Ez csak egy rövidített verzió, de így már használható. Amit kivettem az a hálózatom sajátosságai miatt volt benne, de itt nincs jelentősége.

/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related dst-address=192.168.9.0/24
add action=accept chain=forward connection-state=established,related dst-address=192.168.9.0/24
add action=add-src-to-address-list address-list=blacklist address-list-timeout=1d10m chain=input comment="port scanners" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=blacklist address-list-timeout=6h chain=input comment=\
"6h - blacklist kiv\E9ve lan TCP" dst-port=20-1023,8000,8080,8192 protocol=tcp src-address= !192.168.0.0/16
add action=add-src-to-address-list address-list=blacklist address-list-timeout=6h chain=input comment=\
"6h - blacklist kiv\E9ve lan UDP" dst-port=20-122,124-1023,8000,8080,8192 protocol=udp src-address=!192.168.0.0/16
add action=drop chain=input comment="drop blacklist" src-address-list=blacklist
add action=drop chain=forward comment="drop blacklist" src-address-list=blacklist
add action=drop chain=forward comment="LAN / vend\E9g v\E9delem" dst-address=192.168.9.2-192.168.9.255 src-address=192.168.10.0/24

/ip firewall mangle
add action=change-mss chain=forward new-mss=1440 out-interface=pppoe-digi \
passthrough=yes protocol=tcp tcp-flags=syn tcp-mss=!0-1440 comment="PPPOE csomagmeret konvert"