No firewall rules on the input chain: your router accepts every connection
The input chain is the firewall that protects the router itself. When it is empty, every service on the device — Winbox, SSH, the API, DNS — is open to whoever can reach the WAN port. This is the single most serious finding the audit can report.
/ip firewall filter
What the audit found
Your configuration has no active rules in the input chain of the IP firewall filter. Rules that exist but are disabled do not count, and neither do rules in other chains.
RouterOS behaves like most routers: if nothing says "drop", the packet is accepted. With an empty input chain the router accepts every connection addressed to it, on every interface, from everyone — including the internet side.
The audit rates this critical on a device that routes traffic between networks (it has a WAN interface, does NAT, or has addresses in several subnets). On a device that only acts as a switch or access point behind another router, the same state is reported as informational, because the router in front of it is doing the filtering.
Why it matters
A router with no input firewall is not "slightly less secure" — it has no protection at all. Everything that is enabled on the device is reachable from outside: Winbox, SSH, the web interface, the API, FTP, Telnet, the DNS resolver, SNMP, bandwidth test. Most of those are enabled by default.
That makes every other finding in your report worse. A weak password becomes a takeover. An outdated RouterOS version with a known bug becomes an exploit that works. An enabled DNS resolver becomes an open resolver that gets your address blacklisted for taking part in DDoS attacks.
This is also the state the MikroTik botnets of 2018–2021 fed on: they did not need anything clever, just a reachable management port and a known bug or a guessable password.
What it looks like in Winbox
Open IP → Firewall → Filter Rules. Look at the Chain column. If there is no rule with chain input — or the only ones are greyed out (disabled) — this is your situation.
A healthy router shows at least four input rules: accept established/related, drop invalid, accept ICMP, and a final rule that drops everything that did not come from the LAN.
How to fix it
The fix is to give the router the basic input chain that the factory default ships with. It rests on one prerequisite: an interface list naming your LAN-side interfaces (the bridge, your VLANs, or the ports your devices hang off), created under Interfaces → Interface List. Every rule that follows refers to that list rather than to a specific port, so the rules keep working if the WAN ever moves.
The chain itself is four rules, and their order is the whole point. First, accept packets that belong to connections the router already knows about, so existing sessions keep flowing. Second, drop packets in the invalid connection state — malformed traffic that belongs to nothing. Third, accept ICMP, which troubleshooting and path MTU discovery depend on. Last, drop everything arriving on an interface that is not in the LAN list — which is your WAN. If some service genuinely must be reachable from the internet, such as a VPN endpoint, it gets its own accept rule for that exact protocol and port above the final drop. Do not open ports "just in case".
Make the change with Safe Mode switched on in Winbox; if a mistake cuts your own session, the router rolls it back. Afterwards, try to reach your public IP with Winbox or SSH from a network that is not your LAN — a phone on mobile data is enough — and confirm it times out. Then re-run the audit: this finding disappears and several dependent findings about exposed services should drop in severity too.
The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.
FAQ
I have NAT (masquerade). Doesn't that protect the router?
No. NAT hides the devices behind the router; it does nothing for the router itself. The router's own address is public, and its services listen on it.
The default configuration had firewall rules. Where did they go?
Many people reset the router with "no default configuration" to start from a clean slate, or remove the rules while troubleshooting and never put them back. Restoring the four rules described above gives you the same protection the factory default provides; the report lists them exactly.
Will the final drop rule block my own port forwards?
No. Port forwards (dst-nat) go through the forward chain, not the input chain. The input chain only concerns traffic addressed to the router itself.
This article explains the finding in general terms. Test any configuration change with Safe Mode enabled in Winbox. MKRouterKit analyses configuration exports only; it does not replace an external port scan or a professional penetration test.