In
Building Advanced Firewall there is the following rule:
;;; accept DHCP discovery - most of the DHCP packets are not seen by an IP firewall, but some of them are, so make sure that they are accepted;
/ip firewall raw add action=accept chain=prerouting comment="defconf: accept DHCP discover" dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=udp src-address=0.0.0.0 src-port=68
Do I understand correctly that "most of the DHCP packets are not seen by an IP firewall" because they will most likely hit the server running in the same LAN segment and won't need routing?