Hi CZFan thank you very much for your help and support.. I combined Steveocee advice and yours and here is result 
I hope this will help me to secure connection for Cpe and customer. thank you and Steveocee again.
/interface list add name=WAN
/interface list add name=LAN
/interface list member add interface=[/interface ethernet find] list=LAN
/interface list member add interface=[/interface pppoe-client find] list=WAN
/ip firewall address-list add address=10.10.10.30 comment="Admin" list=secureAdmin
/ip firewall filter
add action=accept chain=forward comment="ACCEPT established & related" connection-state=established,related
add action=accept chain=input comment="ACCEPT established & related" connection-state=established,related
add action=drop chain=forward comment="DROP invalid" connection-state=invalid
add action=drop chain=input comment="DROP invalid" connection-state=invalid
add action=accept chain=input comment="SecureConnection For Admin" src-address-list=admin
add action=accept chain=forward comment="SecureConnection For Admin" src-address-list=admin
add action=accept chain=forward comment="ACCEPT DST-NAT'D" connection-nat-state=dstnat in-interface-list=WAN
add action=accept chain=input comment="ACCEPT ICMP" in-interface-list=WAN protocol=icmp
/ip firewall filter add action=drop chain=input comment="drop connection for admin special ports" dst-port=22,23,8291,8728,8729 protocol=tcp
/ip firewall filter add action=drop chain=input comment="drop connection for Admin special ports" dst-port=22,23,8291,8728,8729 protocol=udp
/ip firewall filter add action=drop chain=forward comment="drop connection for Admin special ports" dst-port=22,23,8291,8728,8729 protocol=tcp
/ip firewall filter add action=drop chain=forward comment="drop connection for Admin special ports" dst-port=22,23,8291,8728,8729 protocol=udp
add action=drop chain=input comment="DROP ALL"
add action=drop chain=forward comment="DROP ALL"
/ip service disable telnet,ftp,www,api,api-ssl
/ip service set ssh port=2200
/ip service set address=10.10.10.30 [/ip service find]
/user set address=10.10.10.30 [/user find]
/tool bandwidth-server set enabled=no
/ip dns set allow-remote-requests=no
/ip proxy set enabled=no
/ip socks set enabled=no
/ip upnp set enabled=no
/ip cloud set ddns-enabled=no update-time=no
/ip ssh set strong-crypto=yes
/ip ssh set host-key-size=4096 strong-crypto=yes
/ip settings set rp-filter=strict
/ip firewall service-port disable [/ip firewall service-port find]