🛠️ This site has 3 free RouterOS generators + in-depth guides — see everything here.

/ip firewall → RouterOS config generator

MikroTik NAT + Firewall Generator

For any MikroTik gateway — not just PPPoE or Hotspot setups. Masquerade, optional port forwarding, WAN-side hardening, and basic brute-force protection, generated together.

Interfaces & LAN

WAN interface

LAN subnet (CIDR)

Port forwarding (optional) Forward one external port to a local device. Leave unchecked if you don't need this.

Hardening Block Winbox, Telnet, FTP & API from the WAN. Recommended for every internet-facing router. Block SSH from the WAN too. Uncheck only if you specifically need remote SSH access from outside. Rate-limit new connection attempts to router services. Basic brute-force protection via address-list blacklisting.

nat-firewall-config.rsc

What this script sets up

Unlike the PPPoE and Hotspot generators, this one isn't tied to subscriber access at all — it's the baseline every internet-facing MikroTik router should have, regardless of what else runs on it.

01 · NAT

Masquerade scoped to your actual LAN subnet, not the whole router — tighter than a blanket rule.

02 · Port forward

Optional dst-nat rule for exposing one internal service (a camera, a server) without opening the whole LAN.

03 · Service hardening

Closes Winbox, Telnet, FTP, API, and optionally SSH to anyone on the WAN side.

04 · Brute-force protection

New connection attempts to router services beyond a threshold get temporarily blacklisted via address-list.

05 · Forward chain

Standard established/related accept plus invalid drop — same baseline as the PPPoE and Hotspot generators.

Import

Download the .rsc file and run /import nat-firewall-config.rsc from Winbox's terminal.

Before you deploy: if you manage this router remotely, keep a Winbox/console session open while testing — a misordered firewall rule can lock you out of your own router. Test on a device you can reach physically before relying on this in production.