Hi,

My topology:
Internet --- Modem (Bridge) --- MikroTik (pppoe) --- Switch --- LAN

Modem = 10.0.0.1
MikroTik ether1 (to Modem) = 10.0.0.2
MikroTik ether2 (to LAN) = 192.168.1.2
LAN = 192.168.1.xxx/24

I have 2 questions:

1. How to block ping from Internet to MikroTik, and MikroTik still able to ping Internet (google.com)?
I tried with ip firewall filter chain=input action=drop protocol=icmp in-interface=pppoe-out1
It works with blocking ping from Internet but MikroTik became unable to ping Internet. I want MikroTik is still able to ping Internet. LAN is also able to ping Internet.
The purpose is to block intruder/hacker from Internet trying to ping to my network.

2. How to block ping from LAN to ether1 (Modem (Bridge) & MikroTik)? Not blocking with ip, but blocking with interface ether1.
I tried with
ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.1 in-interface=ether2
ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.2 in-interface=ether2
It works, but it is blocking with IP which is not efficient, if I have many devices on 10.0.0.0/24 then I should add them all. I think it is much simpler just block ether1, is it possible?

Solved question 1: just adding connection-state=new

Thanks....
waiting for answer to question 2...

2. How to block ping from LAN to ether1 (Modem (Bridge) & MikroTik)? Not blocking with ip, but blocking with interface ether1.
I tried with
ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.1 in-interface=ether2
ip firewall nat chain=input action=drop protocol=icmp dst-address=10.0.0.2 in-interface=ether2
It works, but it is blocking with IP which is not efficient, if I have many devices on 10.0.0.0/24 then I should add them all. I think it is much simpler just block ether1, is it possible?

Remove the dst-address, just block ICMP inputs to the router from the required interface. Add the rule in "/ip firewall filter" not "NAT"

Remove the dst-address, just block ICMP inputs to the router from the required interface. Add the rule in "/ip firewall filter" not "NAT"

Code: Select all

/ip firewall filter chain=input action=drop protocol=icmp in-interface=ether2

The command above block only from ether2 to ether1, and by blocking from ether2 to any devices behind ether1, i use
/ip firewall filter chain=forward action=drop protocol=icmp in-interface=ether2 out-interface=ether1

and it works...
thanks...