Hi Guys.
I know the understanding of input chains and forward chains.
What I am trying to work out, is if I am supplying DNS to my LAN, blocking everything on the input chain, except winbox (for example) stops DNS from resolving. This is expecting.
Why does adding the rule on the input chain of established connections accept make this work?
Here is an example, with established removed, it no longer works. So how does that work without a new connection rule?
add chain=input comment="input established" connection-state=established
add chain=input comment="input related" connection-state=related
add chain=input comment=icmp protocol=icmp
add chain=input comment="local dns" dst-port=53 protocol=udp \
src-address-list="local lan"
add chain=input comment=winbox dst-port=8291 protocol=tcp src-address-list=\
"local lan"
add action=drop chain=input