I feel the fasttrack in my ROS(v6.48.6 on CHR x86_64) is disabled, because all fasttrack counters are zero.
But the fasttrack rule in “IP → Firewall → Filter Rules” is enabled and the “Bytes” & “Packets” in this rule are not zero, and these 2 numbers are increasing…
So could someone explain why the counters and the bytes/packets numbers are contradictory?
Hello Kartwall
I would recommend you to use the “default” firewall rule solution, because there the order of the rules is in the correct order. Policy rules are executed from “top to bottom”. You are a bit wrong.
If you want to find out more about configuration, you can read this - https://forum.mikrotik.com/viewtopic.php?t=180838
/interface list
add name=WAN
add name=LAN
/interface list member
add interface=ether1 list=WAN
add interface=bridge1 list=LAN
/ip firewall filter
{Input Chain}
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input in-interface-list=LAN
add action=drop chain=input comment="drop all else"
{forward chain}
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow port forwarding" connection-nat-state=dstnat
add action=drop chain=forward comment="drop all else"
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN