I’d love for the firewall to automatically open ports matching NAT entries.
If I NAT port 80 in ether1 to an on ether2, I’d like to see a firewall rule dynamically created that is in-interface-ether1, port 80.
Why? You can already do:
/ip firewall filter
add action=accept chain=forward connection-nat-state=dstnat
It will allow any dstnatted connection, which may sound dangerous but no connection can get this state, unless it’s processed by dstnat, so it doesn’t open any security holes. What would be the advantage of suggested feature compared to this?
You can use this FW rule to accept all NATed connections:
/ip firewall filter
add chain=forward connection-nat-state=dstnat action=accept
EDIT: damn, Sob beat me to it 
How did I not know this!
It’s relatively new (since 6.22, according to changelog). Well, that was in 2014, but still…