the script is correct and it does not limit sites you specified
there are only unnecessary accept (in forward and input) because you do not have a defult drop (but this is unrelated to your problem)
My first guess would be DNS. How is DNS configured for the router and machines behind it? Are you using the router as your local DNS server? Are you having any resolution problems with the upstream DNS servers?
The next thing would be to look at packet loss within your LAN. A relatively small % of loss can cause big performance problems. I just cleaned up some very annoying issues on my LAN, by tracking down and replacing a flaky unmanaged switch. Ping testing showed that it was “only” losing <5% of the packets, but that number went up with packet size (by 1500 bytes it was closer to 20%). If you see a packet loss problem with wireless connections check for noise and interference on the frequencies that you’re using.
Firewall rules would generally block something completely. There would be no “slow” or “sometimes”. As a result it seems like you should be looking elsewhere for the problem.
After cleaning up and reorganizing your firewall rules a couple things jumped out at me. Comments in-line below.
/ip firewall filter
add chain=input action=accept connection-state=established
add chain=input action=accept connection-state=related
#
# What about dropping invalid connections on the input chain?
#
add chain=input action=accept dst-port=8080 protocol=tcp comment="Web Proxy"
add chain=input action=accept dst-port=801 protocol=tcp comment="WebFig"
add chain=input action=accept dst-port=8291 protocol=tcp comment="WINBOX"
add chain=input action=accept dst-port=53 protocol=udp comment="DNS"
#
# What about allowing ICMP status responses? This could be part of your problem...
# Something like...
# add chain=input action=accept protocol=icmp comment="Allow ping and the like" disabled=no
#
add chain=input action=drop comment="Drop everything else"
add chain=forward action=accept connection-state=established comment="allow established connections"
add chain=forward action=accept connection-state=related comment="allow related connections"
add chain=forward action=drop connection-state=invalid comment="drop invalid connections"
add chain=forward action=accept dst-port=80 protocol=tcp comment="HTTP"
add chain=forward action=accept dst-port=443 protocol=tcp comment="HTTPS"
add chain=forward action=accept dst-port=25 protocol=tcp comment="SMTP"
add chain=forward action=accept dst-port=110 protocol=tcp comment="POP3"
#
# This is a very, very constrained set of ports, and doesn't differentiate between inbound and outbound traffic.
# It also allows outside machines to get in as well as letting inside machines get out... Which can be a problem.
#
add chain=forward action=drop comment="Drop everything else"
For us to get the full story I’d recommend that you do an /ip firewall export and post the complete output. Based on the information you’ve given us so far, the ICMP issue or something wonky with your connection tracking or the proxy setup are my best guesses.
add action=accept chain=input comment=\
"Accetta richieste dai PC della rete al Server DNS" disabled=no \
dst-port=53 protocol=udp
add action=accept chain=input disabled=no dst-port=53 protocol=tcp
