MikroTik IP Firewall
Create and manage RouterOS filter and NAT rules from the MikroTik monitor
Create and manage RouterOS filter and NAT rules from the MikroTik monitor
On this page
The IP Firewall panel has Filter Rules and NAT Rules tabs. It reads and changes the selected router’s live /ip/firewall/filter and /ip/firewall/nat configuration.
See MikroTik Device Management for access, API, audit, and NOC requirements.
Firewall changes apply immediately and the page has no rollback, safe-mode session, rule reordering, or automatic management-access protection. Check rule order and keep an alternate route to the router.
Filter rules
The table shows order number, chain, action, protocol, source, destination, destination port, comment, and enabled/disabled control.
Add a filter rule
- Open Device Management → IP Firewall → Filter Rules.
- Click Add Rule.
- Set the fields, then click Add Filter Rule.
- Approve the confirmation prompt.
| Field | Allowed by the page |
|---|---|
| Chain | forward, input, or output in the selector. Required; maximum 32 characters at the server. |
| Action | accept, drop, reject, log, passthrough, jump, or return. Required. |
| Protocol | Optional text, maximum 16 characters. |
| Src Address, Dst Address | Optional text, each maximum 64 characters. |
| Dst Port | Optional text, maximum 32 characters. |
| Comment | Optional text, maximum 128 characters. |
Blank optional match fields are not sent and therefore behave according to RouterOS defaults. The form does not expose source port, in/out interface, connection state, address list, ICMP options, jump target, logging prefix, or rule placement.
The page validates lengths and the action list, but does not parse address, protocol, or port syntax. RouterOS decides whether a combination is valid.
Enable, disable, or remove a filter rule
Click Disable or Enable in the row to change its RouterOS disabled state. This toggle has no confirmation prompt and is available to a permitted NOC user.
On a non-NOC management page, use the trash icon and approve the traffic-impact warning to permanently remove the rule. NOC users have no filter-rule delete route.
The page does not expose editing or reordering. Disable a rule for a reversible test; use RouterOS for field changes or ordering.
NAT rules
The table shows chain, action, protocol, destination address/port, translated address/port, comment, and removal control. The create form also accepts a source address, although that value is not displayed in this table after creation.
Add a NAT rule
- Select NAT Rules and click Add NAT Rule.
- Set the fields below.
- Click Add NAT Rule and approve the confirmation.
| Field | Allowed by the page |
|---|---|
| Chain | Required: srcnat or dstnat. |
| Action | Required: masquerade, dst-nat, src-nat, redirect, netmap, accept, or drop. |
| Protocol | Optional text, maximum 16 characters. |
| Src Address, Dst Address | Optional text, each maximum 64 characters. |
| Dst Port | Optional text, maximum 32 characters. |
| To Addresses | Optional text, maximum 64 characters. |
| To Ports | Optional text, maximum 32 characters. |
| Comment | Optional text, maximum 128 characters. |
RouterOS performs the final compatibility checks between chain, action, protocol, ports, and translation targets.
Remove a NAT rule
On a non-NOC management page, click the trash icon and approve the traffic-impact warning. The page does not offer NAT enable/disable, editing, or reordering. NOC users can create NAT rules but cannot remove them from the NOC route set.
Troubleshooting and safe recovery
- Before adding
droporreject, identify the management traffic and rule order that keep the router reachable. - If a destination port rule is rejected, verify that its protocol and action support that field.
- If a new rule has no effect, inspect its position and counters in RouterOS; this page does not show counters or move rules.
- If the wrong filter rule was added, disable it first when possible. If the wrong NAT rule was added, a Group Admin must review and remove it because the page has no NAT toggle.
- If a permitted NOC user receives a failure after clicking a trash icon, the missing NOC delete route is the cause; creation and filter toggling remain available.