MikroTik RouterOS Firewall Rules for ISPs: Blocking Abuse, Protecting Subscribers & Securing Your Network

A misconfigured firewall is one of the most common causes of ISP network outages, security breaches, and subscriber complaints in Uganda, Kenya, and Tanzania. RouterOS has one of the most powerful and flexible firewall engines available on any router platform — but that flexibility means it requires deliberate configuration. Without proper firewall rules, your PPPoE server is exposed, your management interfaces are vulnerable, and subscriber traffic can loop or flood your network.

This guide covers the essential RouterOS firewall rules every ISP must have, optimised for MikroTik-based networks running PPPoE with an integrated ISP billing system.

RouterOS Firewall Fundamentals

• input — traffic destined for the router itself
• forward — traffic passing through the router (subscriber internet traffic)
• output — traffic originating from the router

Rules are evaluated top-to-bottom. The first matching rule wins. Always end with a drop rule after your explicit accepts.

Recommended Hardware

• MikroTik hEX S RB760iGS — primary ISP core router and firewall
• MikroTik hEX RB750Gr3 — zone-level distribution router
• MikroTik hAP RouterBOARD with PoE — subscriber CPE
• MikroTik hAP lite Wireless Router — residential CPE
• MikroTik hAP lite RB941-2nD — budget CPE
• MikroTik RouterBOARD Wireless Router — backhaul and distribution

Cabling: Cat6 Flat Ethernet Cable (indoor) and Cat6 Indoor/Outdoor UTP Cable (outdoor). Browse the full MikroTik Routers collection.

Input Chain Rules (Protect the Router)

1. Allow Established and Related Connections

Chain: input | Connection State: established, related | Action: accept

2. Drop Invalid Connections

Chain: input | Connection State: invalid | Action: drop

3. Allow ICMP

Chain: input | Protocol: icmp | Action: accept

4. Allow Management from Trusted Subnet Only

Chain: input | Src Address: 10.0.10.0/24 | Action: accept

5. Allow RouterOS API from Billing Server Only

Only your billing platform should reach the API:

Chain: input | Protocol: tcp | Dst Port: 8728,8729 | Src Address: [billing-server-IP] | Action: accept

6. Allow Winbox from Management Subnet

Chain: input | Protocol: tcp | Dst Port: 8291 | Src Address: 10.0.10.0/24 | Action: accept

7. Drop Everything Else to the Router

Chain: input | Action: drop

Forward Chain Rules (Subscriber Traffic)

8. Allow Established and Related Forward Traffic

Chain: forward | Connection State: established, related | Action: accept

9. Drop Invalid Forward Traffic

Chain: forward | Connection State: invalid | Action: drop

10. Allow Subscribers to Internet

Chain: forward | In Interface: [pppoe-out] | Out Interface: [ether1-WAN] | Action: accept

11. Block Inter-Subscriber Traffic (Recommended)

Chain: forward | In Interface: [subscriber] | Out Interface: [subscriber] | Action: drop

NAT Rule

12. Masquerade Subscriber Traffic

Chain: srcnat | Out Interface: [ether1-WAN] | Action: masquerade

Firewall Best Practices

• Never expose Winbox or API to the internet — management subnet only
• Put established/related rules first — reduces CPU load dramatically
• Log drop rules during testing — diagnose blocked traffic before going live
• Always back up before changes — a firewall mistake can lock you out
• Test from a subscriber CPE — verify hAP RouterBOARD or hAP lite still connects after applying rules

Conclusion

A properly configured RouterOS firewall protects your management interfaces, secures the billing system API, and keeps subscriber traffic flowing cleanly. Apply these rules to every MikroTik router in your ISP stack.

Automate subscriber management with our ISP billing system →