MikroTik Trainingmikrotiktraining.bd
Security hardening

Protect Your MikroTik Router: Input-Chain Firewall Basics for RouterOS v7

A minimal, readable input-chain policy that keeps management access on your LAN, plus the service and discovery settings that attackers look for first.

By Titas Sarker Published 26 Oct 2026 RouterOS v7.x
Commands in this article follow RouterOS v7 documentation but have not yet been marked as lab-tested on this site. Always test changes in a lab or maintenance window and keep a backup.

Problem

Your router answers WinBox, SSH or web requests from the Internet. Even with a strong password, exposed management services are the first thing automated scanners try.

Symptoms

  • Repeated failed logins from unknown addresses in Log.
  • /ip service print shows telnet, ftp or www enabled with no address restriction.
  • The router is reachable on port 8291 from outside your network.

Likely causes

  • The default configuration was removed (for example with No Default Configuration or Netinstall) and no input rules were added back.
  • Rules exist but are in the wrong order — a broad accept above the final drop.

Prerequisites

  • Interface lists LAN and WAN with the right members (the default configuration creates them). Check with /interface list member print.
  • A way back in if you lock yourself out: local access on a LAN port, or Safe Mode.

Warning: Firewall changes on the input chain can cut off your own session. Enable Safe Mode before you start and work from a LAN connection, not remotely over WAN.

Solution

1. Add a simple input policy

Order matters: RouterOS checks rules from top to bottom and stops at the first match.

RouterOS CLI
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked comment="input: allow established"
add chain=input action=drop connection-state=invalid comment="input: drop invalid"
add chain=input action=accept protocol=icmp comment="input: allow ICMP"
add chain=input action=accept in-interface-list=LAN comment="input: allow management from LAN"
add chain=input action=drop in-interface-list=!LAN comment="input: drop everything else"

If you already have input rules, use place-before= or drag the new rules above any broad accept rules in WinBox (IP → Firewall → Filter Rules).

2. Turn off services you do not use and limit the rest

RouterOS CLI
/ip service set telnet disabled=yes
/ip service set ftp disabled=yes
/ip service set www disabled=yes
/ip service set api disabled=yes
/ip service set api-ssl disabled=yes
/ip service set winbox address=192.168.88.0/24
/ip service set ssh address=192.168.88.0/24

Replace 192.168.88.0/24 with your management subnet.

3. Keep MAC access and discovery on the LAN only

RouterOS CLI
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/ip neighbor discovery-settings set discover-interface-list=LAN

Verification

  • /ip firewall filter print stats where chain=input — the counters on the final drop rule should rise when outside scanners hit the router.
  • From outside your network, test that ports 8291 (WinBox) and 22 (SSH) no longer answer.
  • /ip service print shows only the services you need, each with an address restriction.

Common errors

  • Locked out after adding the drop rule: your management interface is not a member of the LAN list. Fix the list membership from a local port, or let Safe Mode roll back.
  • VPN users cannot reach the router: add their interfaces (or an address list) to an accept rule above the final drop.

Rollback

Disable the last rule first — it is the one that blocks traffic:

RouterOS CLI
/ip firewall filter disable [find comment="input: drop everything else"]
Go deeper in class

This topic is covered hands-on in MTCSE — MikroTik Certified Security Engineer.

View MTCSE