Базовые правила Firewall Mikrotik, например для импорта на CHR.

Чтобы правила сработали в системе надо сначала сделать WAN и LAN интерфейс листы, добавив в них нужные интерфейсы.

/ip firewall filteradd action=accept chain=input comment=»defconf: accept established,related,untracked» connection-state=established,related,untracked

add action=drop chain=input comment=»defconf: drop invalid» connection-state=invalid

add action=accept chain=input comment=»defconf: accept ICMP» protocol=icmp

add action=drop chain=input comment=»defconf: drop all not coming from LAN» in-interface-list=!LAN

add action=accept chain=forward comment=»defconf: accept in ipsec policy» ipsec-policy=in,ipsec

add action=accept chain=forward comment=»defconf: accept out ipsec policy» ipsec-policy=out,ipsec

add action=fasttrack-connection chain=forward comment=»defconf: fasttrack» connection-state=established,related

add action=accept chain=forward comment=»defconf: accept established,related, untracked» connection-state=established,related,untracked

add action=drop chain=forward comment=»defconf: drop invalid» connection-state=invalidadd action=drop chain=forward comment=»defconf: drop all from WAN not DSTNATed» connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall natadd action=masquerade chain=srcnat comment=»defconf: masquerade» ipsec-policy=out,none out-interface-list=WAN