Is the order of firewall rules important in the RouterOS firewall?

• A. Yes, they are sequential
• B. No, order does not matter
• C. Only in NAT rules matters
• D. Depends on the interface

Answer: (A)

Packets are checked in RouterOS firewall rules from top to bottom within each chain. The first rule that matches determines the action to take (accept, drop, jump, etc.), and processing typically stops for that chain unless you’ve jumped to another chain or explicitly continued elsewhere. This means the order you place rules matters a lot: a broad allow at the top can let through traffic you later intended to block, while a specific deny placed above a general allow will correctly block that traffic before it’s evaluated by the broader rule. The same sequential evaluation applies to NAT rules in their prerouting and postrouting chains, where the topmost matching rule governs the NAT action.