Trying to understand defconf firewall

[jaclaz]

Some answers (hopefully):

@tetyys

How can a completely unrelated external incoming packet bypass a chain named “INPUT”?

Input means (in this context) that the destination is the device itself.
As opposed to forward that means that packet has a different destination and "passes through" the device.

If you prefer the check in #12 differentiates the traffic between what is destined to the router from what is destined to other addresses (hopefully reachable through the router).

This should also answer your question #5, input chain only applies to packets that have "dst-address=self" (destined to the router itself)

@tetyys

Question 2) Not related to defconf yet, but what is “localhost” in step 5 in the flowchart? Is it only the router itself? “self” is used two times in the flowchart, but it doesn’t seem that they mean the same thing (local router IP vs WAN IP)

"self" means always the same "thing" the router itself, and it is used THREE times,:
5 from self (localhost)? <- try reading it as “Is src-address router's own?”
12 dst addr=self? <- try reading it as “Is dst-address router's own?”
24 dst addr=self? <- try reading it as “Is dst-address router's own?”

@tetyys

Question 6) I have internet detection feature enabled, which sends DNS queries for cloud.mikrotik.com every second. Enabling logs for rule 4, I see logs for UDP [dns server]:53→[WAN IP]:5678, which I assume is the DNS answer. This actually makes sense because DNS answers are coming from WAN, and are routed through INPUT chain. If the rule is to drop, how can internet detection feature work?

First thing you shouldn't, that is Rule #5:
The twelve Rules of Mikrotik Club

Post the actual log entries you see, but check also logs for firewall rule #1, maybe the DNS answers are in the latter.

@tetyys

Question 7) Do we need an additional rule 6 (compared to rule 2) because DSTNATed traffic doesn’t touch INPUT chain? Any other reasons?

Yes, because firewall rule #2 applies to chain INPUT only, whilst firewall rule #6 applies to chain FORWARD only.

@tetyys

Question 8) I have been running my router for a some time. Rule 7 has never been triggered (packet count is 0). Why is this rule needed? If an incoming connecting is DSTNATed, then the rule doesn’t apply (actually I don’t see how anything would reach FORWARD chain if traffic isn’t DSTNATed). If incoming connection is not DSTNATed, then only INPUT chain applies and it’s dropped by rule 4. It is theoretically possible to send traffic to the router with dst ip of 1.2.3.4, so maybe then it would reach the FORWARD chain and wouldn’t be DSTNATed?

Thanks. I would actually prefer a firewall that DROPs by default, so if anyone has a copypaste config I could learn from, that would be great.

There are mainly two schools of thought on Mikrotik forum about firewall rules, the rextendeders and the anavites, the former believe that the default firewall from Mikrotik is cleverly designed AS IS and should be NOT modified (if not to drill small holes in it to allow some specific service/connection), the latter believe that it is ALMOST fine but you need to replace the last rule with a "drop all else" one and EXPLICITLY ADD just before it what you actually want to allow.
The debate is essentially around how the default last rule is too clever and complex to understand, see these thread:
Ready to start my custom firewall rules journey
Review of PPPoE and Firewall rules for improvements
Firewall rules analysis

If you use the final "drop all else" rule in the forward chain, you essentially have your "Drop by default" setting, but anything that you don't explicitly allow before it won't pass through.

AND do check the firewall part in the excellent article by tangent here:
https://tangentsoft.com/mikrotik/wiki?name=Default%20Router%20Configuration