If you are using the bridge mode, the answer of the AUG is correct. In the button Settings of the Bridge USE IP FIREWALL checked and in CONNECTION TRACKING you should check ENABLED.
Ok, type in terminal: /interface bridge settings and print, type set use-ip-firewall=yes. Good luck. Boa sorte. PS: You should not load the 2.9 backup file after 3.1 installation. Test with fresh rules only.