Не забываем, что перед назначением правил нужно добавить LAN и WAN в интерфейс лист.

/ip firewall filter
add action=drop chain=input comment="drop invalid" connection-state=invalid \
in-interface-list=WAN
add action=accept chain=input comment="accept established,related,untracked" \
connection-state=established,related,untracked in-interface-list=WAN
add action=accept chain=input comment="accept ICMP" in-interface-list=WAN \
protocol=icmp
add action=drop chain=input comment="drop pptp brute forcers" dst-port=1723 \
in-interface-list=WAN protocol=tcp src-address-list=pptp_blacklist
add action=add-src-to-address-list address-list=pptp_blacklist \
address-list-timeout=1w3d chain=input connection-state=new dst-port=1723 \
in-interface-list=WAN protocol=tcp src-address-list=pptp_stage3
add action=add-src-to-address-list address-list=pptp_stage3 \
address-list-timeout=1m chain=input connection-state=new dst-port=1723 \
in-interface-list=WAN protocol=tcp src-address-list=pptp_stage2
add action=add-src-to-address-list address-list=pptp_stage2 \
address-list-timeout=1m chain=input connection-state=new dst-port=1723 \
in-interface-list=WAN protocol=tcp src-address-list=pptp_stage1
add action=add-src-to-address-list address-list=pptp_stage1 \
address-list-timeout=1m chain=input connection-state=new dst-port=1723 \
in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="PPTP" dst-port=1723 in-interface-list=\
WAN protocol=tcp
add action=drop chain=input comment="Drop WinBox" dst-port=8291 \
in-interface-list=WAN protocol=tcp src-address-list=black_list time=\
0s-1d,sun,mon,tue,wed,thu,fri,sat
add action=add-src-to-address-list address-list=black_list \
address-list-timeout=1d chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN protocol=tcp src-address-list=Winbox_stage3
add action=add-src-to-address-list address-list=Winbox_stage3 \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN protocol=tcp src-address-list=Winbox_stage2
add action=add-src-to-address-list address-list=Winbox_stage2 \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN protocol=tcp src-address-list=Winbox_stage1
add action=add-src-to-address-list address-list=Winbox_stage1 \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="Allow winbox" dst-port=8291 \
in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=OVPN dst-port=1194 in-interface-list=\
WAN protocol=tcp
add action=accept chain=input comment=L2TP+IPsec in-interface-list=WAN port=\
1701,500,4500 protocol=udp
add action=accept chain=input in-interface-list=WAN protocol=ipsec-esp
add action=accept chain=forward comment="accept in ipsec policy" \
in-interface-list=WAN ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" \
ipsec-policy=out,ipsec out-interface-list=WAN
add action=drop chain=input comment="drop all not coming from LAN" \
in-interface-list=!LAN
add action=fasttrack-connection chain=forward comment=fasttrack \
connection-state=established,related
add action=accept chain=forward comment=\
"accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN