Interface Confusion IP Firewall Filter

Hi All,

Moving from Cisco land to Mikrotik and a tad confused with IP Firewall Filter.
I need to allow a few ports to be opened.
The internal host IP is: 192.168.1.239.
There is tcp port 15015 and udp port 49049
I have a lan interface list called ‘inside’ and a wan interface list called ‘outside’

There is no NATing required, just open these ports.
I have put the existing Cisco Pix command with what I think is the equivalent Mikrotik command but I am still getting a bit confused as to when I should be using src-address vs dst-address and also which interface when.


PIX: access-list inside extended permit tcp host 192.168.1.239 any eq 15015
MTIK: chain=forward action=accept protocol=tcp src-address=192.168.1.239 in-interface-list=inside dst-port=15015 log=no log-prefix=“”

PIX: access-list inside extended permit udp host 192.168.1.239 any eq 49049
MTIK: chain=forward action=accept protocol=udp src-address=192.168.1.239 in-interface-list=inside dst-port=49049 log=no log-prefix=“”

Thanks in advance everyone

ROS firewall has notion of connection states. Usual approach is to use a quite general firewall rule near to beginning of firewall rule list

add action=accept chain=forward connection-state=established,related,untracked

which passes packets of connections which have already been allowed by other rules.

Then one builds further firewall rules which then deal only with initial packets of new connections. This is important as then the meaning of in- and out- becomes clear.

In your case: if a “outside” host starts a TCP connection targeting internal host port 15015, then the initial TCP packet enters router through “outside” interface, after all the firewall decisions and route selections are done that packet will leave router through “inside”. The IP packet will originate from “outside” host and is destined to the “inside” host. Which gives:

  • in-interface=outside
  • out-interface=inside
  • src-address=
  • dst-addres=192.168.1.239

so appropriate FW rule would be

action=accept chain=forward connection-state=new in-interface=outside dst-address=192.168.1.239 out-interface=inside protocol=tcp dst-port=15015

Despites the fact that UDP is stateless (and hence it’s not possible to determine originator of a “connection” just by inspecting packets), ROS does track UDP connections as well (making them almost statefull) and the in- and out- logic is then the same as with TCP.

As you can see, in ROS in- and out- don’t have “geographical” but rather logical meaning.