Firewall

Overview

The Firewall page is read-only, and it is built to be read. The top half is a packet-flow diagram: ingress, the input chain, the router itself, the output chain, and egress along the top, with the forward chain looping underneath. Hovering or focusing a chain node pops up the rules attached to it, colour-coded by action. The bottom half is the full Firewall rules table, in priority order, refreshed every three seconds.

Use it to answer “why is this traffic being dropped” without opening Winbox. Editing rules is not available from this page.

The page is not on the router tab bar. Reach it at /router/<router-id>/firewall in the panel.

Before you start

The session must hold valid credentials for this router.
Rules are listed in RouterOS order, which is the order they are evaluated in.

Steps

Open the firewall page for the router.
Hover or tab to the Input, Forward or Output node in the diagram to see the rules on that chain and their count.
Narrow the table with the Chain dropdown, offering All chains, input, forward or output.
Read the Bytes and Packets columns to see which rules are actually matching traffic.

Reference

Rules table

Column	What it shows
Chain	input, forward or output.
Action	accept, drop, reject, log and so on, colour-coded.
Proto	Protocol, or “any”.
Source	Source address and port, or “any”.
Destination	Destination address and port, or “any”.
In	Input interface, or empty when the rule does not set one.
Out	Output interface, or empty when the rule does not set one.
Bytes	Bytes matched by the rule.
Packets	Packets matched by the rule.
Comment	The rule’s comment, or empty when it has none.
Status	enabled or disabled, plus a log badge where logging is on.

Troubleshooting

“No firewall rules configured”. The router has no filter rules, or none in the chain you filtered to.

“Failed to load firewall rules.” The router did not answer. The page keeps retrying every three seconds.

“Missing router credentials for this session.” Reconnect to the router from the Routers list.