I have a MikroTik router acting as an Access Point and have implemented some Firewall rules to protect the router and users.
In the Forward chain I have two rules to accept packets that are “Established” or “Related”, I then have a log rule to identify packets that are not being handled. Every so often I get entries like the following in the log:-
forward: in:ether1 out:vapprivate, src-mac 00:0b:6b:56:7d:51, proto TCP (SYN/ACK), 209.135.45.232:80->10.0.8.50:2202, len 48
The Access Point has another Firewall between it and the Internet (on ether1) which also only allows “Established” and “Related” packets in.
Why are these packets not being handled? If they have been filtered by the first Firewall as “Established” or “Related”, why does the MikroTik Firewall fail to pass them through the accept rules?
Running RouterOS v2.9.48.