RouterOS Firewall — Adding ICMP Accept Before Drop Rule

When enabling WAN ping on a MikroTik, the ICMP accept rule must be placed before the default "Drop WAN input" rule.

Adding the Rule

# Find the drop rule number first
/ip firewall filter print chain=input

# Add ICMP accept before the drop rule (replace N with drop rule number)
/ip firewall filter add chain=input protocol=icmp in-interface-list=WAN action=accept comment="Allow ICMP WAN Ping" place-before=N

Common Issues

place-before by comment finds wrong rule

RouterOS place-before accepts a rule number, not a comment. If you use place-before=[find comment="Drop WAN input"], it may place the new rule after the drop rule instead of before it.

Fix: Use the literal rule number (e.g., place-before=17), not a find expression.

New rule shows "I" flag (disabled)

If the rule was previously created via add and failed to place before the target, then a second add creates it disabled with an I flag. Remove it and re-add with the correct place-before.

Rule numbering shifts

When rules are added/removed from other chains (forward, nat, etc.), the numbering in input chain stays stable. But if you remove a rule from input, the numbering shifts. Always re-run print before adding a rule with place-before.

Testing

After adding the rule, test from an external host:

ping -c 3 <wan-ip>

MikroTik Firewall Ordering Rules

Rules are numbered 0..N within each chain
place-before=N inserts the new rule before existing rule N
If N is larger than any existing rule number, the new rule becomes the last rule
The I (Invalid) flag means the rule was created but cannot be applied — usually a placement or parameter issue. Remove and recreate.

1.8 KiB Raw Blame History