Which statement correctly matches the two RouterOS firewall sections with their chains?

• A. Filter uses Forward, Input, Output; NAT uses src-nat, dst-nat
• B. Filter uses src-nat, dst-nat; NAT uses Forward, Input, Output
• C. Filter uses Masquerade and Jump; NAT uses Source and Destination
• D. NAT uses Jump and Return; Filter uses Forward and Drop

Answer: (A)

In RouterOS, firewall rules are organized into two sections with different purposes and chain concepts. The Filter section handles general packet filtering and uses the chains that describe where a packet is in its journey: input for traffic destined to the router, forward for traffic passing through the router, and output for traffic generated by the router itself. The NAT section deals with address translation and uses the NAT actions src-nat (source NAT) and dst-nat (destination NAT) to rewrite addresses as packets enter or leave the network. So, the correct pairing is that Filter uses Forward, Input, and Output, while NAT uses src-nat and dst-nat. The other options mix these roles, which doesn’t align with how RouterOS structures firewall rules.