40 lines
1.8 KiB
Markdown
40 lines
1.8 KiB
Markdown
# RouterOS Firewall — Adding ICMP Accept Before Drop Rule
|
|
|
|
When enabling WAN ping on a MikroTik, the ICMP accept rule must be placed **before** the default "Drop WAN input" rule.
|
|
|
|
## Adding the Rule
|
|
|
|
```routeros
|
|
# Find the drop rule number first
|
|
/ip firewall filter print chain=input
|
|
|
|
# Add ICMP accept before the drop rule (replace N with drop rule number)
|
|
/ip firewall filter add chain=input protocol=icmp in-interface-list=WAN action=accept comment="Allow ICMP WAN Ping" place-before=N
|
|
```
|
|
|
|
## Common Issues
|
|
|
|
### place-before by comment finds wrong rule
|
|
RouterOS `place-before` accepts a rule number, not a comment. If you use `place-before=[find comment="Drop WAN input"]`, it may place the new rule *after* the drop rule instead of before it.
|
|
|
|
**Fix:** Use the literal rule number (e.g., `place-before=17`), not a find expression.
|
|
|
|
### New rule shows "I" flag (disabled)
|
|
If the rule was previously created via `add` and failed to place before the target, then a second `add` creates it disabled with an `I` flag. Remove it and re-add with the correct `place-before`.
|
|
|
|
### Rule numbering shifts
|
|
When rules are added/removed from other chains (forward, nat, etc.), the numbering in `input` chain stays stable. But if you remove a rule from `input`, the numbering shifts. Always re-run `print` before adding a rule with `place-before`.
|
|
|
|
### Testing
|
|
After adding the rule, test from an external host:
|
|
```bash
|
|
ping -c 3 <wan-ip>
|
|
```
|
|
|
|
## MikroTik Firewall Ordering Rules
|
|
|
|
- Rules are numbered 0..N within each chain
|
|
- `place-before=N` inserts the new rule before existing rule N
|
|
- If N is larger than any existing rule number, the new rule becomes the last rule
|
|
- The `I` (Invalid) flag means the rule was created but cannot be applied — usually a placement or parameter issue. Remove and recreate.
|