/ip firewall filter
add action=accept chain=input comment="pristup na MK z GUEST len moj pc" dst-port=9999 protocol=tcp src-address=192.168.1.0/24 src-mac-address=01:23:45:67:AB:CD
add action=drop chain=input comment="drop na MKT z Guest" src-address=192.168.1.0/24 add action=drop chain=forward comment="drop z Guest do internej siete"  dst-address=10.6.0.0/16 log-prefix="GUEST  to LAN - " src-address=192.168.1.0/24
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log-prefix="YYY - "
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log-prefix="XXX - "
/ip firewall nat
add action=masquerade chain=srcnat log-prefix="NAT - " out-interface=LAN src-address=192.168.1.0/24