Simple Fw rule - denying everything

RouterOS Beginner Basics
1

How to deny everything to an IP address through firewall except port 80, to one single IP address.

I’ve managed to create PPPoE server and user can connect to the server, and he gets IP 192.168.20.20 when he connects (it’s static), in NAT i’ve masqueraded the whole segment 192.168.20.0/24, so when someone connects via PPPoE, one can access the internet.

Now I want to deny only that one single address everything else than port 80, so he can only browse the web.

I guess it’s a simple firewall rule?

thanks

2 
/ip firewall filter
add chain=forward src-address=192.168.20.20 dst-port=!80 action=drop

The wiki contains many manuals and examples for firewall rules.

3

This is good!

http://wiki.mikrotik.com/wiki/Securing_New_RouterOs_Router