====== Пример firewall ======
<code bash>/ip firewall filter
add action=accept chain=input comment="Accept input icmp" in-interface-list=WAN protocol=icmp
add action=accept chain=forward in-interface-list=WAN protocol=icmp
add action=add-src-to-address-list address-list=ddos-blacklist address-list-timeout=1h chain=input comment="Protection from DDoS - 100 connection Limit" connection-limit=100,32 \
    in-interface-list=WAN limit=1,5:packet log=yes log-prefix=ddos_connection_limit
add action=add-src-to-address-list address-list=web-ddos-blacklist address-list-timeout=1h chain=input comment="Protection from DDoS web - Connection Limit 50" connection-limit=50,32 \
    dst-port=80,443 in-interface-list=WAN log=yes log-prefix=ddos_web_connection_limit protocol=tcp
add action=add-src-to-address-list address-list=l2tp_blacklist address-list-timeout=none-dynamic chain=input comment="Drop L2TP brute forcers" connection-state=new dst-port=1701,500,4500 \
    in-interface-list=WAN log=yes log-prefix=hack_l2tp protocol=tcp
add action=accept chain=input comment="Accept OVPN" dst-port=666 in-interface-list=WAN protocol=tcp
add action=add-src-to-address-list address-list=ovpn_blacklist address-list-timeout=none-dynamic chain=input comment="Drop OVPN brute forcers" connection-state=new dst-port=666 \
    in-interface-list=WAN log=yes protocol=tcp
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="Port scanners to list" in-interface-list=WAN log=yes log-prefix=port_scan protocol=\
    tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=drop_sec_ports address-list-timeout=none-dynamic chain=input comment="Drop all connections on not security ports" dst-port=\
    20,21,22,23,53,110,1194,5060,5222,8080,8291 in-interface-list=WAN protocol=tcp
add action=add-src-to-address-list address-list=winbox_blacklist address-list-timeout=none-dynamic chain=input comment="Drop WINBOX brute forcers" connection-state=new dst-port=4519 \
    in-interface-list=WAN log=yes log-prefix=hack_winbox protocol=tcp
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=none-dynamic chain=input comment="Drop SSH brute forcers" connection-state=new dst-port=27112 \
    in-interface-list=WAN log=yes log-prefix=hack_ssh protocol=tcp
add action=add-src-to-address-list address-list=mail_blacklist address-list-timeout=none-dynamic chain=input comment="Drop MAIL brute forcers" connection-state=new dst-port=25,465,587,993,995 \
    in-interface-list=WAN log=yes log-prefix=hack_mail protocol=tcp
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="NMAP FIN Stealth scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=\
    tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="SYN/FIN scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=tcp \
    tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="SYN/RST scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=tcp \
    tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="FIN/PSH/URG scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=tcp \
    tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="ALL/ALL scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=tcp \
    tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="NMAP NULL scan" in-interface-list=WAN log=yes log-prefix=port_scan protocol=tcp \
    tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" in-interface-list=WAN src-address-list=port_scanners
add action=drop chain=forward in-interface-list=WAN src-address-list=port_scanners
add action=drop chain=input connection-limit=10,32 in-interface-list=WAN protocol=tcp src-address-list=ddos-blacklist
add action=drop chain=input connection-limit=10,32 dst-limit=1,5,dst-address/1m40s dst-port=80,443 in-interface-list=WAN limit=1,5:packet protocol=tcp src-address-list=web-ddos-blacklist \
    time=0s-1d,sun,mon,tue,wed,thu,fri,sat
add action=drop chain=input dst-port=1701,500,4500 in-interface-list=WAN protocol=tcp src-address-list=l2tp_blacklist
add action=drop chain=input dst-port=666 in-interface-list=WAN protocol=tcp src-address-list=ovpn_blacklist
add action=drop chain=input dst-port=4519 in-interface-list=WAN protocol=tcp src-address-list=winbox_blacklist
add action=drop chain=input dst-port=27112 in-interface-list=WAN protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input dst-port=25,465,587,993,995 in-interface-list=WAN protocol=tcp src-address-list=mail_blacklist
add action=reject chain=input dst-port=20,21,22,23,53,110,1194,5060,5222,8080,8291 in-interface-list=WAN protocol=tcp reject-with=icmp-network-unreachable src-address-list=drop_sec_ports
add action=drop chain=input comment="Drop all input DNS" dst-port=53 in-interface-list=WAN protocol=udp
add action=accept chain=input comment="Accept L2TP" dst-port=1701,500,4500 in-interface-list=WAN protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=drop chain=input comment="Block Bogon IP Address" disabled=no in-interface-list=WAN src-address-list=BOGON
add action=drop chain=forward disabled=yes dst-address-list=BOGON
add action=drop chain=input comment="Block hole Windows" dst-port=135,137-139,445,593,4444,5000 protocol=tcp
add action=drop chain=forward dst-port=135,137-139,445,593,4444,5000 protocol=tcp
add action=drop chain=input dst-port=135,137-139 protocol=udp
add action=drop chain=forward dst-port=135,137-139 protocol=udp
add action=accept chain=input comment="Accept established & related connection" connection-state=established,related
add action=accept chain=forward comment="Accept forward established & related & new connection" connection-state=established,related,new
add action=accept chain=input comment="Accept mail port connections" connection-state=established,related,new dst-port=25,465,587,993,995 in-interface-list=WAN port="" protocol=tcp
add action=accept chain=input comment="Accept connections for LAN to WAN" in-interface-list=!WAN src-address=172.17.16.0/24
add action=drop chain=input comment="Drop all invalid connections" connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input in-interface-list=WAN
add action=accept chain=forward comment="Accept forward from LAN to WAN" in-interface-list=!WAN out-interface-list=WAN
add action=drop chain=forward comment="Drop all other connections"</code>