**** Reemplace "in-interface" con la interface de tu WAN y luego

**** copy y pase en la terminal de tu RouterOS.

/ip firewall filter

add action=accept chain=input comment="Input - Accept Echo Replies" disabled=\
yes icmp-options=0:0-255 in-interface=ether1_to_INTERNET protocol=icmp
add action=drop chain=input comment="Input - Drop Echo Request" disabled=yes \
icmp-options=8:0-255 in-interface=ether1_to_INTERNET protocol=icmp
add action=accept chain=input comment="Input - Accept Established/Related" \
connection-state=established,related disabled=yes in-interface=\
ether1_to_INTERNET
add action=drop chain=input comment="Input - Drop Invalid/New" \
connection-state=invalid,new disabled=yes in-interface=ether1_to_INTERNET
add action=accept chain=forward comment=\
"Forward - Accept Established/Related" connection-state=\
established,related disabled=yes in-interface=ether1_to_INTERNET
add action=drop chain=forward comment="Forward - Drop Invalid/New" \
connection-state=invalid,new disabled=yes in-interface=ether1_to_INTERNET
add action=drop chain=input comment="Input - DROP ALL" disabled=yes \
in-interface=ether1_to_INTERNET log=yes log-prefix=Input-Drop
add action=drop chain=forward comment="Forward - DROP ALL" disabled=yes \
in-interface=ether1_to_INTERNET