I took the default FORWARD chain firewall rules for 7.18beta5 from:
http://forum.mikrotik.com/t/buying-rb1100ahx4-dude-edition-questions-about-firewall/148996/25
Where you write:
/ip firewall filter
add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes comment="defconf: fasttrack"
add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=drop in-interface-list=WAN connection-nat-state=!dstnat connection-state=new comment="defconf: drop all from WAN not DSTNATed"
Above you write that the following is the expanded FORWARD chain rules:
/ip firewall filter
add chain=forward action=fasttrack-connection connection-state=established comment="defconf: fasttrack estabilished"
add chain=forward action=fasttrack-connection connection-state=related comment="defconf: fasttrack related"
add chain=forward action=accept connection-state=established comment="defconf: accept established"
add chain=forward action=accept connection-state=related comment="defconf: accept related"
add chain=forward action=accept connection-state=untracked comment="defconf: accept untracked"
add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
add chain=forward action=accept in-interface-list=WAN connection-nat-state=dstnat comment="defconf: accept all connection from WAN DSTNATed"
add chain=forward action=drop in-interface-list=WAN out-interface-list=LAN comment="defconf: drop unsolicited connections from WAN to LAN"
add chain=forward action=drop in-interface-list=WAN out-interface-list=WAN comment="defconf: drop all coming from WAN to WAN"
add chain=forward action=accept in-interface-list=LAN out-interface-list=LAN comment="defconf: accept all connection from LAN to LAN"
add chain=forward action=accept in-interface-list=LAN out-interface-list=WAN comment="defconf: accept all connection from LAN to WAN"
Leaving aside the IPSEC rules, and the fasttrack, established, related, untracked, and invalid rules (that is, the first 5 default (non-expanded) rules (which I can readily see how they expand as you stated immediately above), we are left with the default rule #6:
add chain=forward action=drop in-interface-list=WAN connection-nat-state=!dstnat connection-state=new comment="defconf: drop all from WAN not DSTNATed"
I see now that this rule (#6) expands to 5 separate rules, some of them drop and some accept.
And, some of those rules are the rules that I am asking about. This clear up things up nicely.
Your one rule (#6):
accepts in-interface-list=WAN and connection-nat-state=dstnat and connection-state=new
drops in-interface-list=WAN out-interface-list=LAN
drops in-interface=list=WAN out-interface-list=WAN
accepts in-interface-list=LAN out-interface-list=LAN
accepts in-interface-list=LAN out-interface-list=WAN
And the following rule should simply not exist at the end of the chain?
add chain=forward action=drop comment="defconf: drop all not coming from LAN or WAN"
Is what I wrote correct?