Add:
add comment=myconf interface=vlan500 list=WAN
What is this?:
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade"
ipsec-policy=out,none out-interface=Unifi out-interface-list=WAN
When you modify a defconf rule you should also change the comment (otherwise you won't be able to understand which one is defconf and which one is "modified defconf"), then you should use EITHER out-interface OR out-interface-list in a masquerade rule
And you have seemingly no interface called "Unifi", you should have only out-interface-list=WAN in that (defconf) rule.
The default firewall is fine in 99.99% of the cases, don't touch it, that would be Rule #8:
The twelve Rules of Mikrotik Club