{"id":119,"date":"2024-02-06T19:40:40","date_gmt":"2024-02-07T00:40:40","guid":{"rendered":"https:\/\/blog.lfps64.com\/?p=119"},"modified":"2026-04-11T17:20:23","modified_gmt":"2026-04-11T22:20:23","slug":"simple-basic-home-firewall-with-mikrotik","status":"publish","type":"post","link":"https:\/\/blog.lfps64.com\/?p=119","title":{"rendered":"Simple &amp; Basic Home Firewall with Mikrotik"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"><\/h1>\n\n\n\n<p>One of the most common mistakes I&#8217;ve seen from technicians setting up MikroTik routers is leaving the firewall completely empty. The assumption seems to be that a strong password is enough protection. It isn&#8217;t. A password protects your router&#8217;s management interface \u2014 it does nothing to stop malicious traffic from flowing through it, scanning your network, or exploiting services running behind it. A firewall is not optional. It&#8217;s the foundation.<\/p>\n\n\n\n<p>This post walks you through a simple but solid home firewall ruleset for MikroTik. It&#8217;s designed to be approachable \u2014 you don&#8217;t need to be a network engineer to follow it \u2014 but it covers the right bases and explains the reasoning behind each decision.<\/p>\n\n\n\n<p>A few things to keep in mind before we start:<\/p>\n\n\n\n<ul>\n<li>This assumes your firewall is currently empty. If it isn&#8217;t, read through the rules carefully and apply what makes sense for your setup.<\/li>\n\n\n\n<li>I group rules by purpose rather than by chain. I find this easier to reason about, especially when troubleshooting.<\/li>\n\n\n\n<li>MikroTik processes firewall rules in sequential order \u2014 the position of each rule matters.<\/li>\n\n\n\n<li>I&#8217;m using <code>ether1-wan<\/code> as the WAN interface and <code>bridge.home<\/code> as the LAN bridge throughout. Adjust these to match your actual interface names.<\/li>\n\n\n\n<li>This post does not cover NAT configuration \u2014 that deserves its own post.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">The Ruleset<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Accept established and related traffic<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>\/ip firewall filter\nadd action=accept chain=input comment=\"Accept established &amp; related inputs\" \\\n    connection-state=established,related\nadd action=accept chain=forward connection-state=established,related\n<\/code><\/pre>\n\n\n\n<p>These go first and they&#8217;re critical for performance. Once a connection is established, there&#8217;s no need to re-evaluate every subsequent packet against the full ruleset. Accepting established and related traffic early means the router only does the heavy lifting once per connection, not once per packet. Skip these and your CPU will suffer for it.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">2. Drop invalid packets<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=drop chain=input comment=\"Drop invalid inputs &amp; forwards\" \\\n    connection-state=invalid\nadd action=drop chain=forward connection-state=invalid\n<\/code><\/pre>\n\n\n\n<p>Invalid packets are those that don&#8217;t belong to any known connection and don&#8217;t make sense as the start of a new one \u2014 malformed headers, out-of-sequence packets, and similar garbage. There&#8217;s no legitimate reason to accept them. Drop them early.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">3. Reject blacklisted sources<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=reject chain=input comment=\"Reject blacklisted\" in-interface=\\\n    ether1-wan reject-with=icmp-network-unreachable src-address-list=\\\n    Blacklist\n<\/code><\/pre>\n\n\n\n<p>This rule rejects any traffic from IPs that have been added to a <code>Blacklist<\/code> address list. The list itself gets populated later by the blacklisting rules \u2014 this rule just enforces it. The order matters: this needs to come before any accept rules so blacklisted IPs get stopped regardless of what they&#8217;re trying to do.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">4. Drop unsolicited inbound forwards<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=drop chain=forward comment=\"Drop all from WAN not DSTNATed\" \\\n    connection-nat-state=!dstnat connection-state=new in-interface=ether1-wan\n<\/code><\/pre>\n\n\n\n<p>This rule blocks any new inbound connection from the WAN that hasn&#8217;t been explicitly port-forwarded via DNAT. Without this, your router would happily forward unsolicited traffic from the internet toward your internal devices. Unless you&#8217;ve set up a DNAT rule for a specific service, nothing from the outside should be initiating connections to your network.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">5. Accept traffic from a whitelist (optional)<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=accept chain=input comment=\"Accept inputs from the whitelist\" \\\n    in-interface=ether1-wan src-address-list=Whitelist\n<\/code><\/pre>\n\n\n\n<p>This is optional. It allows specific trusted external IPs to reach the router directly \u2014 useful if you manage the router remotely from a known static IP. Use it carefully. If you don&#8217;t have a stable public IP or aren&#8217;t sure you need it, skip it. A WireGuard VPN is a much better way to manage your router remotely.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">6. Log and track access attempts on the Winbox port<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=add-src-to-address-list address-list=\"Unknown Admin\" \\\n    address-list-timeout=1w chain=input comment=\"Log unknown admins\" \\\n    dst-port=8291 in-interface=ether1-wan log=yes log-prefix=\"Unknown Admin\" \\\n    protocol=tcp src-address=0.0.0.0\/0\nadd action=accept chain=input comment=\"Accept unknown admins\" dst-port=8291 \\\n    in-interface=ether1-wan protocol=tcp src-address=0.0.0.0\/0\n<\/code><\/pre>\n\n\n\n<p>Port 8291 is the default Winbox port. If you&#8217;re keeping it accessible from the WAN \u2014 and I&#8217;d strongly recommend against it \u2014 these rules at least log who&#8217;s trying to connect so you can see it happening.<\/p>\n\n\n\n<p>More importantly: <strong>change this port<\/strong>. Leaving it at 8291 means every automated scanner on the internet knows exactly where to knock. Moving it to a non-standard port won&#8217;t make you invisible, but it will dramatically reduce the noise. You can change it in WinBox under <strong>IP \u2192 Services \u2192 Winbox<\/strong>.<\/p>\n\n\n\n<p>Better yet, block it from the WAN entirely and only access your router from your local network or over a VPN.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">7. Accept traffic from your LAN<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=accept chain=input comment=\"Accept inputs from home\" in-interface=\\\n    bridge.home src-address=192.168.88.0\/24\nadd action=accept chain=forward comment=\\\n    \"Accept internet access for home devices\" in-interface=home-bridge \\\n    out-interface=ether1-wan src-address=192.168.88.0\/24\n<\/code><\/pre>\n\n\n\n<p>These rules allow your local devices to reach the router and access the internet. Adjust the subnet and interface names to match your LAN configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">8. Blacklist port scanners<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=add-src-to-address-list address-list=Blacklist \\\n    address-list-timeout=1w chain=input comment=\\\n    \"Add forbidden attempts to the blacklist\" dst-port=\\\n    21-23,25,53,80,110,135,139,443,445,587,1025,1352 in-interface=ether1-wan \\\n    protocol=tcp src-address=0.0.0.0\/0 src-address-list=!Whitelist\nadd action=add-src-to-address-list address-list=Blacklist \\\n    address-list-timeout=1w chain=input dst-port=\\\n    1433,1521,3306,3389,5060,5900,6001,8000-8080 in-interface=\\\n    ether1-wan protocol=tcp src-address=0.0.0.0\/0 src-address-list=!Whitelist\nadd action=add-src-to-address-list address-list=Blacklist \\\n    address-list-timeout=1w chain=input dst-port=\\\n    53,69,161,135-139,445,593,1433-1434,1900 in-interface=ether1-wan \\\n    protocol=udp src-address=0.0.0.0\/0 src-address-list=!Whitelist\n<\/code><\/pre>\n\n\n\n<p>Any external IP that probes these ports gets added to the <code>Blacklist<\/code> for one week. These ports cover the most commonly abused attack vectors: FTP, SSH, Telnet, SMTP, DNS, NetBIOS, SMB, RDP, SIP, VNC, SQL Server, MySQL, SNMP, and UPnP among others.<\/p>\n\n\n\n<p>The logic is simple: if you&#8217;re not deliberately exposing any of these services to the internet, there is no legitimate reason for an outside IP to be probing them. Anyone who does is either scanning opportunistically or targeting you specifically \u2014 either way, they go on the list. Rule 3 then blocks them from that point forward for the entire week.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">9. Drop everything else<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>add action=reject chain=input comment=\"Drop all from WAN\" in-interface=\\\n    ether1-wan reject-with=icmp-network-unreachable\nadd action=reject chain=forward comment=\"Drop everything else\" reject-with=\\\n    icmp-network-unreachable\n<\/code><\/pre>\n\n\n\n<p>These are your catch-all rules. Anything from the WAN that hasn&#8217;t been explicitly accepted by a previous rule gets dropped here. Never skip these \u2014 without them, unmatched traffic falls through to RouterOS defaults, which is not a firewall policy you want to rely on.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Complete Rule Order at a Glance<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>#<\/th><th>Chain<\/th><th>Action<\/th><th>Purpose<\/th><\/tr><\/thead><tbody><tr><td>1<\/td><td>input \/ forward<\/td><td>Accept<\/td><td>Established &amp; related traffic<\/td><\/tr><tr><td>2<\/td><td>input \/ forward<\/td><td>Drop<\/td><td>Invalid packets<\/td><\/tr><tr><td>3<\/td><td>input<\/td><td>Reject<\/td><td>Blacklisted sources<\/td><\/tr><tr><td>4<\/td><td>forward<\/td><td>Drop<\/td><td>Unsolicited WAN inbound<\/td><\/tr><tr><td>5<\/td><td>input<\/td><td>Accept<\/td><td>Whitelisted sources (optional)<\/td><\/tr><tr><td>6<\/td><td>input<\/td><td>Log + Accept<\/td><td>Winbox port tracking<\/td><\/tr><tr><td>7<\/td><td>input \/ forward<\/td><td>Accept<\/td><td>LAN traffic<\/td><\/tr><tr><td>8<\/td><td>input<\/td><td>Add to list<\/td><td>Blacklist port scanners<\/td><\/tr><tr><td>9<\/td><td>input \/ forward<\/td><td>Reject<\/td><td>Everything else<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Final Thoughts<\/h2>\n\n\n\n<p>This ruleset won&#8217;t make your router impenetrable, but it will make it vastly more resilient than an empty firewall with just a password on it \u2014 which, again, is a setup I see far more often than I should.<\/p>\n\n\n\n<p>Start with these rules, watch your logs, and watch your blacklist populate. You&#8217;ll quickly get a sense of what&#8217;s being thrown at your network from the outside every single day. It&#8217;s eye-opening, and it makes a strong case for never leaving a MikroTik without a proper firewall again.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>One of the most common mistakes I&#8217;ve seen from technicians setting up MikroTik routers is leaving the firewall completely empty. The assumption seems to be that a strong password is enough protection. It isn&#8217;t. A password protects your router&#8217;s management interface \u2014 it does nothing to stop malicious traffic from flowing through it, scanning your &hellip; <a href=\"https:\/\/blog.lfps64.com\/?p=119\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Simple &amp; Basic Home Firewall with Mikrotik&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[21,11],"_links":{"self":[{"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/posts\/119"}],"collection":[{"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=119"}],"version-history":[{"count":2,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/posts\/119\/revisions"}],"predecessor-version":[{"id":149,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=\/wp\/v2\/posts\/119\/revisions\/149"}],"wp:attachment":[{"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=119"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=119"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lfps64.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=119"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}