In MikroTik firewall, which chain handles traffic that is destined for the router itself?

• A. forward
• B. output
• C. prerouting
• D. input

Answer: (D)

Traffic addressed to the router itself is processed by the input chain. This chain handles packets whose destination is the router’s own IP on any interface, such as management connections (Winbox, SSH, API) or ICMP to the router. The forward chain deals with traffic being routed through the device from one network to another, not addressed to the router. The output chain is for traffic generated by the router itself going out to the network. (In NAT/mangle contexts, prerouting handles incoming packets before the routing decision, and postrouting handles outgoing packets after the decision.)