# Firewall

> A packet-flow diagram of the input, forward and output chains, plus the full filter rule table.

Source: https://joinnasnet.com/en/guides/nasnet-panel/lan/firewall/
Last updated: 2026-08-14

---

## Overview

The **Firewall** page is read-only, and it is built to be read. The top half is
a packet-flow diagram: ingress, the input chain, the router itself, the output
chain, and egress along the top, with the forward chain looping underneath.
Hovering or focusing a chain node pops up the rules attached to it, colour-coded
by action. The bottom half is the full **Firewall rules** table, in priority
order, refreshed every three seconds.

Use it to answer "why is this traffic being dropped" without opening Winbox.
Editing rules is not available from this page.

The page is not on the router tab bar. Reach it at
`/router/<router-id>/firewall` in the panel.

## Before you start

- The session must hold valid credentials for this router.
- Rules are listed in RouterOS order, which is the order they are evaluated in.

## Steps

1. Open the firewall page for the router.
2. Hover or tab to the **Input**, **Forward** or **Output** node in the diagram
   to see the rules on that chain and their count.
3. Narrow the table with the **Chain** dropdown, offering **All chains**, **input**,
   **forward** or **output**.
4. Read the **Bytes** and **Packets** columns to see which rules are actually
   matching traffic.

## Reference

### Rules table

| Column | What it shows |
| ------ | ------------- |
| Chain | input, forward or output. |
| Action | accept, drop, reject, log and so on, colour-coded. |
| Proto | Protocol, or "any". |
| Source | Source address and port, or "any". |
| Destination | Destination address and port, or "any". |
| In | Input interface, or empty when the rule does not set one. |
| Out | Output interface, or empty when the rule does not set one. |
| Bytes | Bytes matched by the rule. |
| Packets | Packets matched by the rule. |
| Comment | The rule's comment, or empty when it has none. |
| Status | **enabled** or **disabled**, plus a **log** badge where logging is on. |

## Troubleshooting

**"No firewall rules configured".** The router has no filter rules, or none in
the chain you filtered to.

**"Failed to load firewall rules."** The router did not answer. The page keeps
retrying every three seconds.

**"Missing router credentials for this session."** Reconnect to the router from
the Routers list.

## Related

- [LAN](/en/guides/nasnet-panel/lan/)
- [DNS](/en/guides/nasnet-panel/lan/dns/)
- [Logs](/en/guides/nasnet-panel/logs/)