Firewall: Understanding Custom Chains

Understanding Custom Chains

Ever wondered what makes MikroTik firewalls so flexible? It’s the custom chain feature — a powerful way to group and reuse firewall rules efficiently. Think of it as creating “mini rule blocks” or “functions” inside your firewall configuration. Let’s break it down in a practical, Pinoy-friendly way.

🔥 What Is a Custom Chain?

In MikroTik, a custom chain works like a shortcut or function. Instead of writing repetitive rules for every scenario, you can group related ones together. When a packet matches your condition, you “jump” into your custom chain, process the rules, then return to the main flow.

⚙️ Example: LAN Traffic Filtering

Here’s a simple setup where we handle LAN traffic separately:

# MikroTik Firewall Example
/ip firewall filter
add chain=forward src-address=192.168.88.0/24 action=jump jump-target=LAN-RULES
add chain=LAN-RULES protocol=tcp dst-port=80,443 action=accept comment="Allow Web"
add chain=LAN-RULES protocol=udp dst-port=53 action=accept comment="Allow DNS"
add chain=LAN-RULES action=drop comment="Drop Other LAN Traffic"
add chain=LAN-RULES action=return comment="Return to main chain"
  

🧩 Linux Equivalent (iptables)

# Linux iptables Example
iptables -N LAN_RULES
iptables -A FORWARD -s 192.168.88.0/24 -j LAN_RULES
iptables -A LAN_RULES -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A LAN_RULES -p udp --dport 53 -j ACCEPT
iptables -A LAN_RULES -j DROP
iptables -A LAN_RULES -j RETURN
  

📊 Illustration: How Custom Chains Flow

Packets jump into your custom chain, get processed, then return to the main chain — simple and efficient.

🧠 In Short

• Custom chains = mini rule sets or functions.
• They help organize your firewall rules cleanly.
• You can reuse them for multiple scenarios (LAN, WAN, or VLAN).

In other words, custom chains make your MikroTik config cleaner and faster to troubleshoot — a habit every pro network admin should develop early.