Hello. What is the best way to block network traffic from external network? My router hap ax3 (v.7.20.6). A cable from provider is connected to router's ether1 port. The provider connects/authorizes via an l2tp tunnel, interface name freedom-l2tp. So, what's the best way to block traffic from e…

[image] bagas: I deleted the standard rules, I don't need them. Fine. No need for rules, so don’t ask for rules. Otherwise, I promise that @erlinden ’s will be quite effective…

Not really sure what traffic you want to block but from my understanding you want to know which is better? Selecting the interface Eth1 or the L2TP? If you have the L2TP on Ether 1 then you should select in and L2TP. Its the same when you do port forwarding and you have a PPPoE config then you have…

[image] jnortje23: If you have the L2TP on Ether 1 then you should select in and L2TP. Its the same when you do port forwarding and you have a PPPoE config then you have to select that as your Interface. Best practice is to create a Address List or on Interface list and work with your Firewall …

You deleted the rules and now you say “block everything that is not allowed in the firewall.” you have no firewall. Restore the default config. It is a very strong firewall. Suggest not to mess with what you don't understand.

Just in case, Rule #8 : [image] The twelve Rules of Mikrotik Club Beginner Basics Preamble and disclaimer: The following is a set of Rules that are intended as advice useful to avoid the most common errors observed in configuration posted on this forum. It is…

[image] bagas: I've already figured out that firewall rules need to use ISP's authentication interface (L2TP) rather than physical Ether1 interface. It's partialy true. A lot of traffic could happen on WAN's (Eth1) interface L2 level, traffic that comes from other routers connected to same L2…

[image] jnortje23: Best practice is to create a Address List or on Interface list and work with your Firewall rules based of that. Default config already uses interface lists (WAN in particular). If actual WAN setup doesn't match default (which uses ether1 as interface carrying IP traffic), t…

[image] mkx: it is very wise to include to WAN interface list also all interface underlying the "normal" IP-carrying interface ... in this particular case ether1 (which is there already by default) If there is an L2TP tunnel connection from an Internet provider, then what is the point of addi…

And what path do you think that L2TP tunnel uses ? Thin air ?

What is the best way to block network traffic from the external network?

RouterOS Security

jaclaz January 12, 2026, 3:25pm 17

Just in case, Rule #8 :

If you want to comply with it, all you have to do is to categorize the L2TP interface as WAN in:

/interface list member