/ip firewall filter
add action=drop chain=forward disabled=no protocol=tcp src-address=\
    192.168.1.251
add action=drop chain=input comment="\C7\E0\EF\F0\E5\F2\E8\F2\FC \ED\E5\F1\F2\E0\
    \ED\E4\E0\F0\F2\ED\FB\E5 \EF\E0\EA\E5\F2\FB" connection-state=invalid \
    disabled=no
add action=accept chain=forward disabled=no protocol=icmp
add action=accept chain=forward comment="\D2\F0\E0\ED\E7\E8\F2 \EC\E5\E6\E4\F3 \
    \EB\EE\EA\E0\EB\FC\ED\FB\EC\E8 \F1\E5\F2\FF\EC\E8" disabled=no \
    dst-address-list=Local_nets src-address-list=Local_nets
add action=accept chain=input comment="\CC\E5\F1\F2\ED\FB\E5 \EF\EE\E4\EA\EB\FE\
    \F7\E5\ED\E8\FF \E2 \EF\F0\E5\E4\E5\EB\E0\F5 \EB\EE\EA\E0\EB\FC\ED\FB\F5 \F1\
    \E5\F2\E5\E9" disabled=no dst-address-list=Local_nets src-address-list=\
    Local_nets
add action=accept chain=input comment="\E8\ED\F2\E5\F0\ED\E5\F2" \
    connection-state=established disabled=no
add action=accept chain=input connection-state=related disabled=no
add action=accept chain=input comment=VPN/PPTP disabled=no protocol=gre
add action=accept chain=input disabled=no dst-port=1723 protocol=tcp
add action=accept chain=input comment="PING \EE\E3\F0\E0\ED\E8\F7\E5\ED\E8\E5 \
    \F7\E0\F1\F2\EE\F2\FB \E8 \EA\EE\EB\E8\F7\E5\F1\F2\E2\E0 \E7\E0\EF\F0\EE\F1\
    \EE\E2" disabled=no limit=50/5s,2 protocol=icmp
add action=drop chain=input disabled=no protocol=icmp
add action=accept chain=input comment=WinBox disabled=no dst-port=8291 \
    protocol=tcp
add action=accept chain=input disabled=no protocol=udp
add action=drop chain=input comment="\CF\EE\E4\EA\EB\FE\F7\E5\ED\E8\FF \E8\E7\E2\
    \ED\E5 \EF\EE SSH, FTP \EA \F8\EB\FE\E7\F3" disabled=no dst-port=21,22,23 \
    protocol=tcp
add action=accept chain=forward comment=\
    "\E8\ED\F2\E5\F0\ED\E5\F2, SSL, \C0\F1\F2\F0\E0\EB" disabled=no dst-port=\
    80,443,85 protocol=tcp
add action=drop chain=input comment=\
    "\C2\F1\B8 \EE\F1\F2\E0\EB\FC\ED\EE\E5 \ED\E0\F4\E8\E3" disabled=no \
    in-interface="1 -INET DON"

/ip firewall nat
add action=accept chain=dstnat comment="WEB-\F2\F0\E0\F4\E8\EA \E2\ED\F3\F2\F0\
    \E8 \F1\E5\F2\E8 \E1\E5\E7 \EF\F0\EE\EA\F1\E8" disabled=no \
    dst-address-list=Local_nets dst-port=80 protocol=tcp src-address-list=\
    Local_nets to-ports=8080
add action=redirect chain=dstnat disabled=no dst-port=80 protocol=tcp to-ports=\
    8080
add action=masquerade chain=srcnat comment="default configuration" disabled=no \
    out-interface="1 -INET DON" to-addresses=0.0.0.0
add action=dst-nat chain=dstnat disabled=no dst-address=X.X.X.X \
    dst-port=3389 in-interface="1 -INET DON" protocol=tcp to-addresses=\
    192.168.0.33

local_nets=192.168.0.0/20