There is one thing I’m wondering. Well, just now.
The “drop invalid” rule.
Many configuration put this rule as a second or third rule in the chain. Usually first rule is “accept established,related,untracked”.
I understand these rules work in order, first rule, second rule and so on.
Now, first rule “accept established,related,untracked” let traffic flow if traffic is “established,related,untracked”. And firewall does not check following rules anymore?
What if this traffic “established,related,untracked” contain something “invalid”? Is it checked by firewall at all?
Should “drop invalid” be the first rule?
TL;DR, connection tracking recognizes five states and each packet can have only one. If it’s established, it can’t be invalid. There are more established/related/untracked packets than invalid, so that’s why that rule is first.
Ok, that make sense. I lost my focus and I didn’t realise that packet can have only one state. I’m quite happy to have Mikrotik router because all problems are solved sooner or later here in the forum.
Imagine this scenario: you have the usual sequence of firewall filter rules:
accept established,related,untracked
accept connections for your service (e.g. protocol=tcp dst-port=80)
drop everything
So if some malicious device sent a packet, targeting your HTTP server, but would be invalid according to firewall’s connection tracking machinery, the filter rule set above would still allow such malicious packet to be forwarded to server behind firewall. If there’s a “drop invalid” rule right after rule #1 above (or even as absolute first rule), then the malicious packet wouldn’t reach backend server.
So in the case of 5009, I believe it have enough cpu power to handle traffic if “drop invalid” is the first rule ( it will check all the packets for “invalid”)? But I think I will keep it as a second rule. I don’t want to push my nice router even close to the limits…
