вопрос спецам по микротикам

# :foreach item in=[ /ip firewall filter find dynamic=no ] do { /ip firewall filter remove $item }
/ip firewall filter remove [/ip firewall filter find dynamic=no]
# :foreach item in=[ /ip firewall nat find dynamic=no ] do { /ip firewall nat remove $item }
/ip firewall nat remove [/ip firewall nat find dynamic=no]
# :foreach item in=[ /ip firewall address-list find dynamic=no ] do { /ip firewall address-list remove $item }
/ip firewall address-list remove [/ip firewall address-list find dynamic=no]

/ip firewall address-list
add address=1.1.1.1 list=ALLOW_IP
add address=2.2.2.2 list=ALLOW_IP

# разрешить уже установленные и ассоциированные с установленными
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=output comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked

# выкинуть сбойные пакеты
/ip firewall filter
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=output comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid

/ip firewall filter
add action=accept chain=input comment="defconf: accept to local loopback" dst-address=127.0.0.0/8 src-address=127.0.0.0/8
add action=accept chain=input comment="allow from LAN to mictotik" in-interface-list=LAN
add action=drop   chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward connection-type=ftp dst-port=21 dst-address-list=ALLOW_IP protocol=tcp
add action=drop   chain=forward comment=" drop any another packages by manages instruction 2022-06-27"

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="defconf: Masquarade output packages for WAN" out-interface-list=WAN

# внешнее логгирование
:if ([/system logging print count-only where action=syslogexternal]=1) do {
	/system logging action add name=syslogexternal remote=XXX.XXX.XXX.XXX target=remote
	/system logging add action=syslogexternal
	}
	
# :do {/system watchdog set no-ping-delay=15m ping-timeout=2m watch-address=YYY.YYY.YYY.YYY.YYY; } on-error={:put "fail add watchdog #1"}
# :do {/system watchdog set ping-start-after-boot=15m ping-timeout=2m watch-address=YYY.YYY.YYY.YYY.YYY; } on-error={:put "fail add watchdog #1"}

/ip firewall filter
add action=accept chain=forward  dst-address-list=ALLOW_IP protocol=tcp