Introduction: Why SMBs Need Professional Firewall Configuration Even More
As digital transformation accelerates, cybersecurity is no longer a topic reserved for large enterprises. SMBs face increasingly complex cyber threats as well—ransomware, DDoS attacks, and data breaches keep emerging. Yet many SMBs, constrained by limited budgets, often overlook professional firewall configuration and run on default rules alone, which is tantamount to swimming naked in the vast ocean of the internet.
MikroTik RouterOS, a highly cost-effective routing operating system, has become an ideal choice for SMB cybersecurity thanks to its powerful firewall functions and flexible rule engine. Taking a hands-on perspective, this article systematically explains in-depth configuration of the MikroTik RouterOS firewall to help network administrators build an unbreakable enterprise-grade line of defense.
1. A Complete Breakdown of the MikroTik Firewall Architecture
The MikroTik RouterOS firewall is built on the Linux kernel’s Netfilter framework, but its design is more structured and easier to use. Understanding its architecture is the prerequisite for configuring it well.
1.1 The Three Processing Chains
The core concept of the MikroTik firewall is the chain. As packets pass through the router, they are processed by different chains:
- Input chain: handles packets destined for the router itself. All traffic that attempts to access the router’s management interface, SSH, API, and other services passes through this chain.
- Output chain: handles packets sent from the router itself. Connections the router initiates on its own (such as DNS queries and NTP synchronization) pass through this chain.
- Forward chain: handles forwarded packets traversing the router. This is the most critical chain in an enterprise network—all communication between the internal network and the external network passes through it.
1.2 Connection State Mechanism
The MikroTik firewall supports a complete connection tracking mechanism, which is the foundation of stateful inspection:
- new: the first packet of a new connection
- established: subsequent packets of an established connection
- related: packets related to an existing connection (such as FTP data connections or ICMP error messages)
- invalid: packets that cannot be identified or that belong to no known connection
Understanding connection states is crucial for writing efficient and secure firewall rules. A common security mistake is to focus only on port filtering while neglecting state inspection, allowing attackers to bypass rules with forged packets.
2. Basic Security Configuration: Building the First Line of Defense
2.1 Default Deny Policy
The first principle of security is “default deny”—everything is prohibited unless explicitly allowed. In MikroTik, we achieve this by adding a drop-all rule at the end of each chain:
/ip firewall filter add chain=input action=drop comment="Drop all input" add chain=forward action=drop comment="Drop all forward"
Important: before adding a default deny rule, be sure to allow the necessary services first, otherwise you will lock yourself out of the router!
2.2 Protecting the Router Itself (Input Chain)
The router is the heart of the network, and protecting it is the top priority. The following is a recommended Input chain configuration:
/ip firewall filter # Allow established and related connections add chain=input action=accept connection-state=established,related comment="Accept established,related" # Drop invalid connections add chain=input action=drop connection-state=invalid comment="Drop invalid" # Allow ICMP (rate limited) add chain=input action=accept protocol=icmp limit=5,10:packet comment="Accept ICMP with rate limit" # Allow only the internal network to access router management services add chain=input action=accept src-address=192.168.0.0/16 protocol=tcp dst-port=22,80,443,8291 comment="Accept management from LAN" # Allow DNS requests from the internal network add chain=input action=accept src-address=192.168.0.0/16 protocol=udp dst-port=53 comment="Accept DNS from LAN" # Default deny add chain=input action=drop comment="Drop all other input"
This configuration ensures that only management requests from the internal network are accepted and that the management interface cannot be reached directly from outside. Port 8291 is Winbox’s default port; if you use a different management tool, adjust accordingly.
2.3 Internal Forwarding Security (Forward Chain)
The Forward chain governs all communication between the internal and external networks. Configuring it correctly not only defends against external attacks but also prevents lateral spread after an internal host is compromised:
/ip firewall filter # Allow established and related connections add chain=forward action=accept connection-state=established,related comment="Accept established,related" # Drop invalid connections add chain=forward action=drop connection-state=invalid comment="Drop invalid" # Allow outbound traffic from the internal network add chain=forward action=accept in-interface=bridge-lan out-interface=pppoe-wan comment="Accept LAN to WAN" # Allow return traffic for DNAT (port forwarding) add chain=forward action=accept connection-nat-state=dstnat comment="Accept DNAT" # Default deny add chain=forward action=drop comment="Drop all other forward"
3. Advanced Security Policies: Building Enterprise-Grade Protection
3.1 Dynamic Address List Management
The address list feature is a highlight of the MikroTik firewall, enabling dynamic whitelist and blacklist management. Combined with scheduled scripts, it can automate threat intelligence updates:
/ip firewall address-list add address=10.0.0.0/8 list=BOGON comment="RFC1918" add address=172.16.0.0/12 list=BOGON comment="RFC1918" add address=192.168.0.0/16 list=BOGON comment="RFC1918" add address=0.0.0.0/8 list=BOGON comment="Invalid" /ip firewall filter add chain=forward action=drop src-address-list=BOGON in-interface=pppoe-wan comment="Drop bogon from WAN" add chain=forward action=drop dst-address-list=BOGON out-interface=pppoe-wan comment="Drop bogon to WAN"
This configuration blocks forged source address attacks (IP spoofing) from the external network, a technique that underlies many DDoS attacks.
3.2 Port Scan Defense
Before launching an attack, attackers usually perform port scans to probe which ports and services a target has open. MikroTik can detect scanning behavior and automatically block the source address:
/ip firewall filter # Detect and log port scans add chain=input action=add-src-to-address-list psd=21,3s,3,1 address-list=port-scanners address-list-timeout=2w comment="Detect port scanners" # Block identified scanners add chain=input action=drop src-address-list=port-scanners comment="Drop port scanners"
PSD (Port Scan Detection) parameters explained: 21 = weight threshold, 3s = delay threshold, 3 = number of low-weight ports, 1 = number of high-weight ports. When a source initiates connections to multiple ports within a short period, it is judged to be scanning and automatically added to the blacklist for 2 weeks.
3.3 SYN Flood Defense
A SYN flood is one of the most common forms of DDoS attack. Attackers send a large number of SYN packets without completing the three-way handshake, exhausting the server’s connection resources:
/ip firewall filter # Limit the rate of new SYN connections add chain=forward action=accept tcp-flags=syn connection-state=new limit=50,10:packet comment="Limit new TCP connections" # Drop SYN packets above the rate limit add chain=forward action=drop tcp-flags=syn connection-state=new comment="Drop excess SYN"
3.4 Layer 7 Protocol Filtering
MikroTik supports Layer 7 protocol matching, which can filter traffic based on application-layer characteristics. In an enterprise environment this is very practical for controlling non-work-related applications:
/ip firewall layer7-protocol add name=facebook regexp="^.+(facebook.com).*\$" add name=youtube regexp="^.+(youtube.com).*\$" /ip firewall filter add chain=forward action=drop layer7-protocol=facebook comment="Block Facebook" add chain=forward action=drop layer7-protocol=youtube comment="Block YouTube"
Note: Layer 7 filtering places a heavy CPU load on the router. Use it with caution in high-traffic networks, or enable it only for specific subnets.
IV. Security Practices for NAT and Port Forwarding
4.1 Secure Port Forwarding Configuration
Port forwarding (DNAT) is one of the most frequently used features in small and medium-sized businesses, mapping external access to internal servers. Yet improper port forwarding configurations are often the root cause of security vulnerabilities:
/ip firewall nat # Secure port forwarding example: allow access only from specific source IPs add chain=dstnat action=dst-nat to-addresses=192.168.1.100 to-ports=443 \ protocol=tcp dst-port=443 src-address-list=trusted-ips comment="Secure DNAT for web server"
Key security points:
- Never expose management ports such as RDP (3389) or SSH (22) directly to the public internet
- Map non-standard external ports to standard internal ports
- Use src-address-list to restrict the source of access
- Add a detailed comment to every DNAT rule explaining its purpose
4.2 NAT Loopback (Hairpin NAT)
When internal users need to reach internal services through the public IP, Hairpin NAT must be configured:
/ip firewall nat add chain=srcnat action=masquerade src-address=192.168.1.0/24 \ dst-address=192.168.1.100 out-interface=bridge-lan comment="Hairpin NAT"
A missing Hairpin NAT configuration is one of the most common problems in SMB networks, leaving internal users unable to reach their own services by domain name or public IP.
V. Logging and Monitoring: The Cornerstone of Security Operations
5.1 Firewall Logging Configuration
A firewall configuration without logs is incomplete. Proper logging not only helps with troubleshooting, but is also the key evidence for tracing security incidents:
/ip firewall filter # Log rejected connections add chain=input action=log log-prefix="INPUT-DROP" action=drop comment="Log dropped input" add chain=forward action=log log-prefix="FORWARD-DROP" action=drop comment="Log dropped forward" # Log suspicious activity add chain=input action=log log-prefix="PORT-SCAN" src-address-list=port-scanners comment="Log port scan activity"
5.2 Remote Logging Server
Sending logs to a remote server is a best practice, because an attacker who gains access to the router will usually clear the local logs:
/system logging action add name=remote target=remote remote=192.168.1.200 remote-port=514 /system logging add action=remote topics=firewall add action=remote topics=system,error add action=remote topics=system,warning
5.3 Traffic Monitoring and Alerts
With MikroTik’s Traffic Flow feature, traffic statistics can be sent to an analysis system for anomaly detection:
/ip traffic-flow set enabled=yes cache-entries=4k set active-flow-timeout=30m inactive-flow-timeout=15s /ip traffic-flow ipfix set src-address=0.0.0.0 dst-address=192.168.1.200 dst-port=2055
VI. Automated Operations: Letting Your Security Policies Evolve on Their Own
6.1 Automatically Blocking Brute-Force Attacks
SSH brute force is one of the most common attacks against routers. The following configuration automatically detects and blocks brute-force attempts:
/ip firewall filter # Stage 2: record failed attempts add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ src-address-list=ssh-stage1 address-list=ssh-stage2 address-list-timeout=30s \ connection-state=new comment="SSH brute force stage 2" add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ src-address-list=ssh-stage2 address-list=ssh-blacklist address-list-timeout=7d \ connection-state=new comment="SSH brute force blacklist" # Stage 1 logging add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ address-list=ssh-stage1 address-list-timeout=30s connection-state=new \ comment="SSH brute force stage 1" # Block the blacklist add chain=input action=drop src-address-list=ssh-blacklist comment="Drop SSH brute forcers"
This three-stage detection mechanism works as follows: the first SSH connection attempt adds the source to the stage1 list (30-second timeout); a second attempt within 30 seconds moves it to stage2; any further attempt adds it to the blacklist for 7 days. Legitimate users who occasionally mistype a password will not be blocked by mistake, while the high-speed attempts of brute-force tools are blocked immediately.
6.2 Scheduled Security Scripts
Together with the Scheduler feature, periodic security checks and policy updates can be automated:
/system scheduler
add name=daily-security-check interval=24h on-event="/system script run security-check" \
start-time=03:00:00
/system script
add name=security-check source={
:log info "Running daily security check..."
/ip firewall address-list remove [find list=port-scanners timeout-active=no]
:log info "Cleaned expired address list entries"
}
VII. Siwenlide: Your All-Around IT Operations Partner
For small and medium-sized businesses, the complexity of network security often exceeds what an in-house IT team can handle. Hiring a dedicated network security engineer is costly, while neglecting security costs far more. The “IT All-in-One” three-in-one managed operations package from Siwenlide (Beijing Siwen Lide Technology & Trade Co., Ltd.) was created precisely to resolve this dilemma.
Our services cover three core areas:
- Internet Access: stable, reliable enterprise-grade network connectivity that keeps your business running without interruption. From bandwidth planning to link redundancy, and from in-depth configuration of MikroTik to Huawei devices, we bring extensive hands-on experience.
- Free Network Equipment: sign up and receive professional-grade network equipment at no extra cost, with no large one-time hardware purchase. The equipment covers a full set of network infrastructure, including routers, switches, and firewalls.
- Uninterrupted Operations: 7×24 monitoring and response, with a professional team on standby. The firewall rule configuration, security policy optimization, and vulnerability patching described above can all be left to us.
As this article shows, a well-built firewall configuration involves coordination across multiple layers — from a basic default-deny policy to advanced automated defense mechanisms. Siwenlide’s operations team not only masters these technologies; more importantly, we tailor the most suitable security strategy to your actual business needs, giving your network security both depth and warmth.
Network security is not a one-time purchase but an ongoing game of attack and defense. Choose Siwenlide and let a professional team safeguard your digital transformation. To learn more, visit www.siwenlide.com or call us for a consultation.
