[dadoremix]

/ip firewall filter
add chain=input comment="Accept established and related packets" connection-state=established,related
add chain=input comment="Accept all connections from local network" in-interface=BR_lan
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid
add action=drop chain=input comment="Drop all packets which are not destined to routes IP address" dst-address-type=!local
add action=drop chain=input comment="Drop all packets which does not have unicast source IP address" src-address-type=!unicast
add action=drop chain=input comment="Drop all packets from public internet which should not exist in public network" in-interface=optika src-address-list=NotPublic

add chain=forward comment="Accept established and related packets" connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid
add action=drop chain=forward comment="Drop new connections from internet which are not dst-natted" connection-nat-state=!dstnat connection-state=new in-interface=optika
add action=drop chain=forward comment="Drop all packets from public internet which should not exist in public network" in-interface=optika src-address-list=NotPublic
add action=drop chain=forward comment="Drop all packets from local network to internet which should not exist in public network" dst-address-list=NotPublic in-interface=BR_lan
add action=drop chain=forward comment="Drop all packets in local network which does not have local network address" in-interface=BR_lan src-address=!192.168.0.0/24

trenutno sam na ovome
jer ne mogu otkrit šta mi hebe iptv, da konekcije ne otvara, sa ovime je sad ok
al lupaju po ssh, telnet itd, to sam trenutno u servisima ograničio da može se spajat samo lokalna mreža 192.168.0.0/24