http://arav.i2p/stuff/article/hardening_mikrotik?lang=en
It is, indeed, a good thing to do, but I personally prefer to have access to my LAN from outside through a VPN. And I recommend that you do the same. 3.1. Port Scan Detection RouterOS has a mechanism that allows you to detect port scanners. To do so in WinBox in firewall filter tab add a new rule for an input chain for TCP/UDP protocol and then set in-interface-list=WAN .