/ip firewall filter
add action=accept chain=input connection-state=established,related,untracked in-interface-list=WAN
add action=drop chain=input connection-state=invalid in-interface-list=WAN
add action=jump chain=input in-interface-list=WAN jump-target=icmp protocol=icmp
add action=drop chain=input in-interface-list=WAN
add action=fasttrack-connection chain=forward connection-state=established,related disabled=yes
add action=accept chain=forward connection-state=established,related,untracked
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward dst-port=25,135,137-139,445 protocol=tcp
add action=drop chain=forward dst-port=135,137-139 protocol=udp
add action=jump chain=forward jump-target=icmp protocol=icmp
add action=drop chain=icmp fragment=yes protocol=icmp
add action=accept chain=icmp comment="Type 0, Echo reply" icmp-options=0 protocol=icmp
add action=accept chain=icmp comment="Type 3, Code 4, Fragmentation needed and DF set" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="Type 4, Source quench" icmp-options=4 protocol=icmp
add action=accept chain=icmp comment="Type 8, Echo" icmp-options=8 protocol=icmp
add action=accept chain=icmp comment="Type 11, Code 0, Time to live exceeded in transit" disabled=yes icmp-options=11:0 protocol=icmp
add action=accept chain=icmp comment="Type 12, Parameter problem" icmp-options=12 protocol=icmp
add action=drop chain=icmp