DNS Open Resolver Protection
To protect the Router from being a DNS open resolver, we can block DNS access from the WAN entirely.
This tutorial assumes your internet port is called WAN (if not, replace WAN with your interface name).
/ip firewall filter add action=drop chain=input connection-state=new dst-port=53 in-interface=WAN protocol=udp add action=drop chain=input connection-state=new dst-port=53 in-interface=WAN protocol=tcp