible rule as the last one before the first dropping rule.

8

I thought place-before would automatically accept just the first match, but apparently, no, so:

/ip firewall filter add place-before=[:pick [find chain=input] 0] chain=input action=accept protocol=icmp icmp-options=8:0-255

The “place-before” is a mean to save you from the “move” part in the instructions jacekes uses above, i.e. it will automatically place the rule where it will have an effect.