insert chain=enter in-interface=ether1 motion=settle for protocol=tcp port=8291 remark="allow Winbox"; insert chain=input in-interface=ether1 action=settle for protocol=tcp port=22 remark="make it possible for SSH"; increase chain=enter in-interface=ether1 motion=drop remark="block almost everything else"; ) As MAC link is effective on Layer2, it can be done to connect with the router... https://connerepugq.bloggerchest.com/30052906/winbox-no-further-a-mystery