Firewall Blocking Traffic

A process for finding which firewall rule is dropping traffic it shouldn't — or confirming the firewall isn't actually the problem.

• troubleshooting
• firewall
• security

1. Confirm it’s actually the firewall

Before chasing firewall rules, rule out routing, NAT, and addressing — all three can produce symptoms that look exactly like a firewall drop from the client’s side (e.g., connection timing out).

• Is there a route? The router can’t forward traffic if it doesn’t know where to send it.
• Is NAT masquerading the source? The remote server might be trying to reply to a private 192.168.x.x IP because you forgot to masquerade outbound traffic.

2. Identify the Correct Chain

RouterOS uses distinct chains for traffic:

• input: Traffic destined to the router itself (e.g., WinBox, Ping to the router’s IP, DNS requests to the router).
• forward: Traffic passing through the router (e.g., a PC browsing the internet, PC on VLAN 10 talking to a Server on VLAN 20).
• output: Traffic originating from the router itself (rarely filtered).

CLI Check:

/ip firewall filter print
# If you are trying to allow a port forward to a web server inside your LAN, the accept rule MUST be in the 'forward' chain, not 'input'.

3. Check Rule Order

Firewall rules are evaluated top to bottom, and the first match wins.

If you place a rule to accept traffic on port 80 at the very bottom of the list, but there is a rule above it that says drop all, the traffic will be dropped. The accept rule is never reached.

WinBox Check: Go to IP -> Firewall -> Filter Rules. Drag and drop the accept rule above any broad drop rules that might catch that traffic.

4. Check Connection Tracking State

A stateful firewall expects to see two rules to handle two-way communication:

1. Allow new connections outbound (or inbound if hosting a server).
2. Allow established,related connections to let the reply traffic back through.

CLI Check:

/ip firewall filter print
# Look for a rule at the TOP of the forward and input chains that says:
# action=accept connection-state=established,related

Without this rule, your router will drop the replies to your web requests because they look like unsolicited traffic.

5. Enable Logging to Catch the Culprit

If you still can’t find what is dropping the traffic, use RouterOS’s logging feature.

Find your broad drop rules at the bottom of your chains and temporarily enable logging: CLI Procedure:

/ip firewall filter set [find action=drop] log=yes log-prefix="DROP-CATCH:"

Then open the Log window in WinBox. You will see exactly which IP and port is hitting the drop rule, confirming the firewall is indeed blocking it, and telling you which rule to adjust.

(Remember to turn logging off when you’re done, or you’ll fill your logs!)