Firewal как настроить для офиса?

Question

[Роман Рензин]

Добрый день, я совсем зеленый, пришел в компанию и меня поставили на должность сис админа, закупился микротиками и задался вопросом, как настроить безопасность, смотрел Романа Козлова, по его примерам делал, в организации есть телефония yealink, файловый сервер и удаленная 1с, также облачная версия битрикса.
Сделал вот такие правила, можете помочь и подсказать правильно ли я сформировал правила?

/ip firewall address-list
add address=673705ce8fd8.sn.mynetname.net list=manager
add address=192.168.88.0/24 list="\"!HotTrapsIP\""
add address=smtp.gmail.com list=SMTP_External_Servers
add address=192.168.88.0 list=SMTP_Internal_Servers/Clients
add address=smtp.yadnex.ru list=SMTP_External_Servers
add address=smtp.mail.ru list=SMTP_External_Servers
/ip firewall filter
add action=add-src-to-address-list address-list="Trap for TCP traffic" \
address-list-timeout=3d chain=input connection-nat-state=!dstnat \
dst-port=5060,5061,4569,3389,22,23,389,445,53 in-interface-list=WAN \
protocol=tcp psd=21,3s,3,1 src-address-list="\"!HotTrapsIP\""
add action=add-src-to-address-list address-list="Trap for UDP traffic" \
address-list-timeout=3d chain=input connection-nat-state=!dstnat \
dst-port=5060,4569,389,162,53 in-interface-list=WAN protocol=udp psd=\
21,3s,3,1 src-address-list="\"!HotTrapsIP\""
add action=add-src-to-address-list address-list="TrapAdrress addressl ist" \
address-list-timeout=1w chain=input comment="Trap for port scanning" \
in-interface-list=WAN protocol=tcp psd=10,10s,3,1 src-address-list=\
"\"!HotTrapsIP\""
add action=accept chain=input comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid in-interface-list=WAN
add action=drop chain=input dst-port=123,53 in-interface-list=WAN protocol=\
udp
add action=accept chain=input dst-port=8291 in-interface-list=WAN protocol=\
tcp src-address-list=manager
add action=accept chain=input comment="defconf: accept ICMP" icmp-options=0:8 \
in-interface-list=!lan packet-size=100 protocol=icmp
add action=drop chain=input comment="Drop\r\
\nIN echo request" in-interface-list=WAN protocol=icmp src-address-list=\
!AllowIPRemoteManagement
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface-list=WAN
add action=drop chain=output comment="Neighbor ychechka info" dst-port=5678 \
out-interface-list=WAN protocol=udp
add action=drop chain=forward comment="Drop SMTP Spam not allow hosts" \
connection-state=new dst-address-list=!SMTP_External_Sersers dst-port=\
25,587,465 log=yes log-prefix="SMTP Spam" out-interface-list=WAN \
protocol=tcp src-address-list=!!SMTP_Internal_Sersers/Clients
add action=drop chain=forward comment="Drop out SMB not allow hosts" \
connection-state=new dst-port=445 log=yes log-prefix="SMb scan" \
out-interface-list=WAN protocol=tcp
add action=drop chain=input comment="Drop vsega" in-interface-list=WAN
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
disabled=yes in-interface-list=!lan
add action=accept chain=input comment="Vhod test po www" disabled=yes \
protocol=tcp src-port=8080
add action=accept chain=input comment=CapSman disabled=yes dst-address-type=\
local src-address-type=local
/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=invalid \
dst-port=8291,22 new-connection-mark=ManTraff_conn passthrough=yes \
protocol=tcp
add action=mark-packet chain=prerouting connection-mark=ManTraff_conn \
new-packet-mark=ManTraff_Packets passthrough=no
add action=mark-connection chain=prerouting connection-state=new \
dst-address-list=SIP_External_Servers new-connection-mark=SIP_Conn \
passthrough=yes src-address-list=SIP_Internal_Servers/Clients
add action=mark-connection chain=prerouting connection-state=new \
dst-address-list=!!SMTP_Internal_Sersers/Clients new-connection-mark=\
SIP_Conn passthrough=yes src-address-list=SIP_External_Servers
add action=mark-packet chain=prerouting connection-mark=SIP_Conn \
new-packet-mark=SIP_Packets passthrough=no
add action=mark-connection chain=prerouting connection-state=new dst-port=\
3389 new-connection-mark=RDP_Conn passthrough=yes protocol=tcp
add action=mark-packet chain=prerouting connection-mark=RDP_Conn \
new-packet-mark=SIP_Packets passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
ipsec-policy=out,none out-interface-list=WAN
/ip firewall raw
add action=drop chain=prerouting comment="Drop Address from Trap" \
src-address-list=TrapAddress
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes