firewall management best practice ... zones ... and interface groups ... and things

RouterOS General
1

dear friends and neighbors …
.
for a (relative) long time now I am using ROS .. mostly for routing stuff … wifi-ptp … service-network-dialin … testbeds … third-party-wifi-monitoring … ( and … yes … also just for fun )
…
… for a recent project … “a third man” come in to the equation … so I tried to enhance the default LAN / WAN-default firewall … to LAN / WAN / 3rd-MAN
and my firewall-rules … very early … became … … jzus!
.
thing is … how I can manage this … for me … and possible co-workers ? ( call me a spoiled f* … I like … fortigate … palo-alto … this kind of experience !!! )*
.
filtering views … and in config always tag an interface … !!!
.
I’m just looking … for practice examples … suggestions

*) years ago I had thing going called “linux-firewall-builder” for my open-vc container service-network … not bad … not optimal … … just mentioned to explain … my … its not a problem … just looking for input

2

Keep good default rules. Add admin required traffic flow rules. DROP all else in both input and forward chains.
Use interface lists for all subnets, use dst/src address for single subnets, use interface when appropriate aka like wireguard, use firewall address lists if not covered by the three previous methods.