/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
    established,related protocol=tcp
add action=fasttrack-connection chain=forward connection-state=\
    established,related protocol=udp
add action=accept chain=forward connection-state=established,related
add action=accept chain=input comment="Allow ping" connection-state=\
    established,related in-interface-list=WAN protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input connection-state=new protocol=tcp src-port=8291
add action=accept chain=input comment="Allow est+rel -invalid" \
    connection-state=established,related
add action=drop chain=input connection-state=invalid
add action=accept chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=input
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" \
    out-interface=ether4-wan
/ip firewall service-port