I don't know if my router was hacked or what but I have an dstnat accept rule that keeps showing up in my filter rules. the port number seems random. 16291 was the latest . The first time I seen it I deleted it but it returns. Looks the same but everytime it returns it has a different port number. I've changed my username and password. All services expcept winbox and web are disabled. The default port for web access has been changed. The router is an RB493G running very new software. Not the latest but close(I don't like to be the one finding bugs in the latest software)
Not sure what is going on. I don't see any funny connections to the router when I run torch. Not sure what else I should be looking for.