Stage 1 → security

MikroTik Firewall Rule Builder

Turn a firewall intention into a visible RouterOS rule while keeping order, scope, and rollback in view.

Free to use · Runs locally in your browser · Last reviewed 2026-09-26

Review before deployment: Firewall rules are order-dependent. This builder only creates a narrow rule set and leaves interface names, trusted networks, and rule order visible for review.

Inputs

Chain

Action

Protocol

Destination port

Source address/network

In-interface-list

Add established/related rule before the custom rule

firewall-rules.rsc

Change an input to recalculate.

How to use this result

Put the established/related rule first, then narrow rules, then a deliberate default policy. A rule that accepts Winbox from an entire WAN is not a hardening rule. Prefer an interface list and a trusted management subnet, and use counters to prove the intended traffic matched.

/ip firewall filter print stats
/ip firewall connection print

Related tools

Sources and safe-use notes

This page follows the RouterOS documentation and the networking standards linked below. RouterOS syntax, hardware limits, and packet direction depend on your exact release and topology. Export a backup, test one controlled case, and keep a rollback path before applying generated output.

MikroTik documentation · RouterOS manual · RFC 4632 — CIDR · RFC 6598 — shared address space · RFC 8200 — IPv6 · MikroTik firewall filter documentation · MikroTik firewall basics