MTCNA
MikroTik Certified Network
Associate
Module 6
Firewall
Instructor: Sharif
Contents
Firewall principles
• Connection tracking and states
• Structure, chains and actions
Firewall Filter in action
• Filter actions
• Protecting your router (input)
• Protection your customers (forward)
Basic Address-List
Source NAT
• Masquerade and src-nat action
Destination NAT
• dst-nat and redirect actions
FastTrack 3
Instructor: Sharif
Network Devices
Most common devices used in a computer network
Networking Device Internetworking Device
Used in LAN Used in WAN
Servers, PC, Printers , switches, Firewall, Router, Load Balancer,
wireless router, wireless access point, Multilayer Switch
VoIP phones and …
4
Instructor: Sharif
Firewall Principles
5
Instructor: Sharif
Firewall Principles
6
Instructor: Sharif
Firewall
Firewalls filter traffic that is undesirable and allow authorized traffic
into and across your networks.
7
Instructor: Sharif
Best Firewalls for Security
8
Instructor: Sharif
Connection States
Every packet is part of a connection, whether that connection has only
a few packets or millions.
All connections exist in one of four possible states:
1. New
2. Established
3. Related
4. Invalid
9
Instructor: Sharif
Connection State
10
Instructor: Sharif
Firewall Components
The RouterOS firewall uses three components to police traffic:
• Chains
• Rules
• Actions
11
Instructor: Sharif
Firewall Chains
Firewall Chains
Three chains exist by default and cannot be removed:
• Input
• Forward
• Output
13
Instructor: Sharif
Firewall Chains
You can also create your own chains for more
advanced firewalling and traffic monitoring.
Each chain is a group of rules that processes a
certain kind of traffic.
Custom chains are easily created to serve more
specialized firewall needs.
14
Instructor: Sharif
Input Chain
The input chain processes packets inbound to the router itself.
An example of input traffic would be an administrator pinging a
router’s interface.
Another example would be a Winbox session to a router.
15
Instructor: Sharif
Output Chain
The Output chain processes traffic sent from the router.
An example of traffic that matches the Output chain is a ping sent directly
from the router’s console.
An OSPF hello packet sent to another router or a Syslog message would also
match the Output chain because it was sent from the router.
16
Instructor: Sharif
Forward Chain
The Forward chain processes packets being forwarded through a router.
This is routed traffic that the device is handing off from one network to
another.
While the router is handling this traffic it isn’t destined specifically for the
router itself, which means the input chain does not apply.
17
Instructor: Sharif
Firewall Chains
18
Instructor: Sharif
Packet Flow
19
Instructor: Sharif
Connection Tracking
Packets in a connection that match a firewall rule allowing traffic will
be permitted.
Packets that aren’t part of an active connection but have spoofed
sequence numbers are dropped or rejected.
This connection tracking capability is critical to robust firewalling and
device security.
Tracking connections also gives us the ability to filter and analyse
traffic depending on its connection state.
20
Instructor: Sharif
Connection Tracking
21
Instructor: Sharif
Chain (Input)
Scenario Structure
Protecting your router (input)
Rules in Firewall
Block winbox with drop action
Add src to address list Ether2: [Link]
Block ICMP with drop & reject action
Block FTP, Telnet SHH & Webfig
Allow just one IP to access router
Allow a specific range of IP to access router
Module-6 Lab#1
Allow one specific MAC to access router
Allow specific users to access router in specific
time with Accept and drop action
[Link] [Link] [Link]
22
Instructor: Sharif
Chain (Forward)
Scenario Structure
Protection your customers (forward)
Rules in Firewall
Drop invalid connection from outside and inside
Block one user to access Internet by MAC or IP Ether2: [Link]
Allow specific users to access Internet
Block one specific site for users
Block multiple sites for users
Block All Site expect one specific site
Module-6 Lab#2
Add dst to address list
Add src to address list
Black Facebook for users
[Link] [Link] [Link]
23
Instructor: Sharif
Custom Chain
Custom chains are easily created to
serve more specialized firewall needs.
24
Instructor: Sharif
Firewall Rules
Each rule entry in the firewall tells RouterOS what to do with matching
packets. These rules are applied to chains and contain the criteria for
matching packets. If a packet matches the criteria in a rule then the rule’s
action is applied.
25
Instructor: Sharif
Firewall Rules
RouterOS allows for very flexible rules driven by many available
criteria.
The following are selections of typical criteria used for rules:
• Protocol • Destination Port • TCP Flags
• Source Address
• Interface In • Connection State
• Destination Address
• Interface Out • NAT State
• Source Port
• ICMP Options
26
Instructor: Sharif
Rule Evaluation
Firewall rules are evaluated in a top-down fashion.
This means the firewall evaluates packets against rules starting at the top of
a chain and moves down until a rule is matched or there are no
more rules.
If no rule matches traffic in the chain then the traffic is automatically
allowed.
27
Instructor: Sharif
Firewall Actions
Firewall Actions
Firewall actions determine what the router actually does with packets
that match a firewall rule.
29
Instructor: Sharif
Firewall Actions
Action Description
Accept The accept action allows a packet through the firewall.
Add to src address list add an IP address to an address list. (Passthrough)
Add to dst address list add an IP address to an address list. (Passthrough)
Drop The drop action forces the router to stop processing a packet.
Fast Track Connection The FastTrack firewall action is special, and using it can have a tangible
impact on your routers.
Jump The jump action takes a packet being evaluated and moves it over to a
different chain.
30
Instructor: Sharif
Firewall Actions
Action Description
Log The log action adds source and destination information for matching packets to
the router’s log.
Passthrough The passthrough action adds byte and packet counts to the rule’s statistics then
allows the traffic to continue being processed.
Tarpit The tarpit action keeps TCP connections open and deliberately slows responses
to traffic sources that match a firewall rule.
Reject The reject action forces the router to discard matching packets but doesn’t do it
silently like the drop action does.
Return The return action sends traffic back to the chain that it was originally jumped from.
31
Instructor: Sharif
Firewall Actions (Jump)
32
Instructor: Sharif
NAT
NAT
NAT is short for Network Address Translation.
It is a service that allows multiple devices in a private network to share a
single public IP address when accessing the internet or other networks.
NAT helps to save IP addresses, improve security and simplify network
management.
34
Instructor: Sharif
Source NAT
35
Instructor: Sharif
Destination NAT
36
Instructor: Sharif
Destination NAT
37
Instructor: Sharif
Summary
Firewall Principles
Connection Tracking and states
Structure, Chains and actions
Firewall Filter actions
Protecting your router (input)
Protection your customers (forward)
Src NAT and Dst NAT
38
Instructor: Sharif
Thanks!
Any questions?
You can find me at:
Sharif.khairy786@[Link]
+93 784 67 08 45
39
Instructor: Sharif