Return from a chain (firewall)?

RouterOS Beginner Basics
1

I’m looking at this Wiki example http://wiki.mikrotik.com/wiki/Home_Firewall
I see a jump to ‘virus’ or ‘bad people’ chains, but these chains don’t have return at the end.
What happens if the packet isn’t dropped in virus chain - how does it continue without return in virus chain?

I see the same phenomenon in my own setup. I have ‘all packets’ jump to virus chain without return, but somehow numbers on the filters after the jump do advance, which means control somehow gets back to forward chain, but how?

I did RTFM, but it makes me totally puzzled.

2

You are correct in your observations:
The default action for a custom chain in RouterOS is ‘return’.
The default action for built-in chains (input, output, forward) in RouterOS is ‘accept’.

Refer to this post for a more detailed discussion:
http://forum.mikrotik.com/t/firewall-chains-default-policy-action/26475/1

3

We would then jump from the INPUT chain to the tcp_packets chain and start traversing that chain. When/If we reach the end of that chain, we get dropped back to the INPUT chain and the packet starts traversing from the rule one step below where it jumped to the other chain (tcp_packets in this case). If a packet is ACCEPTed within one of the sub chains, it will be ACCEPT’ed in the superset chain also and it will not traverse any of the superset chains any further. However, do note that the packet will traverse all other chains in the other tables in a normal fashion

http://www.linuxtopia.org/Linux_Firewall_iptables/c3945.html

‘return’ is an early jump out of a subchain, if a packet didn’t hit a rule that stopped processing in a subchain it automatically returns at the end.

4

Priceless!

Thanks a lot