/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input dst-port=53,123 in-interface=eth1-wan protocol=udp
add action=drop chain=input dst-port=53,123 in-interface=eth1-wan protocol=tcp
add action=drop chain=input connection-state=new dst-port=123 in-interface=\
    eth1-wan log-prefix=" " protocol=udp
add action=drop chain=input connection-state=new dst-port=123 in-interface=\
    eth1-wan log-prefix=" " protocol=tcp
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=redirect chain=dstnat dst-port=53 in-interface-list=LAN protocol=udp
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
    out,none out-interface-list=WAN
/ip firewall raw
add action=jump chain=prerouting dst-port=53 in-interface-list=WAN jump-target=\
    DNS-Flood-TCP-RAW protocol=tcp
add action=jump chain=prerouting dst-port=53 in-interface-list=WAN jump-target=\
    DNS-Flood-UDP-RAW protocol=udp
add action=add-src-to-address-list address-list=Attack-from-WAN \
    address-list-timeout=1d chain=DNS-Flood-TCP-RAW
add action=add-src-to-address-list address-list=Attack-from-WAN \
    address-list-timeout=1d chain=DNS-Flood-UDP-RAW
add action=drop chain=DNS-Flood-TCP-RAW
add action=drop chain=DNS-Flood-UDP-RAW
add action=drop chain=prerouting comment="sbl dshield" src-address-list=\
    "sbl dshield"
add action=drop chain=prerouting comment="sbl spamhaus" src-address-list=\
    "sbl spamhaus"
add action=drop chain=prerouting comment="sbl blocklist.de" src-address-list=\
    "sbl blocklist.de"