I posted something similar a while back and was disappointed at the lack of response too… not sure why exactly but it does take a little bit to look through the config… maybe that’s it… anyway
I won’t comment on the queues because I don’t use them much.
Your firewall section looks like it needs some work. It currently looks like it has winbox open to the internet
I’ve reordered your firewall rules so that input are at the top and forward are at the bottom. This is functionally the same as far as the router is concerned but it’s much more readable this way.
The approach of dropping certain ports on the input chain isn’t the best. I would allow what you specifically need and then drop everything else.
Your drop everything input rule is disabled as well as your accept winbox rule. I would turn on the winbox rule and only allow from a trusted source address or address-list. Create an allow rule for your web cache and DNS and only accept from LAN addresses. Your drop DNS attacks should probably be an input rule as well as the port 53 rule following it, but should be irrelevant by the time we’re done.You should maybe use the safe mode feature and have a good backup/export in case you lock yourself out of the router. When that is working, then move the drop everything input rule to the bottom of the input rules and enable.
The DMZ gaming rule looks a little dangerous if enabled because it looks like it allow most anything.
Sorry, I don’t have more time, but that should make it much safer. You should also check out the pinned thread on hacked routers because yours could potentially be compromised with your current rules.
http://forum.mikrotik.com/t/winbox-vulnerability-please-upgrade/122004/1
/ip firewall filter
add action=accept chain=input comment="L2TP VPN" dst-port=500,1701,4500 in-interface=WAN protocol=udp
add action=accept chain=input in-interface=WAN protocol=ipsec-esp
add action=accept chain=input comment=Winbox disabled=yes dst-port=8291 protocol=tcp
add action=accept chain=input comment="Firewall WAN" connection-state=established,related disabled=yes dst-port=8291 in-interface=WAN protocol=tcp
add action=drop chain=input disabled=yes in-interface=WAN
add action=drop chain=input comment="Block Web Cache Attacks" dst-port=8080 in-interface=WAN protocol=tcp
add action=drop chain=forward comment="Block DNS Attacks" dst-port=53 in-interface=WAN protocol=tcp
add action=drop chain=forward dst-port=53 in-interface=WAN protocol=udp
add action=accept chain=forward comment="DMZ Gaming" connection-nat-state=dstnat connection-state=established,related,new,untracked disabled=yes in-interface=WAN