Aqui está um exemplo de como proteger seu roteador MikroTik dos ataques mais comuns. Este exemplo é retirado da Wiki MikroTik e é apenas um exemplo. Você deve testar completamente essa configuração antes de implantar em um ambiente ativo.

Vamos dizer que nossa rede privada é 192.168.1.0/24 e a interface pública (WAN) é ether1. 

Vamos configurar o firewall para permitir conexões ao próprio roteador somente a partir de nossa rede local e descartar o restante.

 Também permitiremos o protocolo ICMP em qualquer interface, para que qualquer pessoa possa efetuar o ping do seu roteador a partir da Internet. 

/ip firewall filter
add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"  
add chain=input connection-state=established action=accept comment="Allow Established connections"  
add chain=input protocol=icmp action=accept comment="Allow ICMP" 
add chain=input src-address=192.168.1.0/24 action=accept in-interface=!ether1 add chain=input action=drop comment="Drop everything else"

Para proteger a rede do cliente, devemos verificar todo o tráfego que passa pelo roteador e bloquear indesejados. Para o tráfego icmp, tcp, udp, criaremos cadeias, onde serão descartados todos os pacotes indesejados: 

/ip firewall filter
add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections"  
add chain=forward connection-state=established action=accept comment="allow already established connections"  
add chain=forward connection-state=related action=accept comment="allow related connections"

 Bloquear “bogon” Endereços IP:

add chain=forward src-address=0.0.0.0/8 action=drop comment="block bogon ip addresses" 
add chain=forward dst-address=0.0.0.0/8 action=drop comment="block bogon ip addresses"  
add chain=forward src-address=127.0.0.0/8 action=drop comment="block bogon ip addresses" 
add chain=forward dst-address=127.0.0.0/8 action=drop comment="block bogon ip addresses" 
add chain=forward src-address=224.0.0.0/3 action=drop comment="block bogon ip addresses" 
add chain=forward dst-address=224.0.0.0/3 action=drop comment="block bogon ip addresses"

Fazer  jumps para o novas chains : 

add chain=forward protocol=tcp action=jump jump-target=tcp comment="make jumps to new chains" 
add chain=forward protocol=udp action=jump jump-target=udp comment="make jumps to new chains" 
add chain=forward protocol=icmp action=jump jump-target=icmp comment="make jumps to new chains"

Crie uma cadeia TCP e negue algumas portas TCP:

add chain=tcp protocol=tcp dst-port=69 action=drop comment="deny TFTP" 
add chain=tcp protocol=tcp dst-port=111 action=drop comment="deny RPC portmapper"  
add chain=tcp protocol=tcp dst-port=135 action=drop comment="deny RPC portmapper"  
add chain=tcp protocol=tcp dst-port=137-139 action=drop comment="deny NBT"  
add chain=tcp protocol=tcp dst-port=445 action=drop comment="deny cifs"  
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"  
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny NetBus"  
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"  
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny BackOriffice"  
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"

Negar portas UDP na cadeia UDP: 

add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"  
add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper"  
add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC portmapper"  
add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"  
add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"  
add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice"

Permitir apenas os códigos ICMP necessários na cadeia ICMP: 

add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="echo reply"  
add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="net unreachable"  
add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="host unreachable"
add chain=icmp protocol=icmp icmp-options=3:4 action=accept comment="host unreachable fragmentation required"  
add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="allow source quench"  
add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="allow echo request" 
add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="allow time exceed" 
add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="allow parameter bad"  
add chain=icmp action=drop comment="deny all other types"