Table of Contents

Introduction

Image Added

The firewall implements stateful (by utilizing connection tracking) and stateless packet filtering and thereby provides security functions that are used to manage data flow to, from, and through the router. Along with the Network Address Translation (NAT), it serves as a tool for preventing unauthorized access to directly attached networks and the router itself as well as a filter for outgoing traffic.

•  Insert basic image(diagram) about firewall 

Network firewalls keep outside threats away from sensitive data available inside the network. Whenever different networks are joined together, there is always a threat that someone from outside of your network will break into your LAN. Such break-ins may result in private data being stolen and distributed, valuable data being altered or destroyed, or entire hard drives being erased. Firewalls are used as a means of preventing or minimizing the security risks inherent in connecting to other networks. Properly A properly configured firewall plays a key role in efficient and secure network infrastructure deployment.

MikroTik RouterOS has a very powerful firewall implementation with features including:

...

• stateful packet inspectionLayer-7 protocol detection
• peer-to-peer protocols filtering
• traffic classification by:
  • source MAC address
  • IP addresses (network or list) and address types (broadcast, local, multicast, unicast)
  • port or port range
  • IP protocols
  • protocol options (ICMP type and code fields, TCP flags, IP options, and MSS)
  • interface the packet arrived from or left through
  • internal flow and connection marks
  • DSCP byte
  • packet content
  • rate at which packets arrive and sequence numbers
  • packet size
  • packet arrival time
  and

And much more!

How It works

The firewall operates by means of firewall rules. Each rule consists of two parts - the matcher which matches traffic flow against given conditions and the action which defines what to do with the matched packet.

RouterOS utilizes 4 5 sub-facilities of the firewall:

• Connection tracking
• Filters
• NAT
• Mangle
• RAW

Connection

...

Connection tracking allows the kernel to keep track of all logical network connections or sessions, and thereby relate all of the packets which may make up that connection. NAT relies on this information to translate all related packets in the same way. Because of connection tracking, you can use stateful firewall functionality even with stateless protocols such as UDP.

A list of tracked connections can be seen in /ip firewall connection for ipv4 and /ipv6 firewall connection for IPv6.

    [admin@MirkoTik] /ip firewall connection> print
    Flags: S - seen-reply, A - assured
    #    PR.. SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT
    0    udp  10.5.8.176:5678       255.255.255.255:5678              0s
    1    udp  10.5.101.3:646        224.0.0.2:646                     5s
    2    ospf 10.5.101.161          224.0.0.5                         9m58s
    3    udp  10.5.8.140:5678       255.255.255.255:5678              8s
    4 SA tcp  10.5.101.147:48984    10.5.101.1:8291       established 4m59s
  

...

states

To completely understand firewall rules, first, you have to understand various states which might apply to a particular network packet. There are five connection states in RouterOS:

• NEW - The NEW state tells us that the packet is the first packet that we see. This means that the first packet that the conntrack module sees, within a specific connection, will be matched. For example, if we see a SYN packet and it is the first packet in a connection that we see, it will match;
• ESTABLISHED - The ESTABLISHED state has seen traffic in both directions and will then continuously match those packets. ESTABLISHED connections are fairly easy to understand. The only requirement to get into an ESTABLISHED state is that one host sends a packet and that it, later on, gets a reply from the other host. The NEW state will upon receipt of the reply packet to or through the firewall change to the ESTABLISHED state;
• RELATED - A connection is considered RELATED when it is related to another already ESTABLISHED connection. For a connection to be considered as RELATED, we must first have a connection that is considered ESTABLISHED. The ESTABLISHED connection will then spawn a connection outside of the main connection. The newly spawned connection will then be considered RELATED, for example, a packet that begins the FTP data connection;
• INVALID - The INVALID state means that the packet can't be identified or that it does not have any state.  It is suggested to DROP everything in this state;
• UNTRACKED - A packet that was set to bypass connection tracking in the Firewall RAW table;

Configuration Example

Let's look at the basic firewall setup to protect the router. By default RouterOS firewall accepts everything, blocking is achieved by adding a filter rule to drop everything at the end of all rules. For our router we want to allow only ICMP, ssh, and Winbox and drop the rest:

/ip firewall filter
add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"
add chain=input connection-state=established,related,untracked action=accept comment="Allow Established/Related/Untracked connections"
add chain=input protocol=icmp action=accept comment="Allow ICMP"
add chain=input protocol=tcp ports=8291,22 action=accept comment="Allow Winbox and SSH"
add chain=input action=drop comment="Drop everything else"

RouterOS also allows filtering packets before connection tracking and selectively sends only specific traffic to connection tracking. This allows us to significantly reduce the load on the CPU and mitigate DOS/DDoS attacks. Configuration of such rules is done in the RAW filtering table.

Additional /ip firewall filter configuration examples are found under the Building Your First Firewall section.

Connection Tracking

Connection tracking allows the kernel to keep track of all logical network connections or sessions, and thereby relate all of the packets which may make up that connection. NAT relies on this information to translate all related packets in the same way. Because of connection tracking, you can use stateful firewall functionality even with stateless protocols such as UDP.

A list of tracked connections can be seen in the /ip firewall connection for ipv4 and /ipv6 firewall connection for IPv6.

[admin@MirkoTik] /ip firewall connection> print
Flags: S - seen

...

-reply, A - assured

...

# 

...

PR.. SRC-ADDRESS DST-ADDRESS TCP-STATE TIMEOUT
0 

...

udp 10.5.8.176:5678 255.255.255.255:5678 0s
1 udp 10.5.101.3:646 224.0.0.2:646 5s
2 ospf 10.5.101.161 224.0.0.5 9m58s
3 udp 10.5.8.140:5678 255.255.255.255:5678 8s
4 SA tcp 10.5.101.147:48984 10.5.101.1:8291 established 4m59s

[admin@MirkoTik] /ipv6 firewall connection> print
Flags: S - seen reply, A - assured
# PRO.. SRC-ADDRESS DST-ADDRESS TCP-STATE
0 udp fe80::d6ca:6dff:fe77:3698

...

 ff02::1

...

1

...

 udp

...

...

fe80::d6ca:6dff:fe98:7c28 

...

ff02::1

...

2 ospf 

...

fe80::d6ca:6dff:fe73:9822

...

 ff02::5

...

Based on connection table entries arrived packet can get assigned one of the connection states: new, invalid, established, related, or untracked.

There are two different methods when the packet is considered new. The first one is in the case of stateless connections (like UDP) when there is no connection entry in the connection table. The other one is in the case of a stateful protocol (TCP). In this case, a new packet that starts a new connection is always a TCP packet with an SYN flag.

If a packet is not new it can belong to either an established or related connection or not to belong to any connection making it invalid. Packet A packet with an established state, as most of you already guessed, belongs to an existing connection from the connection tracking table. A related state is very similar, except that the packet belongs to a connection which that is related to one of the existing connections, for example, ICMP error packets or FTP data connection packets.

Connection state notrack is a special case when RAW firewall rules are used to exclude connection from connection tracking.  This This one rule would make all forwarded traffic bypass the connection tracking engine speeding packet processing through the device.

...

Based on this information we can set a basic set of filter rules to speed up packet filtering and reduce the load on the CPU by accepting established/related packets, dropping invalid packets, and working on more detailed filtering only for new packets.

...

ip firewall filter

...

add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"

...

add chain=input connection-state=established,related,untracked action=accept comment="Allow Established/Related/Untracked connections

Filters

Firewall filters are used to allow or block specific packets forwarded to your local network, originated from your router or destined to the router.

There are two methods on how to set up filtering:

• allow specific traffic and drop everything else
• drop only malicious traffic, everything else is allowed.

Both methods have pros and cons, for example, from a security point of view first method is much more secure, but requires administrator input whenever traffic for new service needs to be accepted. This strategy provides good control over the traffic and reduces the possibility of a breach because of service misconfiguration.

On the other hand, when securing a customer network it would be an administrative nightmare to accept all possible services that users may use. Therefore careful planning of the firewall is essential in advanced setups.

Let's look at the basic firewall setup to protect the router. By default RouterOS firewall accepts everything, blocking is achieved by adding filter rule to drop everything at the end of all rules. For out router we want to allow only icmp, ssh and winbox and drop the rest:

/ip firewall filter
add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"
add chain=input connection-state=established,related,untracked action=accept comment="Allow Established/Related/Untracked connections"
add chain=input protocol=icmp action=accept comment="Allow ICMP"
add chain=input protocol=tcp ports=8291,22 action=accept comment="Allow Winbox and SSH" 
add chain=input action=drop comment="Drop everything else"

RouterOS also allows to filter packets before connection tracking and selectively send only specific traffic to connection tracking. This allows us to significantly reduce the load on CPU and mitigate DOS/DDoS attacks. Configuration of such rules is done in the RAW filtering table.

Network Address Translation (NAT)

Network Address Translation is an Internet standard that allows hosts on local area networks to use one set of IP addresses for internal communications and another set of IP addresses for external communications. A LAN that uses NAT is ascribed as a natted network. For NAT to function, there should be a NAT gateway in each natted network. The NAT gateway (NAT router) performs IP address rewriting on the way a packet travel from/to LAN.

Nat matches only the first packet of the connection, connection tracking remembers the action and performs on all other packets belonging to the same connection.

Types of NAT:

• source NAT or srcnat. This type of NAT is performed on packets that are originated from a natted network. A NAT router replaces the private source address of an IP packet with a new public IP address as it travels through the router. A reverse operation is applied to the reply packets travelling in the other direction.
• destination NAT or dstnat. This type of NAT is performed on packets that are destined for the natted network. It is most commonly used to make hosts on a private network to be accessible from the Internet. A NAT router performing dstnat replaces the destination IP address of an IP packet as it travels through the router towards a private network.

Source NAT

For example, basic rule to hide local networks behind one public IP:

/ip firewall nat add chain=srcnat action=src-nat to-address=1.1.1.1 out-interface=Public

As you can see from the example, we are using the srcnat chain because we want to manipulate the source information. By specifying out interface we ensure that the source will be modified only for those packets that leave a specific interface, in our case it is interface named "Public", and the last action is to src-nat - change source address of the packet to global address configured on "Public" interface.

Masquerade

/ip firewall nat add chain=srcnat action=masquerade out-interface=Public

NAT action masquerade is a unique subversion of srcnat. It was designed for specific use in situations when public IP can randomly change, for example, DHCP server change assigned IP or PPPoE tunnel after disconnect gets different IP, in short - when public IP is dynamic.

Every time when interface disconnects and/or its IP address changes, the router will clear all masqueraded connection tracking entries related to the interface, this way improving system recovery time after public IP change.

Unfortunately, this can lead to some issues with unstable links when the connection gets routed over different links after the primary link goes down. In such scenario following things can happen:

• on disconnect, all related connection tracking entries are purged;
• next packet from every purged (previously masqueraded) connection will come into firewall as new, and, if a primary interface is not back, packet will be routed out via alternative route (if you have any) thus creating new masqueraded connection;
• primary link comes back, routing is restored over the primary link, so packets that belong to existing connections are sent over primary interface without being masqueraded, that way leaking local IPs to a public network.

To work around this situation blackhole route can be created as alternative to route that might disappear on disconnect.

If srcnat is used instead of masquerade, connection tracking entries remain and connections can simply resume after link failure.

Hosts behind a NAT-enabled router do not have true end-to-end connectivity. Therefore some Internet protocols might not work in scenarios with NAT. Services that require the initiation of TCP connection from outside the private network or stateless protocols such as UDP, can be disrupted. Moreover, some protocols are inherently incompatible with NAT, a bold example is AH protocol from the IPsec suite.

To overcome these limitations RouterOS includes a number of so-called NAT helpers, that enable NAT traversal for various protocols.

Destination NAT

Lets see an opposite example where we want to change destination address or perform port mapping:

/ip firewall nat add chain=dstnatdst-port=1234action=dst-natprotocol=tcpto-address=192.168.88.2to-port=12340

What this rule does is, when an incoming connection requests TCP port 1234, it uses the dst-nat action and redirect it to local address 192.168.88.2 and the port 12340. In this example, we chose to specify ports to illustrate how traffic can be mapped from one port to another. If you do not specify a to-port parameter, then the destination port inside the packet is not changed.

Mangle

Mangle is a kind of 'marker' that marks packets for future processing with special marks. Many other facilities in RouterOS make use of these marks, e.g. queue trees, NAT, routing. They identify a packet based on its mark and process it accordingly. The mangle marks exist only within the router, they are not transmitted across the network.

Additionally, the mangle facility is used to modify some fields in the IP header, like TOS (DSCP) and TTL fields.

Change MSS

It is a known fact that VPN links have a smaller packet size due to encapsulation overhead. A large packet with MSS that exceeds the MSS of the VPN link should be fragmented prior to sending it via that kind of connection. However, if the packet has a Don't Fragment flag set, it cannot be fragmented and should be discarded. On links that have broken path MTU discovery (PMTUD) it may lead to a number of problems, including problems with FTP and HTTP data transfer and e-mail services.

In case of a link with broken PMTUD, a decrease of the MSS of the packets coming through the VPN link resolves the problem. The following example demonstrates how to decrease the MSS value via mangle:

/ip firewall mangle  add out-interface=pppoe-out protocol=tcp tcp-flags=syn action=change-mss new-mss=1300 chain=forward tcp-mss=1301-65535

Address List

Firewall address lists allow a user to create lists of IP addresses grouped together under a common name. Firewall filter, Mangle and NAT facilities can then use those address lists to match packets against them. The address list records can also be updated dynamically via the action=add-src-to-address-list or action=add-dst-to-address-list items found in NAT, Mangle, and Filter facilities.
Firewall rules with action add-src-to-address-list or add-dst-to-address-list works in passthrough mode, which means that the matched packets will be passed to the next firewall rules.

Basic example of dynamically created address-list:

...

FastTrack

IPv4 FastTrack handler is automatically used for marked connections. Use firewall action "fasttrack-connection" to mark connections for FastTrack. Currently, only TCP and UDP connections can be actually FastTracked (even though any connection can be marked for FastTrack). IPv4 FastTrack handler supports NAT (SNAT, DNAT, or both).

Note that not all packets in a connection can be FastTracked, so it is likely to see some packets going through a slow path even though the connection is marked for FastTrack. This is the reason why fasttrack-connection is usually followed by an identical "action=accept" rule. FastTrack packets bypass firewall, connection tracking, simple queues, queue tree with parent=global, IP accounting, IPSec, hotspot universal client, and VRF assignment, so it is up to the administrator to make sure FastTrack does not interfere with other configuration.

Requirements

IPv4 FastTrack is active if the following conditions are met:

• no mesh, metarouter interface configuration;
• sniffer, torch, or traffic generator is not running;
• /tool mac-scan is not actively used;
• /tool ip-scan is not actively used;
• FastPath and Route cache is enabled under IP/Settings

Example

For example, for SOHO routers with factory default configuration, you could FastTrack all LAN traffic with this one rule placed at the top of the Firewall Filter. The same configuration accept rule is required:

/ip firewall filter add chain=forward action=fasttrack-connection connection-state=established,related
/ip firewall filter add chain=forward action=accept connection-state=established,related

Services

This section lists protocols and ports used by various MikroTik RouterOS services. It helps you to determine why your MikroTik router listens to certain ports, and what you need to block/allow in case you want to prevent or grant access to certain services.

The default services are:

Properties

Note that it is not possible to add new services, only existing service modifications are allowed.

To restrict Winbox service access to the device only from the 192.168.88.0/24 subnet, we have to configure the following:

[admin@MikroTik] > ip service set [find name~"winbox"] address=192.168.88.0/24
[admin@MikroTik] > ip service print 
Flags: X - disabled, I - invalid 
# NAME PORT ADDRESS CERTIFICATE 
0 telnet 23
1 XI ftp 21
2 XI www 80
3 ssh 22
4 XI www-ssl 443 none 
5 XI api 8728
6 winbox 8291 192.168.88.0/24 
7 XI api-ssl 8729 none

Address List

Firewall address lists allow a user to create lists of IP addresses grouped together under a common name. Firewall filter, Mangle, and NAT facilities can then use those address lists to match packets against them. The address list records can also be updated dynamically via the action=add-src-to-address-list or action=add-dst-to-address-list items found in NAT, Mangle, and Filter facilities.
Firewall rules with action add-src-to-address-list or add-dst-to-address-list work in passthrough mode, which means that the matched packets will be passed to the next firewall rules. A basic example of a dynamically created address-list:

[admin@MirkoTik] > ip firewall address-list add address=www.mikrotik.com list=MikroTik
[admin@MirkoTik] > ip firewall address-list print
Flags: X - disabled, D - dynamic
# LIST ADDRESS CREATION-TIME TIMEOUT
0 MikroTik www.mikrotik.com oct/09/2019 14:53:14
1 D ;;; www.mikrotik.com
MikroTik 159.148.147.196 oct/09/2019 14:53:14

Layer7-protocol

Layer7-protocol is a method of searching for patterns in ICMP/TCP/UDP streams. It collects the first 10 packets of a connection or the first 2KB of a connection and searches for the pattern in the collected data. If the pattern is not found in the collected data, the matcher stops inspecting further. Allocated memory is freed and the protocol is considered unknown. You should take into account that a lot of connections will significantly increase memory and CPU usage. To avoid this, add regular firewall matches to reduce the amount of data passed to layer-7 filters repeatedly.

An additional requirement is that the layer7 matcher must see both directions of traffic (incoming and outgoing). To satisfy this requirement l7 rules should be set in the forward chain. If a rule is set in the input/prerouting chain then the same rule must be also set in the output/postrouting chain, otherwise, the collected data may not be complete resulting in an incorrectly matched pattern.

In this example, we will use a pattern to match RDP packets.

/ip firewall layer7-protocol add name=rdp regexp="rdpdr.*cliprdr.*rdpsnd"