Speaking of @tangent, there is also his excellent guide that walks through the firewall in more detail:
https://tangentsoft.com/mikrotik/wiki?name=Default%20Router%20Configuration
And I put @Kentzo postings as a “firewall faction”, with philosophy of let’s all be good citizens (e.g. using action=tcp-reset/icmp, instead of “Anav-ism’s” action=drop), see http://forum.mikrotik.com/t/connection-tracking-connection-state-invalid-and-loose-tcp-tracking/183467/1
That a good point. To be clear, “RPF mode” is:
/ip/setting rp-filter=<off | strict | loose>
While agree that rp-filter=loose is a good idea (and should be - but is not - the default). And if possible rp-filter=strict be a good idea — but that has side-effects if do anything more complex with routing (i.e. multiwan, VPNs, etc.) and so “strict” can break things.