Mikrotik: Disconnect TCP Connection - Troubleshooting Guide

To disconnect a specific TCP connection on Mikrotik RouterOS, use the /ip firewall connection print command to identify the active session and then remove it using /ip firewall connection remove. This process is essential for clearing stale sessions that cause latency or for enforcing immediate policy changes without waiting for natural timeouts.

Identifying Active TCP Connections

Before you can terminate a connection, you must locate its unique identifier within the MikroTik state table. The firewall connection tracker maintains a dynamic list of all established flows passing through the router. By filtering this list, you can isolate the specific TCP stream that requires intervention. Run the following command in the Terminal or WinBox CLI to view active connections:

/ip firewall connection print where protocol=tcp

This output provides several critical columns. The id column contains the internal reference number needed for removal. The src-address and dst-address columns show the endpoints involved. The state column indicates whether the connection is established, syn-sent, or time-wait. For precise targeting, you should filter by source IP, destination port, or both. For example, if you need to find a connection from 192.168.0.50 to port 443, use:

/ip firewall connection print where src-address=192.168.0.50 dst-port=443 protocol=tcp

If multiple connections exist, the output will list them all. Note the ID at the beginning of the line corresponding to the target session. This ID is not the same as the socket port; it is an internal index managed by the connection tracking engine.

Removing the Connection via CLI

Once you have identified the correct connection ID, you can force the router to drop the session immediately. This action sends no graceful FIN packets to the endpoints unless specifically configured otherwise, which effectively kills the transport layer link. Use the remove action with the ids parameter. Replace YOUR_ID_HERE with the actual ID found in the previous step:

/ip firewall connection remove ids=YOUR_ID_HERE

Upon execution, the router deletes the entry from the connection table. Any subsequent packets belonging to this flow will be treated as new traffic and evaluated against your firewall rules again. If the connection was allowed, it may re-establish automatically. If it was blocked, the attempt will fail. You can also remove connections based on criteria rather than a specific ID. This is useful for bulk operations, such as clearing all connections from a suspicious IP address:

/ip firewall connection remove where src-address=10.0.0.5

Be cautious with broad filters. Removing all connections from a subnet may disrupt legitimate services like DHCP or DNS queries that rely on short-lived TCP interactions. Always verify the filter scope before executing a wildcard removal.

Graceful vs. Forceful Disconnection

MikroTik’s default behavior when removing a connection object is to drop it immediately. However, some applications require a graceful shutdown sequence to avoid data corruption or error states on the client side. While RouterOS does not have a direct "send FIN" command for arbitrary connections, you can influence behavior through firewall rules. To simulate a graceful close, you might insert a rule that drops outgoing packets for the specific flow, allowing the local endpoint to detect the loss and initiate its own teardown. Alternatively, adjusting the connection timeout settings can achieve similar results by forcing the router to age out the connection faster. Check current timeout settings using:

/ip firewall connection track print

Look for tcp-close-wait-timeout or tcp-established-timeout. Reducing these values forces older connections to expire sooner, freeing up resources. However, aggressive timeouts can lead to false positives for long-running idle connections, such as keep-alive probes in VoIP or streaming services.

Verifying the Disconnection

After executing the removal command, confirm that the connection no longer exists in the tracking table. Run the initial print command again with the same filters:

/ip firewall connection print where id=YOUR_ID_HERE

The command should return no results. If the connection persists, it may have been re-established instantly by an application retrying the handshake. In such cases, consider applying a temporary firewall drop rule to prevent reconnection while you investigate the root cause. Additionally, monitor system resources. Stale connections consume memory in the connection hash table. Regularly cleaning up orphaned flows improves overall routing performance, especially on devices handling high throughput. For related network management tasks, see How to Open a Port on Mikrotik: A Comprehensive Guide to understand how access controls interact with active sessions. Understanding segment communication is also vital, as detailed in Achieving TCP Communication Across Network Segments: IP Addresses 192.168.0.2 and 192.168.12.2.

Frequently Asked Questions

Will removing a TCP connection reset the device?

No, removing a connection only affects the specific tracked flow. It does not restart the router or clear other configuration settings. The rest of the network continues to operate normally.

Why do connections reappear after removal?

Applications often retry failed connections automatically. If the underlying issue causing the problem is not resolved, the client will simply establish a new session that appears identical to the old one.

Can I disconnect UDP connections using the same method?

Yes, the /ip firewall connection remove command works for any protocol tracked by the firewall, including UDP. Simply adjust the filter criteria to match protocol=udp.

What happens to ongoing downloads when I kill a TCP connection?

The download will fail immediately on the client side. Most modern browsers and download managers will either report an error or attempt to resume the transfer from the last successfully received byte, depending on server support.

Is there a way to log every removed connection?

RouterOS does not natively log individual connection removals via the CLI command. You would need to implement a script that monitors the connection table or use syslog forwarding from a custom script triggered by specific events.