Evaluasi Layering Firewall RAW-Filter untuk Mitigasi Trafik Berindikasi DDoS pada MikroTik RouterOS v6

Authors

  • Arif Rahmadi Wibowo Universitas Dian Nusantara, Indonesia
  • Desi Ramayanti Universitas Dian Nusantara, Indonesia

DOI:

https://doi.org/10.29240/arcitech.v6i2.17833

Keywords:

Mikrotik, Firewall Filter, Network Security, DDoS Mitigation, RAW Firewall, Stateful Filtering

Abstract

This study evaluates a layered MikroTik RouterOS v6 firewall configuration that combines the RAW and Filter tables to mitigate traffic patterns indicative of Distributed Denial of Service (DDoS) activity on a production edge router. Five sequential scenarios (S0-S4) were observed: normal baseline, unprotected high-load traffic, Filter only, RAW only, and RAW-Filter. Performance was described using CPU utilization, TCP SYN, UDP, and ICMP packet counters, and average latency. Relative to the unprotected scenario (S1), RAW-Filter (S4) reduced peak CPU utilization from 55% to 25% (54%), total SYN packets from 2,952 to 2,068 (30%), and total UDP packets from 484,054 to 55,746 (88%); total ICMP packets increased from 915 to 1,032 (12%), while average latency remained 24 ms. RAW only (S3), however, produced the lowest observed CPU load (7% average; 11% peak), indicating a trade-off between early dropping and the additional stateful policy enforcement provided by the layered configuration. Because the scenarios were executed sequentially on one production network and the manuscript does not report repeated randomized trials or inferential statistics, the findings should be interpreted as descriptive operational evidence rather than proof of statistically significant causal superiority. The study provides practical evidence for baseline-driven firewall tuning while identifying the need for controlled replication, dynamic thresholds, and broader service-availability metrics.

Downloads

Download data is not yet available.

References

Al Muzaki, D. F., Efendi, T. F., & Muqorobin. (2025). Penerapan jaringan hotspot berbasis Mikrotik menggunakan metode PPDIO (Prepare, Plan, Design, Implement, Operate, Optimize). Bulletin of Computer Science Research, 5(4), 490-502. https://doi.org/10.47065/bulletincsr.v5i4.592

Bisevac, S., Bojovic, Z., Bojovic, P. D., & Doknic, I. (2026). Closed-loop CPU-aware traffic control for SDN-enabled 5G/6G networks in Open vSwitch dataplanes. Smart Cities, 9(6), 91. https://doi.org/10.3390/smartcities9060091

Christanto, F. W., Cholillah, P., & Hirzan, A. M. (2025). Optimizing Mikrotik-based network security using address list, firewall filter rules, and raw firewall. Revista de Informatica Teorica e Aplicada, 32(3), 66-76. https://doi.org/10.22456/2175-2745.142954

Coscia, A., Dentamaro, V., Galantucci, S., Maci, A., & Pirlo, G. (2024). Automatic decision tree-based NIDPS ruleset generation for DoS/DDoS attacks. Journal of Information Security and Applications, 82, 103736. https://doi.org/10.1016/j.jisa.2024.103736

Dai, Y., Huang, T., & Wang, S. (2024). DAmpADF: A framework for DNS amplification attack defense based on Bloom filters and NAmpKeeper. Computers & Security, 139, 103718. https://doi.org/10.1016/j.cose.2024.103718

Fouladi, R. F., Ermis, O., & Anarim, E. (2022). A DDoS attack detection and countermeasure scheme based on DWT and auto-encoder neural network for SDN. Computer Networks, 214, 109140. https://doi.org/10.1016/j.comnet.2022.109140

Haris, A. I., Riyanto, B., Surachman, F., & Ramadhan, A. A. (2022). Analisis pengamanan jaringan menggunakan router Mikrotik dari serangan DoS dan pengaruhnya terhadap performansi. Komputika: Jurnal Sistem Komputer, 11(1), 67-76. https://doi.org/10.34010/komputika.v11i1.5227

Hnamte, V., Najar, A. A., Nhung-Nguyen, H., Hussain, J., & Naik, S. M. (2024). DDoS attack detection and mitigation using deep neural network in SDN environment. Computers & Security, 138, 103661. https://doi.org/10.1016/j.cose.2023.103661

'Ibad, M. I., Mahmud, W., & Wilujeng, G. (2026). Analysis of MikroTik firewall effectiveness in mitigating DDoS attacks using the Network Development Life Cycle (NDLC) approach. SISTEMASI, 15(5), 1731. https://doi.org/10.32520/stmsi.v15i5.6347

Li, Q., Huang, H., Li, R., Lv, J., Yuan, Z., Ma, L., Han, Y., & Jiang, Y. (2023). A comprehensive survey on DDoS defense systems: New trends and challenges. Computer Networks, 233, 109895. https://doi.org/10.1016/j.comnet.2023.109895

Lutfi, S., Khairan, A., Muin, Y., & Salmin, M. (2022). Optimal filter assignment policy against distributed denial of service attack on router Mikrotik. MATEC Web of Conferences, 372, 04008. https://doi.org/10.1051/matecconf/202237204008

Ma, J., Su, W., Li, Y., & Peng, Y. (2024). Synchronizing DDoS detection and mitigation based graph learning with programmable data plane, SDN. Future Generation Computer Systems, 154, 206-218. https://doi.org/10.1016/j.future.2023.12.033

MikroTik Documentation. (2025). Packet Flow in RouterOS. Last updated October 31, 2025. https://help.mikrotik.com/docs/spaces/ROS/pages/328227/Packet+Flow+in+RouterOS

MikroTik Documentation. (2026). Filter: RAW Filtering. https://help.mikrotik.com/docs/spaces/ROS/pages/48660574/Filter

Najar, A. A., & Naik, S. M. (2024). Cyber-Secure SDN: A CNN-based approach for efficient detection and mitigation of DDoS attacks. Computers & Security, 139, 103716. https://doi.org/10.1016/j.cose.2024.103716

Ribeiro, M. A., Fonseca, M. S. P., & de Santi, J. (2023). Detecting and mitigating DDoS attacks with moving target defense approach based on automated flow classification in SDN networks. Computers & Security, 134, 103462. https://doi.org/10.1016/j.cose.2023.103462

Riduan, M. A. O., Riska, & Alamsyah, H. (2025). Analisa dan implementasi keamanan jaringan berbasis Firewall RAW terhadap serangan DDoS pada router Mikrotik. Jurnal Media Infotama, 21(1), 317-328. https://doi.org/10.37676/jmi.v21i1.7835

Rokhman, M. N., Rizaldy, E. F., Abdullah, N., & Puspitasari, N. F. (2023). Implementasi firewall filter rule dan RAW sebagai metode pengamanan jaringan pada Perpustakaan XYZ. Jurnal Elektrosista, 11(1), 58-75. https://doi.org/10.63824/jtep.v11i1.142

Sitorus, M. A., Nasution, D., & Iqbal, M. (2025). Analisis efektivitas RAW Firewall Mikrotik dalam mitigasi serangan DDoS pada infrastruktur jaringan. Journal of Science and Social Research, 8(2), 3354-3358. https://doi.org/10.54314/jssr.v8i2.3930

Vladov, S., Scislo, L., Sachenko, A., Krupinski, J., Vysotska, V., Korniienko, M., Uhrovetskyi, O., Krykun, V., Levchenko, K., & Sachenko, A. (2026). Neural network method for detecting UDP flood attacks in critical infrastructure microgrid protection systems with law enforcement agencies' rapid response. Energies, 19(1), 209. https://doi.org/10.3390/en19010209

Wabi, A. A., Idris, I., Olaniyi, O. M., & Ojeniyi, J. A. (2024). DDoS attack detection in SDN: Method of attacks, detection techniques, challenges and research gaps. Computers & Security, 139, 103652. https://doi.org/10.1016/j.cose.2023.103652

Yungaicela, N. M., Vargas-Rosales, C., & Perez-Diaz, J. A. (2023). SDN/NFV-based framework for autonomous defense against slow-rate DDoS attacks by using reinforcement learning. Future Generation Computer Systems, 149, 637-649. https://doi.org/10.1016/j.future.2023.08.007

Zhao, Z., Li, Z., Zhou, Z., Yu, J., Song, Z., Xie, X., Zhang, F., & Zhang, R. (2024). DDoS family: A novel perspective for massive types of DDoS attacks. Computers & Security, 138, 103663. https://doi.org/10.1016/j.cose.2023.103663

Downloads

Published

22-10-2026

How to Cite

Arif Rahmadi Wibowo, & Desi Ramayanti. (2026). Evaluasi Layering Firewall RAW-Filter untuk Mitigasi Trafik Berindikasi DDoS pada MikroTik RouterOS v6. Arcitech: Journal of Computer Science and Artificial Intelligence, 6(2), 358–375. https://doi.org/10.29240/arcitech.v6i2.17833

Issue

Vol. 6 No. 2 (2026): December 2026

Section

Articles

Citation Check

License

Copyright (c) 2026 Arif Rahmadi Wibowo, Desi Ramayanti

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

Authors who publish with Arcitech: Journal of Computer science and Artificial Intelligence agree to the following terms:

  • Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0) that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
  • Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgment of its initial publication in this journal.
  • Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (See The Effect of Open Access).