Introduction: Why SMEs Need to Master Firewall Configuration
In today’s digital era, network security has become part of the infrastructure of business operations. For small and medium-sized enterprises, building a secure and reliable IT environment within a limited budget is a real problem they must face. As the first line of defense for an enterprise network, a firewall’s configuration directly determines the level of security of the company’s data assets.
Mikrotik is a globally recognized network equipment vendor, and its RouterOS system is known for its powerful features and outstanding value for money. This article explains in depth how to configure a Mikrotik firewall, helping enterprise IT administrators quickly master the core technical points. We also introduce Siwenlide’s IT Operations Outsourcing service, which provides reliable technical support for companies without a dedicated IT team.
Part 1: Firewall Fundamentals
1.1 What Is a Firewall
A firewall is a network security system that monitors and controls the data traffic entering and leaving a network according to preset security rules. Think of a firewall as an intelligent gatekeeper: it carefully checks every visitor (data packet) that wants to enter or leave, allows only those that comply with the rules, and blocks suspicious traffic.
The main threats facing enterprise networks include:
- External attacks: hackers attempt to break into the corporate intranet and steal sensitive data
- Malware: viruses, Trojans, and ransomware spread through the network
- Data leakage: internal sensitive information is illegally transmitted to the outside
- Service abuse: employees visit non-work-related websites, reducing productivity
A properly configured firewall can effectively prevent the risks above and build a solid network security defense for the enterprise.
1.2 Advantages of Mikrotik RouterOS
Mikrotik’s RouterOS system is widely popular in the SME market for the following reasons:
Comprehensive features: RouterOS is not just a router system; it also integrates a firewall, VPN server, bandwidth management, wireless AP, and many other functions, so a single device can meet multiple needs.
High cost-effectiveness: Compared with brands such as Cisco and Huawei, Mikrotik devices are affordable yet offer comparable capabilities, making them particularly suitable for SMEs with limited budgets.
Flexible configuration: It supports command line, web interface, WinBox graphical client, and other management methods, meeting the needs of users with different technical skill levels.
Active community: A large number of users and technical professionals worldwide share their experience, so solutions are easy to find when problems arise.
Part 2: Preparation for Firewall Configuration
2.1 Device Login Methods
Mikrotik devices support several login methods:
WinBox (recommended): A graphical management tool for the Windows platform with intuitive operation, suitable for beginners. Download address: https://mikrotik.com/download
WebFig: Access the device IP through a browser, no software installation required, cross-platform.
Telnet/SSH: Command-line methods, suitable for advanced users and bulk configuration scenarios.
For the first login, we recommend using WinBox and connecting via MAC address (which does not depend on IP configuration), as it is more secure and reliable.
2.2 Understanding Firewall Chains
The RouterOS firewall works on the concept of chains. The main chains include:
- input chain: handles packets destined for the router itself, such as management traffic
- output chain: handles packets sent from the router
- forward chain: handles packets forwarded through the router, that is, traffic between the internal network and the external network
Understanding the difference between these three chains is the foundation for configuring a firewall correctly.
2.3 Firewall Action Types
Each firewall rule can define the following actions:
- accept: allow the packet to pass
- drop: silently discard the packet, and the sender is not notified
- reject: reject the packet, and the sender receives a rejection notice
- log: record packet information in the log
In security practice, drop is often used instead of reject, because drop does not reveal the existence of the firewall, making things harder for attackers.
Part 3: Basic Firewall Configuration Steps
3.1 Securing the Router Itself
The router is the core node of the enterprise network, and its security must be protected first. Below is a basic input chain configuration:
# Allow established and related connections /ip firewall filter add chain=input connection-state=established,related action=accept comment="Allow established connections" # Allow ICMP (ping) from the internal network add chain=input protocol=icmp src-address=192.168.88.0/24 action=accept comment="Allow internal ping" # Allow WinBox access from the internal network add chain=input protocol=tcp dst-port=8291 src-address=192.168.88.0/24 action=accept comment="Allow internal WinBox" # Drop all other input traffic add chain=input action=drop comment="Drop other input traffic"
The configuration above ensures that only the internal network can manage the router, while the external network cannot access it directly, greatly improving security.
3.2 Controlling Internal Network Internet Access
The forward chain controls the internet access behavior of internal users. Below are common configurations:
# Allow established and related connections /ip firewall filter add chain=forward connection-state=established,related action=accept comment="Forward established connections" # Allow the internal network to access the external network add chain=forward src-address=192.168.88.0/24 action=accept comment="Allow internal network outbound" # Block direct access from the external network to the internal network add chain=forward dst-address=192.168.88.0/24 action=drop comment="Block external access to internal network"
3.3 NAT Configuration
Enterprise intranets usually use private IP addresses and require NAT to access the public network:
/ip firewall nat add chain=srcnat out-interface=ether1-WAN action=masquerade comment="NAT for internal network internet access"
The masquerade action automatically uses the IP of the external interface as the source address, making it suitable for dynamic IP environments.
Part 4: Advanced Security Configuration
4.1 Port Scan Protection
Attackers often probe open services on a target through port scanning. You can configure rules to detect and block scanning behavior:
/ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="Detect port scanning"
Meaning of the psd parameters: within 3 seconds, if the same source attempts to connect to 3 different ports and reaches a weight of 1, it is judged to be a scan and dropped.
4.2 Brute-Force Protection
For services exposed to the public network (such as VPN), brute-force attacks must be prevented:
/ip firewall filter add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="SSH blacklist" add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1d add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m
The rules above implement progressive banning: the first attempt is added to the stage1 list, the second to stage2, the third to stage3, and the fourth goes directly into the blacklist and is banned for one day.
4.3 Bandwidth Management
RouterOS queues enable fine-grained bandwidth control:
/queue simple add name="Department A" target=192.168.88.0/25 max-limit=10M/10M limit-at=2M/2M priority=5 add name="Department B" target=192.168.88.128/25 max-limit=20M/20M limit-at=5M/5M priority=3
Parameter description: max-limit is the maximum bandwidth, limit-at is the guaranteed bandwidth, and the smaller the priority value, the higher the priority.
Part 5: Common Problems and Solutions
5.1 No Internet Access After Configuration
Troubleshooting steps:
- Check whether the NAT rule is configured correctly
- Confirm that DNS resolution works properly (try pinging 8.8.8.8 to test connectivity)
- Check the client’s gateway and DNS settings
- Review the firewall logs to confirm whether any traffic is being blocked
5.2 External Network Cannot Access Internal Services
If you need to let the external network access an internal web server, you must configure port mapping:
/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 in-interface=ether1-WAN action=dst-nat to-addresses=192.168.88.10 to-ports=80 comment="Web server mapping"
At the same time, make sure the forward chain allows the relevant traffic to pass.
5.3 Locked Out by a Configuration Mistake
If you make a mistake while configuring the firewall, you may lose access to the router. Solutions:
- Physical reset: the router has a reset button; hold it while rebooting to restore the default configuration
- MAC Address Connection: WinBox can connect via MAC address without relying on IP configuration
- Console Cable: Connect directly with a serial cable, bypassing the network layer
Before any major configuration change, export a configuration backup:
/export file=backup-before-change
Part 6: The Value of IT Operations Outsourcing
6.1 Why Choose IT Operations Outsourcing
For most small and medium-sized businesses, networking technology is not their core business. Hiring a dedicated network engineer is costly, and it is hard to find professionals who understand both Mikrotik and network security. The outsourcing model lets companies:
- Reduce costs: no need to hire dedicated IT staff, saving on salaries and training
- Professional assurance: an experienced service team delivers more standardized and secure configurations
- Fast response: when a fault occurs, a professional team steps in quickly
- Focus on the core business: managers concentrate on growth instead of technical details
6.2 Siwenlide IT All-in-One Service
The “IT All-in-One” service from Beijing Siwen Lide Technology & Trade Co., Ltd. gives small and medium-sized businesses a one-stop IT Operations solution:
A three-in-one service package:
- Internet access: enterprise-grade commercial broadband, with cloud private line service available where dedicated lines are required; we hold an ISP license from the MIIT (Ministry of Industry and Information Technology), fully legal and compliant
- Free network equipment: firewalls, enterprise routers, switches, and wireless APs, provided free of charge during the contract term, with free repair and replacement
- Non-stop IT Operations support: multiple channels including a WeChat service group, official account repair requests, and phone support; remote and on-site service with no limit on the number of visits
Core advantages:
- Customers pay a single IT Operations Services fee and enjoy a complete IT infrastructure, saving 99% of equipment procurement costs
- Solves three major pain points: high internet costs, expensive equipment with poor after-sales support, and slow IT Operations response
- Professional credentials: ISP license from the MIIT, ISO9001/ISO20000 certifications, Huawei HCIE, and Mikrotik MTCTCE certification
6.3 Service Process
After you sign up for Siwenlide services, our technical team will:
- On-site survey: assess the existing network environment and understand business needs
- Solution design: design a sound network architecture based on company size and business characteristics
- Equipment deployment: install and configure firewalls, routers, switches, and other devices
- Rule configuration: configure firewall policies according to security requirements
- Training and handover: walk company managers through basic operations and emergency handling
- Ongoing IT Operations: daily monitoring, fault handling, regular inspections, and configuration optimization
Part 7: Summary and Recommendations
7.1 Key Points Recap
This article has covered Mikrotik firewall configuration in detail. The key points include:
- Understanding the roles of the input, output, and forward chains
- Prioritizing the router’s own security
- Adopting a “default deny” security policy
- Configuring protection against port scanning and brute-force attacks
- Backing up configurations regularly to prevent accidental loss
7.2 Recommendations for Small and Medium-Sized Businesses
For small and medium-sized businesses without a dedicated IT team:
- Take network security seriously — don’t wait for an incident to act
- Choose a reliable outsourcing provider for professional support
- Review network configurations regularly and update security policies promptly
- Train employees on security awareness to reduce human risk
- Establish an emergency response process to ensure fast recovery from failures
Conclusion
Network security is ongoing work, not something a single configuration can settle once and for all. As your business grows and technology evolves, security policies need continuous adjustment and refinement. We hope this article helps IT administrators at small and medium-sized businesses master the basics of Mikrotik firewall configuration and build a more secure, reliable enterprise network.
If you run into problems during configuration, or would like professional IT Operations Services support, feel free to contact Siwenlide. We offer a free IT Operations assessment to help you find the service plan that best fits your business needs.
📞 Contact Siwenlide today for a free IT Operations assessment
🌐 Website: www.siwenlide.com
💬 WeChat Official Account: search “Siwenlide” or “Yuxinan”
📧 Contact us to learn more about the IT All-in-One package
