The big problem that you had was qualifying the related/established rule with an src-address matcher. That’s now fixed. A big step in the right direction.
As to using a connection-state=new style matcher on the following rules: it’s usually not done, but it doesn’t hurt to do so. It’s mostly a matter of convention/taste. It is redundant because by the time these rules are consulted, packets with other connections states were already handled. (You do know that rules are consulted in strict order.)
Lots of people worry about the performance impact of firewall rules. Simply don’t. In a strict sense it’s true that having more rules results in additional cpu cycles. However this is such a miniscule part of packet processing that when I did an experiment where instead of 1, I included 50 additional rules that the packet had to go through, I couldn’t reliably measure the throughput difference even in a lab setting. Simply don’t worry about this, construct your rules so that they make sense and are easy to follow.
The Linux firewall has lot’s of functions and it can be bewildering. Even for more complicated networks these chains are usually enough to know about:
- filter/input - packets where the router itself is the recipient
- filter/forward - packets that go through the router (not generated or received by the router itself)
- nat/srcnat - this is where translation from internal addresses to internet routable addresses happens
Usually the next one to come up is:
- nat/dsnat - this is where what most routers call “port forwarding” happens
The other chains are used in specialized scenarios.
The packet flow diagram specifically constructed for Mikrotiks: The ultimate Mikrotik iptables flowchart
As to Mikrotik documentation. The parts where they go into theory is usually well written and absolutely worth a read. Many things, however, are only documented in a reference style - so it’s mostly useful for someone who is already familiar with the system is use. In relation to the firewall specifically it may be useful to read up on iptables-style firewalling.
EDIT: fixed link