Manual:Packet Flow

From MikroTik Wiki
Jump to navigation Jump to search

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or natting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?

To address these questions we created a packet flow diagram.


As it was impossible to get everything in one diagram, Packet flow diagram for Mikrotik RouterOS v3.x was created in 2 parts:

  • Bridging or Layer-2 (MAC) where Routing part is simplified to one "Layer-3" box
  • Routing or Layer-3 (IP) where Bridging part is simplified to one "Bridging" box

Packet Flow in Layer-2

Packet Flow in Layer-3


Basic Concepts

Input Interface - starting point in packets way thought the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.

Output Interface - last point in packets way thought the router facilities. Just before the packet is actually sent out.

Filter Output - last point in packets way to router itself, after this packet is discarded

Filter Output - starting point for packets generated by router itself

Configurable Facilities

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly

Connection Tracking - /ip firewall connection tracking

Filter Input Filter Forward Filter Output - /ip firewall filter

Source NAT Destination NAT - /ip firewall nat

Mangle Prerouting Mangle Input Mangle Forward Mangle Output Mangle Postrouting - /ip firewall mangle

Global-in HTB Global-Out HTB Interface HTB - /queue simple and /queue tree

IPSec_Policy - /ip ipsec policy

Use IP Firewall - /interface bridge settings

Bridge Forward Bridge Input Bridge Output - /interface bridge filter

Bridge Destination NAT Bridge Source NAT - /interface bridge nat

Automated processes and desicions

Routing Adjustment


TTL Adjustment

Bridge Decision



In-interface Bridge

Out-interface Bridge

Bridge Decision

Hotspot In

Hotspot Out


Example1: Bridging with use-ip-firewall=yes

Example2: Routing - from Ethernet to Ethernet interface

Example3: Routing from one Bridge interface to another

Example4: IPsec encryption and sending to the peer

Example5: IPsec data receiving and decryption