Which command implements a basic firewall rule to drop traffic from a specific source address 203.0.113.0/24?

Which command implements a basic firewall rule to drop traffic from a specific source address 203.0.113.0/24?

• A. /ip firewall filter add chain=input src-address=203.0.113.0/24 action=drop
• B. /ip firewall filter add chain=input src-address=203.0.113.0/24 action=accept
• C. /ip firewall filter add chain=forward src-address=203.0.113.0/24 action=drop
• D. /ip firewall filter add chain=input src-address=203.0.0.0/24 action=drop

Answer: (A)

Blocking traffic from a specific source address is done by creating a firewall rule that matches that source and drops it, applied on the correct chain. Here, you want to block traffic headed to the router itself, so you place the rule in the input chain and specify the source as 203.0.113.0/24 with the action set to drop. The command /ip firewall filter add chain=input src-address=203.0.113.0/24 action=drop implements exactly that: any packets coming from hosts in that /24 range are discarded before they reach services on the router. The input chain handles traffic destined for the device, which is why this rule blocks those sources at the entry point. Using the forward chain would drop traffic passing through the router between interfaces, not traffic aimed at the router itself. Setting the action to accept would allow the traffic rather than block it, and specifying a different subnet like 203.0.0.0/24 wouldn’t target the requested range.

Blocking traffic from a specific source address is done by creating a firewall rule that matches that source and drops it, applied on the correct chain. Here, you want to block traffic headed to the router itself, so you place the rule in the input chain and specify the source as 203.0.113.0/24 with the action set to drop. The command /ip firewall filter add chain=input src-address=203.0.113.0/24 action=drop implements exactly that: any packets coming from hosts in that /24 range are discarded before they reach services on the router. The input chain handles traffic destined for the device, which is why this rule blocks those sources at the entry point. Using the forward chain would drop traffic passing through the router between interfaces, not traffic aimed at the router itself. Setting the action to accept would allow the traffic rather than block it, and specifying a different subnet like 203.0.0.0/24 wouldn’t target the requested range.