MikroTik Firewall Hardening

Generate MikroTik firewall filter hardening rules and security configurations for RouterOS 6 and 7. Create input, forward, and service protection rules with bruteforce prevention, port scan detection, FastTrack, Layer2 hardening, and customizable security templates online.
Loading...
General Settings
RouterOS VersionWAN Interface
LAN InterfaceManagement Subnet
SSH PortWinbox Port
Firewall Templates
Service Hardening
Generated Script

RouterOS 7WAN: ether1LAN: bridge
©2026 Itung.online. Built for practical online workflows.
This site is protected by reCAPTCHA and the GooglePrivacy PolicyTerms of Serviceapply.

Overview

The MikroTik Firewall Hardening generator produces ready-to-paste RouterOS firewall filter rules, service lockdowns, and Layer2 protections for RouterOS 6 and 7. It builds input and forward chain rules with established-connection handling, SSH bruteforce blacklisting, port scan detection, optional FastTrack, and a final drop for the WAN interface. The output is organized into five copyable blocks covering input, forward, address lists, services, and Layer2.

Common Use Cases

How to Use

1
Set the general settings: RouterOS version, WAN interface, LAN interface, management subnet, SSH port, and Winbox port.
2
Toggle the firewall templates you want, such as FastTrack, ICMP, SSH, Winbox, bruteforce protection, port scan protection, and torrent blocking.
3
Toggle the service hardening switches to disable Telnet, FTP, API, API SSL, MAC server, MAC Winbox, and neighbor discovery on WAN.
4
Open each accordion section, Input Rules, Forward Rules, Services, Layer2 Hardening, or Full Script, and copy the block you need into the terminal.

Example Scenario

Hardening a small office gateway

For a router with ether1 as the WAN, a bridge as the LAN, and the default 192.168.1.0/24 management subnet, keep SSH on port 2222 and Winbox on 8292. The generator emits an input chain that accepts established traffic, allows ICMP, limits SSH and Winbox to the LAN, blacklists repeated SSH attempts into ssh_blacklist, drops port scanners, and ends with a drop of all WAN input.

Technical Notes

The input and forward chains always begin by accepting established and related connections and dropping invalid ones, which keeps existing sessions working while rejecting malformed traffic.

Bruteforce protection adds sources of new SSH connection attempts to an ssh_blacklist address list with a one-day timeout, and a later rule drops traffic that matches the list.

Port scan detection uses the RouterOS PSD port scan detection matcher with psd=21,3s,3,1 and adds offenders to a port_scanner list that is then dropped.

The FastTrack rule sends established and related forward traffic to the fast path for higher throughput and is placed before the matching accept rule.

SSH and Winbox accept rules allow only the management subnet on the LAN interface, and the /ip service lines restrict those services to the same subnet.

The Address List section only appears when bruteforce protection is enabled, because it is the only rule group that creates address lists.

Common Mistakes

Frequently Asked Questions

It moves SSH and Winbox to the ports and management subnet you specify and disables the legacy services you select. Without it, your custom ports may not match the firewall rules.

The generator creates an ssh_blacklist address list, drops sources already on it, and adds any source of a new SSH connection attempt to the list with a one-day timeout.

It rejects any new connection to the router itself arriving on the WAN interface, after the explicit allow rules have already run.

FastTrack only accelerates established and related forward connections. The generator places it before the accept rule for those connection states so the rules still match correctly.

The selected version is shown on the output badge. The generated rules are identical for RouterOS 6 and RouterOS 7.

Related Topics

MikroTik Config FormatterMikroTik PCC GeneratorMikroTik Queue GeneratorIPv4 Subnet CalculatorIPv6 Subnet Calculator