Firewall and NAT in RouterOS 7

A factory-default RouterOS device has an empty firewall (unless you used the default configuration script). Before connecting any router to the public internet, you must implement basic firewall filters and configure Network Address Translation (NAT) so internal devices can route externally.

1. Network Address Translation (NAT)

NAT is configured under /ip firewall nat. The two most common types are Source NAT (for internet access) and Destination NAT (for port forwarding).

Source NAT (Masquerade)

To allow LAN devices to access the internet, their private IP addresses must be translated (masqueraded) behind the router’s public WAN IP.

/ip firewall nat
add chain=srcnat out-interface=ether1 action=masquerade comment="Default Masquerade"

Destination NAT (Port Forwarding)

To allow internet users to access an internal server (like a web server on 192.168.88.50:80).

/ip firewall nat
add chain=dstnat in-interface=ether1 protocol=tcp dst-port=80 action=dst-nat to-addresses=192.168.88.50 to-ports=80 comment="Forward HTTP"

2. Firewall Filter Rules

RouterOS processes firewall rules from top to bottom. The first rule that matches a packet is executed, and subsequent rules are ignored. Therefore, rule order is critical.

There are three primary chains:

• Input: Traffic destined to the router itself (e.g., WinBox, Ping, SSH).
• Forward: Traffic passing through the router (e.g., LAN to Internet).
• Output: Traffic originating from the router itself.

Basic Input Rules (Protecting the Router)

/ip firewall filter
add chain=input connection-state=established,related,untracked action=accept comment="Accept established/related"
add chain=input connection-state=invalid action=drop comment="Drop invalid"
add chain=input in-interface=ether1 action=drop comment="Drop all other WAN input"

Basic Forward Rules (Protecting the LAN)

/ip firewall filter
add chain=forward connection-state=established,related,untracked action=accept comment="Accept established/related"
add chain=forward connection-state=invalid action=drop comment="Drop invalid"

# Optional: If using Port Forwarding, you must explicitly accept DST-NAT'd traffic
add chain=forward connection-nat-state=dstnat action=accept comment="Accept Port Forwards"

add chain=forward in-interface=ether1 action=drop comment="Drop all other WAN forward"

Tip: Drag and drop rules in WinBox to reorder them, making sure your ‘Accept’ rules are at the top and the ‘Drop’ rules are at the bottom of their respective chains.