Agent skill · software engineering · aiskillstore
routeros-firewall
RouterOS firewall filter, NAT, mangle, and address-list configuration. Use when: writing firewall rules in RouterOS, configuring NAT, setting up address-lists or interface-lists, writing idempotent firewall scripts, configuring DNS redirect or port forwarding, or when the user mentions /ip/firewall, chain=forward, chain=input, connection-state, address-list, interface-list, or layer7-protocol on MikroTik.
Why this skill is useful
Provides specific RouterOS firewall configuration patterns and scripts that are not commonly known, enhancing the AI's ability to generate effective firewall rules.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
RouterOS Firewall Rule Ordering — Sequential, Not Priority-Based Rules are evaluated top-to-bottom — first match wins. This is the biggest source of iptables confusion. place-before=0 inserts at the top; default add appends at the bottom An action=accept rule must appear BEFORE any action=drop for the same traffic Non-terminal actions do NOT stop evaluation: action=add-src-to-address-list, action=add-dst-to-address-list, action=log, and any rule with passthrough=yes continue to the next rule. A drop rule below an add-src-to-address-list will still fire. Address-Lists as Dynamic Selectors LLMs rarely suggest this pattern — they write one rule per IP address instead. Address-lists scale to hundreds of IPs with a single firewall rule. Dynamic entries with timeout= expire automatically — the primary pattern for DoS blacklists. Interface-Lists as Rule Selectors in-interface-list= / out-interface-list= — powerful RouterOS pattern LLMs never propose. Eliminates duplicate rules when multiple interfaces serve the same role. Comment-as-Tag Pattern (Idempotent Scripts) RouterOS has no "upsert" — re-running a script without cleanup creates duplicate rules. Use a comment prefix as a tag: Never use remove [find dynamic=no] — this deletes ALL static rules including those added by management tools. Some tools (e.g. OptiWize) mark their rules with comment~"#orchestrator-" — a bulk remove silently breaks remote management. Connection State RouterOS connection-state= is not iptables -m state: RouterOS states: new, established, related, invalid, untracked. untracked matches packets explicitly marked via /ip/firewall/raw action=notrack — it does NOT match FastTrack flows. FastTrack is a separate fast-path that keeps flows in conntrack but bypasses mangle. Never combine fasttrack-connection with mangle-based routing marks on the same traffic — mangle marks are not applied to fasttracked packets. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/routeros-firewall