Bom o que estou postando aqui são regras de firewall que peguei no forum, fiz uma seleção do que eu precisava em minha rede e adicionei essas regras, antes de aplicar regras observem se elas se encaixam nas suas necessidadades, o que peguei no forum tinham muito mais regras, mas como não precisei de todas estou postando só as minhas. (não esqueçam de mudar os ip's para a seu range.
NÃO PEGUEM SIMPLISMENTE E APLIQUEM EM SEUS MK, ANALIZEM E ADICIONEM O QUE PRECISAM.
###################Bom pessoal, regras de firewall ##############################
/ ip firewall filter
add chain=forward protocol=tcp dst-port=135 action=drop comment="" disabled=no
add chain=input connection-state=invalid action=drop comment="Drop Invalid connections" disabled=no
add chain=input connection-state=established action=accept comment="Allow Established connections" disabled=no
add chain=input protocol=udp action=accept comment="Allow UDP" disabled=no
add chain=input protocol=tcp dst-port=23 action=drop comment="" disabled=yes
add chain=input protocol=icmp action=accept comment="Allow ICMP" disabled=no
add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections" disabled=no
add chain=forward connection-state=established action=accept comment="allow already established connections" disabled=no
add chain=forward connection-state=related action=accept comment="allow related connections" disabled=no
add chain=forward src-address=0.0.0.0/8 action=drop comment="" disabled=no
add chain=forward dst-address=0.0.0.0/8 action=drop comment="" disabled=no
add chain=forward src-address=127.0.0.0/8 action=drop comment="" disabled=no
add chain=forward dst-address=127.0.0.0/8 action=drop comment="" disabled=no
add chain=forward src-address=224.0.0.0/3 action=drop comment="" disabled=no
add chain=forward dst-address=224.0.0.0/3 action=drop comment="" disabled=no
add chain=forward protocol=tcp action=jump jump-target=tcp comment="" disabled=no
add chain=forward protocol=udp action=jump jump-target=udp comment="" disabled=no
add chain=forward protocol=icmp action=jump jump-target=icmp comment="" disabled=no
add chain=tcp protocol=tcp dst-port=69 action=drop comment="deny TFTP" disabled=no
add chain=tcp protocol=tcp dst-port=111 action=drop comment="deny RPC portmapper" disabled=no
add chain=tcp protocol=tcp dst-port=135 action=drop comment="deny RPC portmapper" disabled=no
add chain=tcp protocol=tcp dst-port=137-139 action=drop comment="deny NBT" disabled=no
add chain=tcp protocol=tcp dst-port=445 action=drop comment="deny cifs" disabled=no
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS" disabled=no
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus" disabled=no
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny BackOriffice" disabled=no
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP" disabled=no
add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP" disabled=no
add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper" disabled=no
add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS" disabled=no
add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice" disabled=no
add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="drop invalid connections" disabled=no
add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="allow established connections" disabled=no
add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="allow already established connections" disabled=no
add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="allow source quench" disabled=no
add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="allow echo request" disabled=no
add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="allow time exceed" disabled=no
add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="allow parameter bad" disabled=no
add chain=icmp action=drop comment="deny all other types" disabled=no
add chain=forward src-address=172.16.0.1/24 dst-address=172.16.0.1/24 action=drop comment="Bloqueio acesso entre \
usuarios" disabled=no