/ip firewall filter
add action=drop chain=input connection-state=invalid disabled=no
add action=accept chain=forward disabled=no protocol=icmp
add action=accept chain=forward disabled=no dst-address-list=local_nets \
    src-address-list=local_nets
add action=accept chain=input disabled=no dst-address-list=local_nets \
    src-address-list=local_nets
add action=accept chain=input connection-state=established disabled=no
add action=accept chain=input connection-state=related disabled=no
add action=accept chain=input disabled=no protocol=gre
add action=accept chain=input comment=gre disabled=no dst-port=1723 protocol=\
    tcp
add action=accept chain=input disabled=no limit=50/5s,2 protocol=icmp
add action=drop chain=input disabled=no protocol=icmp
add action=accept chain=input disabled=no dst-port=8291 protocol=tcp
add action=accept chain=input disabled=no protocol=udp
add action=drop chain=input comment=Portscan disabled=no dst-port=21,22,23 \
    protocol=tcp
add action=accept chain=input disabled=yes dst-port=\
    80,8080,3128,443,85,465,995,2083,2081 protocol=tcp
add action=accept chain=forward disabled=no dst-port=\
    80,443,85,465,995,2083,2081 protocol=tcp
add action=drop chain=input disabled=no in-interface="1 ISP"


/ip firewall nat
add action=accept chain=dstnat comment="WEB-\F2\F0\E0\F4\E8\EA \E2\ED\F3\F2\F0\
    \E8 \F1\E5\F2\E8 \E1\E5\E7 \EF\F0\EE\EA\F1\E8" disabled=no \
    dst-address-list=local_nets dst-port=80 protocol=tcp src-address-list=\
    local_nets to-ports=8080
add action=redirect chain=dstnat comment="proxy redirect" disabled=no dst-port=\
    80 protocol=tcp to-ports=8080
add action=masquerade chain=srcnat comment=Internet disabled=no out-interface=\
    "1 ISP"
add action=dst-nat chain=dstnat disabled=no dst-address=Y.Y.Y.Y dst-port=\
    3389 in-interface="1 ISP" protocol=tcp to-addresses=192.168.4.10

local_nets=192.168.0.0/20






