WIP default mikrotik Firewall

/ip firewall filter
add action=accept chain=input comment="Allow established & related (Input chain)" \
    connection-state=established,related
add action=drop chain=input comment=\
    "Drop invalid packets (Input chain)" \
    connection-state=invalid
add action=accept chain=input comment=\
    "Allow WireGuard VPN" dst-port=13231 \
    protocol=udp src-address-list=!private_ip_range
add action=accept chain=input comment=\
    "Allow DHCP service from LAN" dst-port=\
    67,68 protocol=udp src-address-list=private_ip_range
add action=accept chain=input comment=\
    "Allow DNS queries from LAN" dst-port=53 \
    protocol=udp src-address-list=private_ip_range
add action=accept chain=input comment=\
    "Allow access from trusted LAN" \
    src-address-list=Trusted-IPs_LAN
add action=accept chain=input comment=\
    "Allow from trusted Public IPs" \
    src-address-list=Trusted-IPs
add action=accept chain=input comment=\
    "Allow all loopback (lo) interface traffic" in-interface=lo
add action=accept chain=input comment=\
    "Allow local UDP broadcasts" dst-address-type=\
    broadcast protocol=udp src-address-list=private_ip_range
add action=accept chain=input comment=\
    "ICMP packets rate limited" limit=\
    100,10:packet protocol=icmp
add action=drop chain=input comment=\
    "Drop excessive ICMP packets" protocol=\
    icmp
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=1w chain=input comment=\
    "Port-Scanner detection" protocol=tcp \
    psd=21,3s,3,1
add action=add-src-to-address-list address-list=blacklist \
    address-list-timeout=1w chain=input comment=\
    "Brute-force detection" connection-state=\
    new dst-port=21-23,53,80,443,161,8291,3389,8728-8729,54321,6379 protocol=\
    tcp src-address-list=!Trusted-IPs
add action=drop chain=input comment="Silently drop UDP 6537 broadcasts (no log\
    )" dst-address=255.255.255.255 dst-port=\
    6537 in-interface=bridge.30_untrusted protocol=udp
add action=drop chain=input comment=\
    "Silent Input Drop NAT-PMP" dst-port=5351 \
    protocol=udp
add action=drop chain=input comment=\
    "Silent Input Drop IGMP" protocol=igmp
add action=log chain=input comment=\
    "Log dropped Input packets" log-prefix=\
    "INPUT DROP: "
add action=drop chain=input comment=\
    "Default Input Drop"
add action=accept chain=forward comment="Allow established & related (Forward chain)" \
    connection-state=established,related
add action=drop chain=forward comment=\
    "Drop invalid forwarded packets" \
    connection-state=invalid
add action=jump chain=forward comment=\
    "Jump to SYN Flood Protection" \
    connection-state=new jump-target=SYN-Flood-Protect protocol=tcp
add action=return chain=SYN-Flood-Protect comment=\
    "Allow SYN within limit" limit=\
    2k,5:packet protocol=tcp
add action=drop chain=SYN-Flood-Protect comment=\
    "Drop excessive SYN packets"
add action=jump chain=forward comment=\
    "Jump to detect DDoS" connection-state=\
    new jump-target=Detect-DDoS
add action=return chain=Detect-DDoS comment=\
    "Allow trusted IPs through DDoS check" \
    src-address-list=Trusted-IPs
add action=return chain=Detect-DDoS comment=\
    "Allow traffic under DDoS threshold" \
    dst-limit=3000,6000,src-and-dst-addresses/5s
add action=add-src-to-address-list address-list=ddos_attackers \
    address-list-timeout=1d chain=Detect-DDoS comment=\
    "Track DDoS attackers"
add action=add-dst-to-address-list address-list=ddos_targets \
    address-list-timeout=1d chain=Detect-DDoS comment=\
    "Track DDoS targets"
add action=drop chain=Detect-DDoS comment=\
    "Drop identified DDoS attack traffic"
add action=accept chain=forward comment=\
    "Allow WireGuard VPN forwarding" \
    in-interface=wireguard
add action=accept chain=forward comment=\
    "Allow LAN to WAN internet forwarding" \
    dst-address-list=!private_ip_range src-address-list=private_ip_range
add action=jump chain=forward comment=\
    "Jump to Private-to-Private checks" \
    dst-address-list=private_ip_range jump-target=Private_to_Private \
    src-address-list=private_ip_range
add action=drop chain=Private_to_Private comment="Drop all unauthorized inter-\
    VLAN communication"
add action=drop chain=forward comment="Default drop all other forwarded traffi\
    c"
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
    "Hairpin NAT marking" dst-address-list=\
    WAN_IPs new-connection-mark="Hairpin NAT" passthrough=no \
    src-address-list=private_ip_range
/ip firewall nat
add action=masquerade chain=srcnat comment="WAN Masquerade NAT" \
    out-interface=pppoe1
add action=masquerade chain=srcnat comment="Hairpin NAT" connection-mark=\
    "Hairpin NAT"
## if wanted, force dns to router I use https://nextdns.io/?from=c92dff8f so I do use this for dumb IoT devices
## add action=dst-nat chain=dstnat comment="Force DNS to Router UDP" dst-port=53 \
    protocol=udp src-address-list=private_ip_range to-addresses=PRIVATE_MAIN_IP
## add action=dst-nat chain=dstnat comment="Force DNS to Router TCP" dst-port=53 \
    protocol=tcp src-address-list=private_ip_range to-addresses=PRIVATE_MAIN_IP
/ip firewall raw
add action=drop chain=prerouting comment=\
    "Early drop blacklisted IPs" \
    src-address-list=blacklist
add action=drop chain=prerouting comment=\
    "Early drop scanners" src-address-list=\
    port_scanners
add action=drop chain=prerouting comment=\
    "Early drop unwanted geo IPs" \
    src-address-list=IP2Location