Which command implements a basic firewall rule to drop invalid connection state packets?

Which command implements a basic firewall rule to drop invalid connection state packets?

• A. /ip firewall filter add chain=forward connection-state=invalid action=drop
• B. /ip firewall filter add chain=forward connection-state=established action=drop
• C. /ip firewall filter add chain=input connection-state=invalid action=drop
• D. /ip firewall filter add chain=forward connection-state=invalid action=accept

Answer: (A)

Dropping packets that have an invalid connection state is a common first-step in a stateful firewall. The command shown applies to traffic that is being forwarded through the router (not traffic destined for the router itself) by using the forward chain. It targets packets whose connection-tracking state is invalid—these are not part of any known, established connection and often indicate spoofing, misconfiguration, or malformed traffic. By setting the action to drop, these suspicious packets are discarded immediately, strengthening security without affecting legitimate traffic. Dropping such packets in the forward chain is preferable to dropping established traffic, which would disrupt valid connections, or to using the input chain, which would apply to traffic destined for the router itself rather than transit traffic. Accepting invalid state would permit potentially harmful traffic to pass through.

Dropping packets that have an invalid connection state is a common first-step in a stateful firewall. The command shown applies to traffic that is being forwarded through the router (not traffic destined for the router itself) by using the forward chain. It targets packets whose connection-tracking state is invalid—these are not part of any known, established connection and often indicate spoofing, misconfiguration, or malformed traffic. By setting the action to drop, these suspicious packets are discarded immediately, strengthening security without affecting legitimate traffic.

Dropping such packets in the forward chain is preferable to dropping established traffic, which would disrupt valid connections, or to using the input chain, which would apply to traffic destined for the router itself rather than transit traffic. Accepting invalid state would permit potentially harmful traffic to pass through.