input chain doesn't work in filter rule

RouterOS General
1

in firewall filter rule input chain doesn’t work.
Ex: chain=input action=accept src-address=192.168.0.3 doesn’t work. But chain=forward action=accept src-address=192.168.0.3 works.
Need to know why?

2

in firewall filter rule input chain doesn’t work.

Yes it does. I use it. What are you trying to do that makes you think it doesn’t?

add: As a matter of fact, it works so well, I was locking myself out of my routers on a regular basis until I got it figured out.

3

Off course it does. But in my case it doesn’t. Before i used to use web proxy when i have a single dsl connection. Now i got another dsl line. And with web proxy enabled i found it impossible to load balance between gateways (I posted the problem here, yet no solution). With web proxy enabled “add action=accept chain=input comment=”" disabled=no src-address=192.168.0.3 src-mac-address=00:0D:61:??:??:??" worked just fine. But when i disable web proxy and dst-nat it’s no more working, instead chain=forward working. Why?

4

If you mean a web proxy on the router, then that would be the input chain. The request is made to the proxy (input chain) and the proxy gets the page if it doesn’t have it (output chain).

If you don’t use the proxy, the request is made directly to the web sever, and that would be the forward chain.

5

Thanks a lot for the information. So without web proxy it’s always forward chain.

6

Conditionally, yes. If you are going to use the html setup page on the router, that will be input, but anything outside the router will be a forward chain if you do not use the proxy.

7

Input chain - traffic from another system aimed specifically at the router itself
Output chain - traffic orginating at the router sent to some other system.
Forward chain - traffic to/from a system behind the router (through the router)

See: http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Chains

The input chain is typically administrative access (CLI session via ssh or telnet, WebFig via http or https, WinBox via port 8291) to the router or access to other services that the router provides (it’s webproxy, or ftp server, or samba server, or NTP server, or …)

8

Now i don’t have any rule with input chain in firewall filter, all in forward chain. But i see lots of packets coming to wan interface from input chain, but no packets on output chain to lan interface. And those packets are not shaped. What should i do with those packets? All mangle rules are in forward chain.

9

Maybe you are not masquerading everything? What is in “/ip firewall nat”?

10

/ip firewall nat
0 chain=srcnat action=masquerade out-interface=Internet