Router with few VLANs - help needed #2

RouterOS Beginner Basics
11

  • As @jaclaz wrote, you can remove #17 and keep #18.

  • Current rule #16 should be moved below the "established,related,untracked" original rule #18 (and also after the "drop invalid" rule, see below).

    For the bulk of the traffic (the very large majority of the packets), the connection state would be established. When you download a 150KB JPG image for example, then usually only one packet has state new, while the other 100+ ones will have state established. You would want the packets in the established to be handled as soon as possible, skipping the other rules below immediately. Of course, fasttrack already helps in this case, but for the cases where fasttrack is not working or not enabled, you don't want to have rules that only act on packets with connection state new to be placed higher than the rule that accepts established in the chain.

  • The chain=forward action=drop connection-state=invalid rule should be placed right after that original #18 rule.

  • Once you've got the "accept established,related,untracked" and "drop invalid" rules at the correct positions (high in the chain, only behind fasttrack and the two special ipsec related rules), then all the other accept or drop rules below them no longer need connection-state=new and that condition can be removed from those rules.

    The possible values for connection-state are new, established, related, untracked, invalid, which means once you already have the 3 rules (including the fasttrack rule) that catch and handle established, related, untracked, invalid, the only possible connection state for the packets caught by other rules below them is new. It is thus totally redundant and unnecessary when you also specify connection-state=new on them. Any packets they can see already only have that connection state.

  • The original rule #20 is fully redundant (already handled by original #18) and should be removed too.

  • When you have the catch all rule (original #25) then you normally don't need the original rule #22 anymore, because no other rule between them explicitly accepts things coming from WAN.

    But you can still leave it there if you want, in case you might insert some accept rules in between and forget to handle incoming connections from WAN with those. With normal traffic (not under attack) only a small ratio of the packets has connection-state=new, so having a few unnecessary rules below the rules that handle established, related, untracked, invalid doesn't affect the performance too much.

  • If in the future for some reason you are not able to use fasttrack anymore (for example you want to use simple queues, or all traffics need mangle) then when you disable the fasttrack rule you should also move the two ipsec rules below the "accept established, related, untracked" rule to prioritize it as much as possible. Without fasttrack, the difference between having to only process 1 rule instead of 3 for most of the packets is very much noticeable.

    With fasttrack enabled and active, then you need those two rules above the fasttrack rule, because from your config, it looks like IPsec is in use.