RouterOS firewall

The firewall is four rule tables (filter, NAT, mangle, raw) evaluated at fixed points of the packet path. Rules in a chain run top to bottom and the first matching terminal action wins, so order is the configuration. IPv4 lives under /ip/firewall, IPv6 under /ipv6/firewall; they are separate tables with separate address lists.

Know where each table acts

Path of a routed packet: raw prerouting, connection tracking, mangle prerouting, dstnat, routing decision, mangle forward, filter forward, mangle postrouting, srcnat, queues. A packet for the router itself goes to mangle input and filter input instead of forward; a packet from the router goes through raw/mangle/filter output. Consequences: