# RouterOS Firewall — Adding ICMP Accept Before Drop Rule

When enabling WAN ping on a MikroTik, the ICMP accept rule must be placed **before** the default "Drop WAN input" rule.

## Adding the Rule

```routeros
# Find the drop rule number first
/ip firewall filter print chain=input

# Add ICMP accept before the drop rule (replace N with drop rule number)
/ip firewall filter add chain=input protocol=icmp in-interface-list=WAN action=accept comment="Allow ICMP WAN Ping" place-before=N
```

## Common Issues

### place-before by comment finds wrong rule
RouterOS `place-before` accepts a rule number, not a comment. If you use `place-before=[find comment="Drop WAN input"]`, it may place the new rule *after* the drop rule instead of before it.

**Fix:** Use the literal rule number (e.g., `place-before=17`), not a find expression.

### New rule shows "I" flag (disabled)
If the rule was previously created via `add` and failed to place before the target, then a second `add` creates it disabled with an `I` flag. Remove it and re-add with the correct `place-before`.

### Rule numbering shifts
When rules are added/removed from other chains (forward, nat, etc.), the numbering in `input` chain stays stable. But if you remove a rule from `input`, the numbering shifts. Always re-run `print` before adding a rule with `place-before`.

### Testing
After adding the rule, test from an external host:
```bash
ping -c 3 <wan-ip>
```

## MikroTik Firewall Ordering Rules

- Rules are numbered 0..N within each chain
- `place-before=N` inserts the new rule before existing rule N
- If N is larger than any existing rule number, the new rule becomes the last rule
- The `I` (Invalid) flag means the rule was created but cannot be applied — usually a placement or parameter issue. Remove and recreate.