For a certain firewall rule in the input chain I’d like to allow only some VLANs and router itself, but cannot figure out what interface represents router here.
I have tried to add a generic action=passthrough rule with a log and then use the ping tool on the router to its own local address, but RouterOS logs “in:(unknown 1) out:(unknown 0)”.
None you can see. We all know there’s loopback interface, but MikroTik keeps it hidden from users. I think it’s wrong, but that’s the way it currently is.
Am I understanding right that it’s impossible to have a firewall rule in the input chain that accepts only from the loopback interface?
Alternatively you can check for a source address of Src.Address.Type “local”.
Of course it is not really the same.
What is the user requirement, practical need to enable functionality that provides some service ?
Better diagnostics (firewall’s log/passthrough, sniffer, etc).
What are you trying to accomplish? You want to firewall packets from the router to itself?