/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
    tcp-close-wait-timeout=10s tcp-established-timeout=1d \
    tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
    tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=drop chain=forward comment="" disabled=no src-address=85.17.92.151
add action=accept chain=forward comment="" disabled=no dst-port=5060 \
    protocol=udp src-address=196.x.x.x
add action=drop chain=forward comment="" disabled=no dst-port=5060 protocol=\
    udp
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="Port scanners to list " \
    disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
    disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="SYN/FIN scan" disabled=no \
    protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="SYN/RST scan" disabled=no \
    protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" disabled=\
    no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="ALL/ALL scan" disabled=no \
    protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="NMAP NULL scan" disabled=no \
    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" disabled=no \
    src-address-list="port scanners"
add action=accept chain=input comment="Accept established connections" \
    connection-state=established disabled=no
add action=accept chain=input comment="Accept related connections" \
    connection-state=related disabled=no
add action=drop chain=input comment="Drop invalid connections" \
    connection-state=invalid disabled=no
add action=accept chain=input comment=UDP disabled=no protocol=udp
add action=accept chain=input comment="Allow limited pings" disabled=no \
    limit=50/5s,2 protocol=icmp
add action=drop chain=input comment="Drop excess pings" disabled=no protocol=\
    icmp
add action=accept chain=input comment="SSH for secure shell" disabled=no \
    dst-port=22 protocol=tcp
add action=accept chain=input comment=dtv disabled=no dst-port=12000 \
    protocol=tcp
add action=accept chain=input comment=radius disabled=no dst-port=1812 \
    protocol=udp
add action=accept chain=input comment=radius disabled=no dst-port=1813 \
    protocol=udp
add action=accept chain=input comment=radius disabled=no dst-port=8181 \
    protocol=tcp
add action=accept chain=input comment=winbox disabled=no dst-port=8291 \
    protocol=tcp
add action=accept chain=input comment="From lan network" disabled=no \
    src-address=192.168.0.0/16
add action=accept chain=input comment="From our private LAN" disabled=no \
    src-address=10.0.0.0/8
add action=log chain=input comment="Log everything else" disabled=no \
    log-prefix="DROP INPUT"
/ip firewall nat
add action=masquerade chain=srcnat comment="" disabled=no
add action=dst-nat chain=dstnat comment=voip disabled=no dst-port=5060 \
    protocol=udp to-addresses=192.168.1.218 to-ports=5060
add action=dst-nat chain=dstnat comment=dtv disabled=no dst-port=12000 \
    protocol=tcp to-addresses=192.168.20.200 to-ports=12000
add action=dst-nat chain=dstnat comment=radiusbox disabled=no dst-port=8181 \
    protocol=tcp to-addresses=10.0.200.2 to-ports=80
add action=dst-nat chain=dstnat comment=radiusbox disabled=no dst-port=22 \
    protocol=tcp to-addresses=10.0.200.2 to-ports=22
add action=dst-nat chain=dstnat comment=radiusbox disabled=no dst-address=\
    41.x.x.x protocol=udp to-addresses=10.0.200.2 to-ports=1812
add action=dst-nat chain=dstnat comment=radiusbox disabled=no dst-port=1813 \
    protocol=udp to-addresses=10.0.200.2
add action=dst-nat chain=dstnat comment=radiusbox disabled=no dst-port=1700 \
    protocol=udp to-addresses=10.0.200.2
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no