accept tcp port 8291 on input chain, set in-interface to be your WAN interface, normally ether1.
However you want to limit access to this port by set source IP from which you allow only. Also make sure you are on latest firmware.
1) Recommend to change the winbox port as well, as most robots look for the default port.
2) Don't forget to set the new port and activate the winbox service In IP/services
3) Look up port knocking and implement it, it will add a layer of security if you frequently log in from the outside
4) If possible, limit outside access to specific IP addresses
5) Don't forget to block ICMP requests from the outside in your firewall as well, robots often use it as a first attempt.