Firewall - Check

/ip firewall connection tracking
set enabled=yes udp-timeout=10s
/ip firewall filter
add action=accept chain=input comment="Allow established and related connections" connection-state=established,related  
add action=accept chain=forward comment="Allow established and related connections" connection-state=established,related  
add action=accept chain=input comment="Allow Ping from local networks" protocol=icmp src-address-list=local  
add action=accept chain=input comment="Allow DNS only from local networks" dst-port=53 protocol=udp src-address-list=local  
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=5m chain=input comment="SSH First attempt" connection-state=new dst-port=43131 protocol=tcp  
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=15m chain=input comment="SSH Second attempt" connection-state=new dst-port=43131 protocol=tcp  
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1h chain=input comment="SSH Third attempt" connection-state=new dst-port=43131 protocol=tcp  
add action=accept chain=input comment="Allow SSH from non-blacklisted sources and only from local networks" dst-port=43131 protocol=tcp src-address-list=local  
add action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=5m chain=input comment="Winbox First attempt" connection-state=new dst-port=8291 protocol=tcp  
add action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=15m chain=input comment="Winbox Second attempt" connection-state=new dst-port=8291 protocol=tcp  
add action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=1h chain=input comment="Winbox Third attempt" connection-state=new dst-port=8291 protocol=tcp  
add action=accept chain=input comment="Allow Winbox from non-blacklisted sources and only from local networks" dst-port=8291 protocol=tcp src-address-list=local  
add action=accept chain=input comment="Allow HTTPS_ROUTER_Intern" dst-port=444 protocol=tcp src-address-list=local  
add action=accept chain=input comment="Allow SNMP" dst-port=161 protocol=udp src-address-list=local  
add action=accept chain=input comment="Allow Wireguard" dst-port=55003 in-interface-list=WAN protocol=udp  
add action=accept chain=forward comment="Allow Wireguard to VLAN100" dst-address=!10.10.150.0/24 in-interface=wg0 out-interface=VLAN100  
add action=accept chain=forward comment="Allow VLAN100 to Wireguard" dst-address=!10.10.150.0/24 in-interface=VLAN100 out-interface=wg0  
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid  
add action=drop chain=input comment="Drop all other input traffic"  
add action=accept chain=forward comment="Allow RTP (VoIP) traffic" connection-nat-state="" dst-address=192.168.100.200 dst-port=10000-20000 protocol=udp  
add action=accept chain=forward comment=Phone connection-nat-state="" dst-address=192.168.100.200 dst-port=5060 log=yes log-prefix=5060 protocol=tcp  
add action=accept chain=forward comment=Phone connection-nat-state="" dst-address=192.168.100.200 dst-port=5060 log=yes log-prefix=5060 protocol=udp  
add action=accept chain=forward comment=Phone connection-nat-state="" dst-address=192.168.100.200 dst-port=5061 log=yes log-prefix=5061 protocol=tcp  
add action=accept chain=forward comment=Phone connection-nat-state="" dst-address=192.168.100.200 dst-port=5222 log=yes log-prefix=5061 protocol=tcp  
add action=accept chain=forward comment="Accept other dst-nat connections" connection-nat-state=dstnat  
add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid disabled=yes  
add action=drop chain=forward comment="Drop all other forward traffic" disabled=yes  
/ip firewall nat
add action=dst-nat chain=dstnat comment=Opensense dst-port=443 in-interface=WAN1 protocol=tcp to-addresses=192.168.200.250 to-ports=443
add action=dst-nat chain=dstnat comment=Telefon dst-port=5222 in-interface=WAN1 protocol=tcp to-addresses=192.168.100.200 to-ports=5222
add action=dst-nat chain=dstnat comment=Telefon dst-port=5061 in-interface=WAN1 protocol=tcp to-addresses=192.168.100.200 to-ports=5061
add action=dst-nat chain=dstnat comment=Telefon dst-port=5060 in-interface=WAN1 protocol=udp to-addresses=192.168.100.200 to-ports=5060
add action=dst-nat chain=dstnat comment="RTP" dst-port=10000-20000 in-interface=WAN1 log=yes log-prefix=RTPNAT protocol=udp to-addresses=192.168.100.200  
add action=masquerade chain=srcnat comment="Masquerade Outgoing Traffic on WAN1" out-interface=WAN1  
/ip firewall service-port
set sip disabled=yes