Protect a MikroTik router with a firewall
Add firewall rules in the right order to protect a router from the internet, then publish a web server inside the network with a port forward.
Part of the path MikroTik routing (step 3 of 4), next: Troubleshoot: the whole office is offline
What you will do
10 tasks1.Look at what is there
This router already shares its internet connection with the office network, but it has no firewall rules at all, so anyone on the internet can try to reach it.
2.Allow connections already agreed
Rules are read from the top, and the first one that matches wins.
3.Drop broken traffic
Packets that belong to no valid connection are either errors or attacks.
4.Close the door
Now drop everything else that reaches the router: an input rule with action drop and no other conditions.
5.Let the office network back in
Add an input rule that accepts traffic arriving on in-interface=bridge-lan, so the office can still manage the router.
6.Publish the web server
The office web server is at 192.168.88.10.
7.Protect the network behind the router
Traffic passing through the router uses the forward chain.
8.Allow the web traffic in
Port forwarding only changes the destination.
9.Block the rest from the internet
Finish the forward chain with a rule that drops everything else arriving from the internet: chain forward, action drop, in-interface=ether1.
10.Review the result
Show everything you configured as text with /ip firewall export, and read the rules top to bottom the way the router does.