anav,
I am learning networking from scratch. “Understanding VLANs” was my first topic. After that, I have had to secure my network and I hope I can migrate the current 192er FritzBox-networt to Mikrotik RB, soon (Alll clients will be in VLAN 99, first). After that I will start to switch the clients to the specific subnets, step by step.
Please keep in mind, I never have had anything to do with networking before and all I knew was that you need IP addresses for the clients, the rest was a black box for me.
I thought I have finished with VLANs but now it seems to be open again! I hope the experts can explain which should be done (http://forum.mikrotik.com/t/vlan-issue-with-rb-3011/119811/1)
But anyway:
regarding the FW-Rules. There is an additional question left for me:
/ip firewall filter add chain=input connection-state=invalid comment="drop invalid" action=drop
/ip firewall filter add chain=forward connection-state=invalid comment="drop invalid" action=drop
Why do I need this rules? If we have a “everything-drop” rule at the end of the chain, why do we need this drop rule in addition?
Here the current rule-set with your modification (with interface-lists instead of interfaces 
, and not sure, if the SPAM rule should be installed in forward chain instead of raw-section)
# Firewall Filter
#
# Prerequisites:
# /interface list add name=WAN
# /interface list add name=LAN
# /interface list member add interface=ether1 list=WAN
# /interface list member add interface=br_vlan list=LAN
# /ip dns set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
#
# Requirements:
# - Allow Subnets to connect to Internet
# - Allow only VLANFriends to talk to each other
# - Allow AdminSubnet to connect to Internet and all other Subnets
# - Allow AdminSubnet to connect to Router
# - Block DNS Requests from WAN
# - Spam prevention (SMTP-Port 25)
# - redirect LAN users to internal DNS-Server
#
#
#
# private Subnetze
#
/ip firewall address-list add address=172.16.1.0/24 list=PrivateSubnets
/ip firewall address-list add address=172.16.10.0/24 list=PrivateSubnets
/ip firewall address-list add address=172.16.20.0/24 list=PrivateSubnets
/ip firewall address-list add address=192.168.1.0/24 list=PrivateSubnets
#
#
# Admin subnet
#
/ip firewall address-list add address=172.16.1.0/24 list=AdminSubnet
#
#
# VLAN friends can talk to each other
#
/ip firewall address-list add address=172.16.10.0/24 list=VlanFriends
/ip firewall address-list add address=172.16.20.0/24 list=VlanFriends
#
#
# Input Chain
/ip firewall filter add chain=input connection-state=established,related comment="accept established,related" action=accept
#
<<do we need this because of common drop at the end?>>
/ip firewall filter add chain=input connection-state=invalid comment="drop invalid" action=drop
#
/ip firewall filter add chain=input in-interface-list=LAN source-address-list=AdminSubnet action=accept
/ip firewall filter add chain=input in-interface-list=LAN protocol TCP dst-port 53 comment="Allow LAN DNS queries-TCP" action=accept
/ip firewall filter add chain=input in-interface-list=LAN protocol UDP dst-port 53 comment="Allow LAN DNS queries-UDP" action=accept
/ip firewall filter add chain=input comment="drop everything" action=drop
# EOF Input Chain
#
#
#
#
# Forward Chain
/ip firewall filter add chain=forward connection-state=established,related comment="fasttrack established,related" action=fasttrack-connection
/ip firewall filter add chain=forward connection-state=established,related comment="accept established,related" action=accept
/ip firewall filter add chain=forward in-interface-list=LAN out-interface-list=WAN protocol=tcp dst-port=25 comment "prevent SPAM" action=drop
#
<<do we need this rule, because of common drop at the end?>>
/ip firewall filter add chain=forward connection-state=invalid comment="drop invalid" action=drop
#
/ip firewall filter add chain=forward connection state=dstnat in-interface-list=WAN comment"only required for port forwarding from WAN" action=accept
/ip firewall filter add chain=forward in-interface-list=LAN src-address-list=PrivateSubnets out-interface-list=WAN comment="accept Internet Access from PrivateSubnets" action accept
/ip firewall filter add chain=forward in-interface-list=LAN src-address-list=AdminSubnet dst-address-list=PrivateSubnets comment="Accept AdminSubnet-> PrivateSubnet" action=accept
/ip firewall filter add chain=forward in-interface-list=LAN src-address-list=VlanFriends dst-address-list=VlanFriends comment="Allow inter VLAN communication with VLAN friends" action=accept
/ip firewall filter add chain=forward comment="drop everything" action=drop
# EOF Forward Chain
#
# NAT
/ip firewall nat add chain=dstnat dst-port=53 protocol=tcp comment= "Force Users to Router for DNS - TCP" action=redirect
/ip firewall nat add chain=dstnat dst-port=53 protocol=udp comment= "Force Users to Router for DNS - UDP" action=redirect
/ip firewall nat add chain=srcnat in-interface-list=LAN out-interface-list=WAN comment= "masquerade LAN->WAN" action=masquerade
# EOF NAT
Regards,
Christian