FIREWALL / INPUT CHAIN

Input chain.

The input chain matches traffic destined for the router itself — Winbox sessions, SSH connections, DNS lookups answered locally, and (most relevantly) probes from the public internet trying to find a way in.

The full script

Five rules. Order matters: each is checked in sequence and the first match wins, so the established/related rule short-circuits most legitimate traffic before any of the more expensive matchers run.

# default input-chain ruleset (RouterOS v6)
/ip firewall filter
add chain=input action=accept connection-state=established,related,untracked \
  comment="mtkf: accept established/related/untracked"
add chain=input action=drop connection-state=invalid \
  comment="mtkf: drop invalid"
add chain=input action=accept protocol=icmp limit=10,5:packet \
  comment="mtkf: rate-limited ICMP"
add chain=input action=accept dst-address=127.0.0.1 \
  comment="mtkf: accept loopback / CAPsMAN"
add chain=input action=drop in-interface-list=!LAN \
  comment="mtkf: drop everything not from LAN list"

# default input-chain ruleset (RouterOS v7)
/ip/firewall/filter
add chain=input action=accept connection-state=established,related,untracked \
  comment="mtkf: accept established/related/untracked"
add chain=input action=drop connection-state=invalid \
  comment="mtkf: drop invalid"
add chain=input action=accept protocol=icmp limit=10,5:packet \
  comment="mtkf: rate-limited ICMP"
add chain=input action=accept dst-address=127.0.0.1 \
  comment="mtkf: accept loopback / CAPsMAN"
add chain=input action=drop in-interface-list=!LAN \
  comment="mtkf: drop everything not from LAN list"

What each rule does

1. Accept established, related, untracked

Lets through return traffic for connections the router itself initiated (NTP, DNS lookups, package fetches, our own /tool fetch). untracked covers traffic that bypassed connection tracking via a raw rule — without this, you can lock yourself out the moment you add a raw bypass.

2. Drop invalid

Connection-state invalid is what RouterOS sets when a packet doesn't match any tracked connection and isn't a SYN-style new connection either — typically reflection-attack scraps and stale ACKs. Cheap to drop, no legitimate traffic uses this state.

3. Accept ICMP (rate-limited)

ICMP is genuinely useful — Path MTU Discovery, traceroute, ping for liveness checks. The limit=10,5:packet matcher caps acceptance at 10 packets per second with a burst of 5, which is generous for legitimate use and tight enough to make ICMP-based DoS unproductive.

4. Accept loopback / CAPsMAN

The router talks to itself (services binding to 127.0.0.1) and CAPsMAN talks to managed access points over an internal address. This rule is cheap and stops a chain of edge cases where management traffic silently drops.

5. Drop anything not from the LAN interface list

The catch-all. Anything that didn't match an earlier accept rule and didn't arrive on a member of the LAN interface list gets dropped. This is the rule that quietly rejects the constant background scanning you see on any IPv4 with a public address.

You need to populate the LAN interface list for this to work — without it, your local clients can't reach the router. Below is a typical small-router setup; adjust to your own interface names.

/interface list
add name=LAN comment="trusted interfaces"
add name=WAN comment="untrusted interfaces"
/interface list member
add list=LAN interface=bridge1
add list=WAN interface=ether1

/interface/list
add name=LAN comment="trusted interfaces"
add name=WAN comment="untrusted interfaces"
/interface/list/member
add list=LAN interface=bridge1
add list=WAN interface=ether1

When you'd want to disable this

• Running a public service from the router itself (a public DNS resolver, an OpenVPN listener with no separate firewall rule). Add a specific action=accept rule above the catch-all or add the WAN interface to a separate WAN-services list and make the catch-all match that list explicitly.
• Diagnosing a connectivity problem. Temporarily disable rule 5 with /ip firewall filter set [find comment~"^mtkf: drop everything"] disabled=yes to confirm the firewall is the problem; re-enable as soon as you've isolated it.

References

• MikroTik default factory firewall (RouterOS 7) — /system default-configuration print
• RFC 4890 — IPv6 ICMP filtering (informs the rate limit choice)