/ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; Drop invalid connections
     chain=input action=drop connection-state=invalid 

 1   ;;; Allow established connections
     chain=input action=accept connection-state=established 

 2   ;;; Allow related connections
     chain=input action=accept connection-state=related 

 3   ;;; Allow UDP
     chain=input action=accept protocol=udp 

 4   ;;; Allow ICMP
     chain=input action=accept protocol=icmp 

 5   ;;; Allow incoming on the BACnet port
     chain=input action=accept protocol=udp in-interface=ether1 dst-port=47808 

 6   ;;; Allow incoming for PPTP tunnel
     chain=input action=accept connection-state=new protocol=tcp dst-port=1723 connection-type=pptp 

 7   ;;; Allow input from the private address space
     chain=input action=accept src-address-list=private 

 8   ;;; Log everything about to be dropped
     chain=input action=log log-prefix="Drop" 

 9   ;;; Drop everything else
     chain=input action=drop 

2   ;;; Allow related connections
     chain=input action=accept connection-state=related