# apr/26/2018 22:04:59 by RouterOS 6.42.1
# software id = DWAX-NGE6
#
# model = 951Ui-2HnD
# serial number = 7175066182B6
/ip firewall address-list
add address=192.168.1.96 list=no_unet_users
/ip firewall filter
add action=accept chain=input comment="Permit ICMP" protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input comment="Permit established" connection-state=\
    established protocol=tcp
add action=accept chain=forward connection-state=established protocol=tcp
add action=accept chain=input comment="Permit related" connection-state=\
    related
add action=accept chain=forward connection-state=related
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=accept chain=input comment="Permit UDP" protocol=udp
add action=accept chain=forward protocol=udp
add action=accept chain=input comment="Permit to WinBox" dst-port=8291 \
    protocol=tcp src-address-list=192.168.1.0/24
add action=accept chain=forward comment="Allow local traffic" in-interface=\
    bridge-lan1 src-address=192.168.1.0/24
add action=accept chain=forward dst-address=109.167.153.217 in-interface=\
    bridge-lan1
add action=accept chain=input in-interface=bridge-lan1 src-address=\
    192.168.1.0/24
add action=reject chain=forward comment="Deny to inet for bad_users" \
    disabled=yes out-interface=ether1-wan protocol=tcp reject-with=tcp-reset \
    src-address-list=no_unet_users
add action=drop chain=forward disabled=yes out-interface=ether1-wan \
    src-address-list=no_unet_users
add action=drop chain=input comment="Drop all input" in-interface=ether1-wan
add action=drop chain=forward in-interface=ether1-wan
add action=drop chain=forward comment="Drop other"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-wan