Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,39 @@
+# RouterOS Firewall — Adding ICMP Accept Before Drop Rule
+
+When enabling WAN ping on a MikroTik, the ICMP accept rule must be placed **before** the default "Drop WAN input" rule.
+
+## Adding the Rule
+
+```routeros
+# Find the drop rule number first
+/ip firewall filter print chain=input
+
+# Add ICMP accept before the drop rule (replace N with drop rule number)
+/ip firewall filter add chain=input protocol=icmp in-interface-list=WAN action=accept comment="Allow ICMP WAN Ping" place-before=N
+```
+
+## Common Issues
+
+### place-before by comment finds wrong rule
+RouterOS `place-before` accepts a rule number, not a comment. If you use `place-before=[find comment="Drop WAN input"]`, it may place the new rule *after* the drop rule instead of before it.
+
+**Fix:** Use the literal rule number (e.g., `place-before=17`), not a find expression.
+
+### New rule shows "I" flag (disabled)
+If the rule was previously created via `add` and failed to place before the target, then a second `add` creates it disabled with an `I` flag. Remove it and re-add with the correct `place-before`.
+
+### Rule numbering shifts
+When rules are added/removed from other chains (forward, nat, etc.), the numbering in `input` chain stays stable. But if you remove a rule from `input`, the numbering shifts. Always re-run `print` before adding a rule with `place-before`.
+
+### Testing
+After adding the rule, test from an external host:
+```bash
+ping -c 3 <wan-ip>
+```
+
+## MikroTik Firewall Ordering Rules
+
+- Rules are numbered 0..N within each chain
+- `place-before=N` inserts the new rule before existing rule N
+- If N is larger than any existing rule number, the new rule becomes the last rule
+- The `I` (Invalid) flag means the rule was created but cannot be applied — usually a placement or parameter issue. Remove and recreate.