Mikrotik DNS Open Resolver Protection

To protect the Router from being a DNS open resolver, we can block DNS access from the WAN entirely.

This tutorial assumes your internet port is called WAN (if not, replace WAN with your interface name).

/ip firewall filter
add action=drop chain=input connection-state=new dst-port=53 in-interface=WAN protocol=udp
add action=drop chain=input connection-state=new dst-port=53 in-interface=WAN protocol=tcp