How to isolate devices behind Mikrotik from devices connected to ISP router

RouterOS Beginner Basics
4

This should not be difficult.
Some assumptions.

  • You are starting with the default firewall ruleset.
  • The ISP router IP range is 192.168.1.0/24 (change below as required to match actual)
  • Using winbox to manage router.

In /ip firewall filter
Add a new firewall rule in the forward chain to drop all traffic from LAN to 192.168.1.0/24

/ip firewall filter
add action=drop chain=forward comment="drop all traffic from LAN to 192.168.1.0" \
   in-interface-list=LAN dst-address=192.168.1.0/24

Then in winbox move this rule to the end of the forward chain rules. (so, keeping the forward chain rules together)

Test from a LAN client.