0    ;;; Accept established connections
      chain=input action=accept connection-state=established log=no log-prefix=""

 1    chain=forward action=accept connection-state=established log=no log-prefix=""

 2    ;;; Accept related connections
      chain=input action=accept connection-state=related log=no log-prefix=""

 3    chain=forward action=accept connection-state=related

 4    ;;; Drop invalid connections
      chain=input action=drop connection-state=invalid log=no log-prefix=""

 5    chain=forward action=drop connection-state=invalid log=no log-prefix=""

 6    ;;; Allow UDP
      chain=input action=accept protocol=udp log=no log-prefix=""

 7    chain=forward action=accept protocol=udp log=no log-prefix=""

 8    ;;; Access to Internet from local network
      chain=forward action=accept src-address=10.37.0.0/24 in-interface=lan log=no log-prefix=""

 9    ;;; Access to Mikrotik only from our local network
      chain=input action=accept src-address=10.37.0.0/24 log=no log-prefix=""

10    ;;; All other drop
      chain=input action=drop log=no log-prefix=""

11    chain=forward action=drop log=no log-prefix=""

chain=forward action=accept dst-address=10.37.0.30 log=no log-prefix=""

/ip address
add address=10.37.0.0/24 interface=ether1 network=10.37.0.1
#адрес поменяйте на свой

/ip firewall filter
add chain=input comment="allow winbox admin" dst-port=8291 in-interface=ether1 protocol=tcp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=tcp comment="Drop DNS"
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp comment="Drop DNS udp"
add chain=input comment="defconf: accept establieshed,related" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=ether1

/ip route
add distance=1 gateway=10.37.0.1
#поменяйте на свой