Manual:Packet Flow
Applies to RouterOS: v6.0+
Overview
MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or NATting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.
However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?
To address these questions we created a packet flow diagram.
Diagrams
For MikroTik RouterOS v6.0 was created detailed diagrams to ease understanding of packet flow.
Overall Packetflow Diagram
Bridging Diagram
In this subsection you can inspect how the packet is going through the bridge. For example, if you configure /interface bridge settings set use-ip-firewall=yes, then the packet will go through the one of all three predefined IP firewall filter chains: input, output, forward.
MPLS Diagram
Packet-forwarding decisions are made solely on the contents of this label, without the need to examine the packet itself. Diagram describe MPLS label movement in RouterOS.
Routing Diagram
Each routing protocol (except BGP) has it's own internal tables. This is where per-protocol routing decisions are made. BGP does not have internal routing tables and stores complete routing information from all peers in the RIB. RIB contains routes grouped in separate routing tables based on their value of routing-mark. All routes without routing-mark are kept in the main routing table. These tables are used for best route selection. The main table is also used for nexthop lookup.
Packet Flow Chains
This diagram explains in detail each section of the Overall Packetflow Diagram.
Examples
In this subsection you can overview different protocol packet processing in RouterOS.
Bridge port in with PPPoE-out
PPPoE-in with bridge port out
Vlan Untagging/Tagging in the bridge interface
EoIP with VPLS out
Ipsec Encryption/Decryption
Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to secure packet exchange over unprotected IP/IPv6 networks such as Internet.
