Getting Started: MikroTik Firewall

This video is aimed at giving you a general overview of how the MikroTik firewall works, what connection tracking is, how implement filter rules as well as mangle and fasttrack connections. Many of the topics are shown in real-time using an EVE-NG lab to show what the impact is on the network when creating firewall rules. Always treat firewall rules with caution and make sure that you do not accidentally configure a rule that will lock you out of your equipment.

EVE-NG Setup:

Timestamps:

00:00 - Introduction
00:48 - Logging onto Winbox and Accessing the Firewall
01:40 - Connection Tracking overview
05:22 - Firewall Filter Rules
06:36 - Firewall Chains Explained
09:41 - Configuring an Input Chain rule
14:56 - Configuring an Output Chain rule
16:00 - Configuring a Forward Chain rule
17:30 - Explanation of Firewall allowing all traffic
19:33 - Mangle Rules brief overview
22:00 - FastTrack brief overview
24:48 - Firewall Connection States
27:05 - Inverse firewall rule

Credits:

Intro Music: Ringtail - Waking Up

Song: Max Brhon - Illusion [NCS Release]
Music provided by NoCopyrightSounds

Song: Max Brhon - The Future [NCS Release]
Music provided by NoCopyrightSounds

Song: Max Brhon - Cyberpunk [NCS Release]
Music provided by NoCopyrightSounds

Song: Max Brhon - Humanity [NCS Release]
Music provided by NoCopyrightSounds

Thumbnail: Created on Canva

Let's connect on Social Media!

Thanks again for watching

[BostjanCadej]

I watched the video. I didn't learn anthing new, but still would like to thank you for work you are doing and giving us tutorials. Keep up the great work. And great video by the way!

[mmrk_]

Man i learn so much from your videos. Thanks for taking the time to upload these.

[jakirbasha]

Started watching your MTCNA Playlist.

You videos are very helpful. i already do have experience with mikrotik and still have learnt a lot from your videos.

gonna checkout all of your videos. Keep making them.

[uknowimmad]

You are a great teacher...love the way you explained

[blindside]

This is truly a fantastic video! Great work. The mikrotik firewall is really what sold me and got me interested in networking.

[samiam]

Used them a long time and very secure for years.

[giahoang]

Thank you! Please make more videos about Mikrotik 😀

[joellemorris]

Thanks for making this video. I could not understand it all... But as I need to research for upgrading my office small network, I would like to know how you would compare a Mikrotik router firewall with Fortigate 40E for example. For kind of uses would you recommend each of those firewalls?

[bergertshitenge]

Hi, I would like you soon to be able to use a loop for your videos so that we can see clearly in any case! thank you

[djvanvuuren]

Hi Mr, Please assist.. Apparently I have double NAT on my main router and clients router, How do I get rid of double NAT. I know I have to Masquerade, but is there a way to NOT Masquerade and bypass it to have a Open Firewall for VOiP to Register easier

[seychellesaccount]

what is the emulatopr u using here in your video? for virtual routers?

[DCikac]

Hi m8, your videos helped me a ton, even if I'm not new to mikrotik, and I wanted to ask you, do you maybe have a how to configure 2 gateways on the same interface. Long story short i have 2 public ip ranges that are on different sub nets and they are both on cisco port 2, and that's connected to mikrotik wan port who is in bridge mode. So i managed to get the route list to get the info of the second IP range and added it as second default ip with a different routing mark, but then I'm not sure should I use route rules, or firewall mangle or something third, I even got bridge-local to say it works for the new ip adress, but my FW rules don't get any packages when I try to go from a different ip ( inernet ) than my local. sry if I only confused you but the main idea is to have 2 public ip ranges that work on the same local network for web service hosting purpose, and my initial pack of static public ip.s were not enough.

[geoffvandermerwe]

Yo, dude! Did you perhaps make an advanced mangle rule video as mentioned in this one ? Would like to know a bit more about mangle. Thank you

[nikolashuminosky]

Hi Berg,

still we are waiting for you new video as your mentioned on this vide 21:23. Please we are so exciting

[Litdex]

I my opinion first should go data flow diagram and only then firewall explanation. It is hard to get truly understanding of how exactly rules works without it. But keep doing, anyway it is a great content! And You really should mention how useful too use "Save mode" button when You management firewall rules. Just to not get a silly ;)

[forex-chart-analysis-daily]

if packet come in the router lan what will rule aply input ? if packet come in router cloudside what will rule output

[jacobjasser]

Hi The Network Berg! Really appreciate your video. Is forward chain primarily used for if you have a server behind your router?

I know you mentioned its for forwarding packets between the router, but is this forwarding also for traffic internally? E.g. from PC1 to PC2 on the same router/bridge

[oschpelemuggn]

Great video, thank you very much. Getting started with firewall rules is hard when you dont have a good teacher. 😎

I've a question about the blocked pings. In the first case we got a timeout, in the other a net unreachable. Why the difference?

Then I've a remark: On my device even in fullscreen mode the text remains unreadable. If you'd reduce your screen resolution while recording the content would be better accessible on smartphones etc.

[sergeybiriukov]

how to create a group of ip addresses without dhcp ?

[mehdimj_ir]

So, That is very ugly "IN" :))