The logic of Filter Rules

RouterOS General
1

Hi, I would clear myself how RouterOS manage rules, questions are:

  • Is destnat and srcnat come first? Then the filter rules will impact on already processed packets. It looks to me yes.
  • Does the filters be applied from the top to the bottom and is the first rule compatible with packet enough to apply and jump to the next packet?
    For example, if the first rule will match the packet, and the following rule too, will be only the first rule processed?
  • If yes, how can I doubel process that packet with the following rules?

Anything else important to add? Thanks

2

easy

https://help.mikrotik.com/docs/display/ROS/Packet+Flow+in+RouterOS

3

True. Specifically, this chart:

4

Thanks, if I understand right, in case a packet is coming to router there is a prerouting, then input or forward, when pacet exit is filtered output then postrouting, right?

Now please suppose you want to drop all input packets from source 192.168.1.0/24 to dest 192.168.0.0/16 but you want to allow only the subnet 192.168.0.0/24. What will be the the difference between:
roule 1: drop dest 192.168.0.0/16
roule 2: accept dest 192.168.1.0/24

and

roule 1: accept dest 192.168.1.0/24
roule 2: drop dest 192.168.0.0/16

If now I send a packet with dest 192.168.0.80, will only the first roule been executed when the source match the filter? Or will them both executed? And, in the first case, is the packet already dropped so the second roule can’t be executed?
Thanks

5

filter rules work on top-down first-match base as a rule of thumb in ROS (and mostly in any OS of other vendors too)
so the first rule a connection matches into will be executed and no following rule for that matched connection