OMFG !
2 days !!

RTFM slowly..

Sorry and thanks

No,
It works only when i disable : add action=drop chain=input comment="defconf: drop all from WAN" in-interface=ether1

Yes i know this will work if i remove this rule

But it is more secure no ?

Is it possible to drop all exept 8921 ?

And if i put my rule before the drop all, why doesn't works ??

Hello, I have a hAP with default configuration (switch eth2-3-4-5-wifi, dhcp server, dhcp client on eth1) I would like to reach Winbox since eth1 ( internet ) Default configuration of firewall : /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp ...