Which firewall rule would drop SSH traffic on the input chain?

Which firewall rule would drop SSH traffic on the input chain?

• A. /ip firewall filter add chain=input protocol=tcp port=22 action=drop
• B. /ip firewall filter add chain=input src-address=0.0.0.0/0 protocol=tcp port=22 action=accept
• C. /ip firewall filter add chain=forward protocol=tcp port=22 action=drop
• D. /ip firewall filter add chain=output protocol=tcp port=22 action=drop

Answer: (A)

Blocking SSH to the device hinges on targeting traffic that ends at the router itself. In MikroTik firewall terminology, the input chain handles packets destined for the router, the forward chain handles packets being routed through it, and the output chain handles packets generated by the router itself. A rule that drops TCP traffic on port 22 in the input chain directly blocks SSH attempts that are addressed to the router, which is exactly what you want. The rule you’re looking at uses chain=input, protocol=tcp, port=22, and action=drop. This matches SSH connections coming into the device and tells the firewall to drop them, effectively disabling SSH access to the router. Why the other options don’t fit: one would allow SSH to the device, not block it; another blocks SSH traffic that is merely being forwarded through the router (not traffic aimed at the router itself); and the last would drop SSH traffic originating from the router itself to a remote host, which is not about blocking access to the router.

Blocking SSH to the device hinges on targeting traffic that ends at the router itself. In MikroTik firewall terminology, the input chain handles packets destined for the router, the forward chain handles packets being routed through it, and the output chain handles packets generated by the router itself. A rule that drops TCP traffic on port 22 in the input chain directly blocks SSH attempts that are addressed to the router, which is exactly what you want.

The rule you’re looking at uses chain=input, protocol=tcp, port=22, and action=drop. This matches SSH connections coming into the device and tells the firewall to drop them, effectively disabling SSH access to the router.

Why the other options don’t fit: one would allow SSH to the device, not block it; another blocks SSH traffic that is merely being forwarded through the router (not traffic aimed at the router itself); and the last would drop SSH traffic originating from the router itself to a remote host, which is not about blocking access to the router.