In the MikroTik firewall, as in many other firewall systems, the order of the rules is crucial and not random. Each packet that passes through the firewall is checked against the rules in sequence, starting from the first rule down the list.

As soon as a rule matching the packet is found, the action specified in that rule is taken (allow, block, flag, etc.), and the packet is not compared to subsequent rules. This process is known as the “first match wins” rule.

Importance of the Order of the Rules

• Security Policy Effectiveness: The order of the rules determines the effectiveness of your security policy. Poorly ordered rules can result in allowing traffic that should be blocked or vice versa.
• Performance Optimization: Placing the most used rules or those most likely to match the traffic at the beginning can improve firewall performance by reducing the time required to process each packet.
• Specificity: The more specific rules should come before the more general ones. For example, if you have a rule to block all traffic to a specific server and another rule to allow all traffic to anywhere, the specific blocking rule should go first.

Considerations for the Order of the Rules

1. Specific Blocking Rules at the Beginning: Place specific rules to block unwanted traffic at the top of your rules list.
2. Allow Known Traffic: After blocking specifically unwanted traffic, follow up with rules to allow expected and known traffic to and from your critical services.
3. Wide Capture Rules at the End: Broad capture rules, such as generic rules of allowing or blocking all remaining traffic, should go last.
4. Using “FastTrack”: If you are using the FastTrack feature (which allows certain traffic to bypass firewall processing to improve performance), be careful with its position as it could bypass important security rules if configured incorrectly.
5. Registration and Debugging Rules: Rules for logging certain traffic are often placed in strategic positions depending on what traffic you need to monitor, but keep in mind that too much logging can impact performance.

Modify the Order of the Rules

You can change the order of rules in MikroTik RouterOS using WinBox, WebFig, or the command line. In WinBox or WebFig, you can simply drag and drop the rulers to rearrange them. On the command line, you can use the sequence numbers of the rules to move them using commands like move.

Conclusion

The order of the rules in the MikroTik firewall is essential to ensure that your network is protected effectively and that the firewall functions optimally. Careful planning and organization of your firewall rules is essential to maintaining a secure and efficient network.