1.8 KiB
RouterOS Firewall — Adding ICMP Accept Before Drop Rule
When enabling WAN ping on a MikroTik, the ICMP accept rule must be placed before the default "Drop WAN input" rule.
Adding the Rule
# Find the drop rule number first
/ip firewall filter print chain=input
# Add ICMP accept before the drop rule (replace N with drop rule number)
/ip firewall filter add chain=input protocol=icmp in-interface-list=WAN action=accept comment="Allow ICMP WAN Ping" place-before=N
Common Issues
place-before by comment finds wrong rule
RouterOS place-before accepts a rule number, not a comment. If you use place-before=[find comment="Drop WAN input"], it may place the new rule after the drop rule instead of before it.
Fix: Use the literal rule number (e.g., place-before=17), not a find expression.
New rule shows "I" flag (disabled)
If the rule was previously created via add and failed to place before the target, then a second add creates it disabled with an I flag. Remove it and re-add with the correct place-before.
Rule numbering shifts
When rules are added/removed from other chains (forward, nat, etc.), the numbering in input chain stays stable. But if you remove a rule from input, the numbering shifts. Always re-run print before adding a rule with place-before.
Testing
After adding the rule, test from an external host:
ping -c 3 <wan-ip>
MikroTik Firewall Ordering Rules
- Rules are numbered 0..N within each chain
place-before=Ninserts the new rule before existing rule N- If N is larger than any existing rule number, the new rule becomes the last rule
- The
I(Invalid) flag means the rule was created but cannot be applied — usually a placement or parameter issue. Remove and recreate.