0
Mikrotik Scripting: Using the "place-before" parameter to place fw rule "after" other rule
This is a quick trick to programmatically place firewall rules after specific rules, not before.
Normally you already have the place-before parameter when adding firewall rules, but there can be times when you programmatically need to place the rule after another specific rule.
Assumed you want to insert a new rule after the common "established, related" states firewall rule in the input chain, you could do this
This places the rule after it. It makes use of the .nextid property of the entry to get the internal id of the next item in the list. This also works when the rule is the last one in the chain, because the .nextid property will then automatically receive the maximum internal id reference *ffffffff.
The above oneliner assumes that a specific rule already exists, otherwise this command will fail. So to be secure you normally want to do a check if the rule exists:
Regards @colinardo
Normally you already have the place-before parameter when adding firewall rules, but there can be times when you programmatically need to place the rule after another specific rule.
Assumed you want to insert a new rule after the common "established, related" states firewall rule in the input chain, you could do this
/ip firewall filter add chain=input protocol=tcp dst-port=22 action=accept place-before=([get ([find chain=input && connection-state ~ "established"]->0)]->".nextid") This places the rule after it. It makes use of the .nextid property of the entry to get the internal id of the next item in the list. This also works when the rule is the last one in the chain, because the .nextid property will then automatically receive the maximum internal id reference *ffffffff.
The above oneliner assumes that a specific rule already exists, otherwise this command will fail. So to be secure you normally want to do a check if the rule exists:
{
:local rule ([/ip firewall filter find chain=input && connection-state ~ "established"]->0)
:if ($rule) do={
/ip firewall filter add chain=input protocol=tcp dst-port=22 action=accept place-before=([get $rule]->".nextid")
} else={
:error "Rule not found!"
}
}Regards @colinardo
Auf Facebook teilen
Auf X (Twitter) teilen
Auf Reddit teilen
Auf Linkedin teilenBitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben
Content-ID: 673086
Url: https://administrator.de/tutorial/mikrotik-scripting-using-the-place-before-parameter-to-place-fw-rule-after-other-rule-673086.html
Ausgedruckt am: 30.05.2025 um 01:05 Uhr
Serie: Mikrotik Scripting
Mikrotik Scripting - Router-Log schnell nach Zeit filternMikrotik Scripting - Quickly filter Router-Log by datetime (englisch)Mikrotik Scripting - Parameter "place-before" nutzen um FW-Regeln "nach" anderen anzulegenMikrotik Scripting: Using the "place-before" parameter to place fw rule "after" other rule (englisch)Mikrotik Scripting: Resolve Domain to IPv6 Address (englisch)1Mikrotik Scripting: Domain zu IPv6 Adresse(n) auflösen1
