Which command sequence adds an allowed subnet to an address-list and permits that subnet through the input chain?

Which command sequence adds an allowed subnet to an address-list and permits that subnet through the input chain?

• A. /ip firewall filter add chain=input action=drop; /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept
• B. /ip firewall filter add chain=input action=drop; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept; /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16
• C. /ip firewall address-list add list=allowed-subnet address=192.168.0.0/16; /ip firewall filter add chain=input src-address-list=allowed-subnet action=accept; /ip firewall filter add chain=input action=drop
• D. /ip firewall address-list add list=blocked-subnet address=10.0.0.0/8; /ip firewall filter add chain=input src-address-list=blocked-subnet action=drop; /ip firewall filter add chain=input action=accept

Answer: (C)

Controlling inbound traffic with an allowlist relies on two things: having the allowed subnet in an address-list and then using a rule that matches that list to permit traffic, with a final rule to drop everything else. In this sequence, you first create the address-list entry for the subnet (192.168.0.0/16). Next, you add a firewall rule in the input chain that matches src-address-list=allowed-subnet and sets action=accept. Finally, you include a catch-all drop rule for the input chain. This order ensures that traffic from the allowed subnet is accepted, while all other inbound traffic is blocked by the subsequent drop rule. Why this works better than the other sequences: if the drop rule is placed before the accept rule, any traffic from the allowed subnet would be dropped before the accept rule can apply. If you create the accept rule before the address-list exists, the rule would reference a list that isn’t defined yet, which can lead to confusion or misbehavior. And having a broad accept rule (with no specific source-list) would defeat the purpose of using an allowlist. The sequence that creates the address-list first, then the accept rule referencing that list, followed by a drop rule, cleanly implements an allowlist on the input chain.

Controlling inbound traffic with an allowlist relies on two things: having the allowed subnet in an address-list and then using a rule that matches that list to permit traffic, with a final rule to drop everything else. In this sequence, you first create the address-list entry for the subnet (192.168.0.0/16). Next, you add a firewall rule in the input chain that matches src-address-list=allowed-subnet and sets action=accept. Finally, you include a catch-all drop rule for the input chain. This order ensures that traffic from the allowed subnet is accepted, while all other inbound traffic is blocked by the subsequent drop rule.

Why this works better than the other sequences: if the drop rule is placed before the accept rule, any traffic from the allowed subnet would be dropped before the accept rule can apply. If you create the accept rule before the address-list exists, the rule would reference a list that isn’t defined yet, which can lead to confusion or misbehavior. And having a broad accept rule (with no specific source-list) would defeat the purpose of using an allowlist. The sequence that creates the address-list first, then the accept rule referencing that list, followed by a drop rule, cleanly implements an allowlist on the input chain.