/ip firewall address-list
add address=100.64.0.0/10 list=rede-local-privada
add address=10.0.0.0/8 list=rede-local-privada
add address=10.3.3.0/24 comment="REDE PC SUPORTE" list=rede-suporte
add address=10.80.250.0/24 comment="REDE SERVIDORES" list=rede-suporte
/ip firewall filter
add action=drop chain=forward comment="BLOQUEIA CLIENTES ATRASADOS" src-address-list=pgcorte
add action=accept chain=input comment="ACEITA CONEXOES ESTABELECIDAS OU RELACIONADAS" connection-state=\
    established,related
add action=accept chain=input comment="ACEITA REDE SUPORTE" src-address-list=rede-suporte
add action=add-src-to-address-list address-list=pre-rede-suporte1 address-list-timeout=5s chain=input \
    comment="PEGA IP PARA PRE-REDE-SUPORTE1" dst-port=30010 protocol=tcp
add action=add-src-to-address-list address-list=pre-rede-suporte2 address-list-timeout=5s chain=input \
    comment="PEGA IP PARA PRE-REDE-SUPORTE2" dst-port=20020 protocol=tcp src-address-list=\
    pre-rede-suporte1
add action=add-src-to-address-list address-list=rede-suporte address-list-timeout=5h chain=input comment=\
    "PEGA IP PARA REDE-SUPORTE" dst-port=10030 protocol=tcp src-address-list=pre-rede-suporte2
add action=accept chain=input comment="ACEITA 100 PACOTES DE ICMP POR SEGUNDO" limit=100,5:packet \
    protocol=icmp
add action=accept chain=input comment="ACEITA OSPF" disabled=yes protocol=ospf src-address-list=\
    autorizados-ospf
add action=accept chain=input comment="ACEITA BGP" disabled=yes port=179 protocol=tcp src-address-list=\
    autorizados-bgp
add action=accept chain=input comment="ACEITA VPN PPTP" disabled=yes dst-port=1723 protocol=tcp
add action=accept chain=input comment="ACEITA VPN L2TP" disabled=yes dst-port=1701 protocol=udp
add action=accept chain=input comment="LIBERA SNMP PARA SERVIDOR ZABBIX EXTERNO" dst-port=161 protocol=\
    udp src-address=177.1.1.25
add action=drop chain=input comment="DROP GERAL"
/ip firewall nat
add action=masquerade chain=srcnat comment="NAT PARA NAVEGACAO" out-interface-list=interfaces-links