# Configure RouterOS Firewall Rules Safely

RouterOS firewall syntax is easy to misorder and duplicate. This skill gives focused guidance for filters, NAT, mangle routing, lists, and DoS rules.

## Install

```bash
npx skillstore add tikoci/routeros-firewall
```

## Metadata

- Status: approved
- Slug: tikoci-routeros-firewall
- Skillstore revision: r1
- Version status: missing
- Tree hash: fd3414fb244167848d933a52b63ca240ce15bd93fb8c4a080122aefb1c8fa11f
- Author: tikoci
- GitHub username: tikoci
- License: MIT
- Repository: https://github.com/tikoci/routeros-skills/tree/main/routeros-firewall
- Ref: 36e07d5e13068e5be64447e8f20b427cf2cbd21a
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands
- Quality score: 74
- Public page: https://skillstore.pages.dev/skills/tikoci-routeros-firewall
- Manifest: https://skillstore.pages.dev/api/skills/tikoci-routeros-firewall/manifest

## Capabilities

- Explains top-to-bottom RouterOS firewall rule order and first-match behavior.
- Shows when to use address lists and interface lists instead of repeated rules.
- Guides idempotent rule cleanup with comment prefixes that preserve other rules.
- Covers NAT patterns for port forwarding, forced DNS, and WAN masquerade.
- Describes mangle routing patterns, DNS exemptions, routing marks, and FastTrack conflicts.
- Summarizes DoS patterns using psd, connection-limit, dynamic lists, and tarpit behavior.

## Use Cases

- Build a Management Access Policy: Create ordered input-chain guidance that accepts trusted sources before WAN drop rules.
- Design NAT and DNS Controls: Plan port forwarding, forced DNS redirects, and outbound masquerade without duplicate rules.
- Review Policy Routing Rules: Check mangle routing marks, DNS exemptions, and FastTrack interactions before deployment.

## Prompt Templates

### Create a Basic Filter Plan

```
Draft a RouterOS input-chain plan for a small office. Include established traffic, trusted management sources, and WAN drop order.
```

### Convert Rules to Lists

```
Review these firewall requirements and suggest address-list or interface-list patterns. Explain the rule order and cleanup comments.
```

### Plan NAT and DNS Redirects

```
Design RouterOS NAT guidance for one web port forward, forced LAN DNS, and WAN masquerade. Mention required user-specific placeholders.
```

### Audit Mangle Routing and DoS Rules

```
Review my RouterOS policy routing and DoS protection plan. Check DNS exemptions, routing marks, FastTrack conflicts, and false positives.
```

## Limitations

- It does not connect to a router or apply configuration changes.
- Examples must be adapted to the user network, interfaces, and RouterOS version.
- It focuses on IPv4 RouterOS firewall features and notes IPv6 as separate.
- It cannot verify live rule counters, packet flow, or device performance.

## Best Practices

- Place narrow accept rules before broad drop rules.
- Use comment prefixes for idempotent cleanup of owned rules only.
- Check FastTrack before adding mangle-based routing marks.

## Anti Patterns

- Do not bulk-remove all static firewall rules.
- Do not add one rule per address when an address list fits.
- Do not assume IPv4 firewall rules also protect IPv6 traffic.

## Security Audit

- Audited at: 2026-07-07T07:05:45.518\+00:00
- Summary: All static findings are false positives from markdown code fences, inline RouterOS syntax, sample private IP ranges, and visible MikroTik links. No prompt injection, hidden network access, host command execution, credential handling, or malicious intent was found in the reviewed files.

## Stats

- Views: 38
- Downloads: 10
- Favorites: 0
- Popularity score: 0