Got the same problem. For packets incoming from LAN, I add "reject: tcp reset" just before the default invalid filter.
It's clean up the "intended" invalid flag we want.
Lokamaya
Code:
/ip firewall filteradd action=reject chain=forward connection-state=invalid out-interface-list=WAN protocol=tcp reject-with=tcp-reset tcp-flags=!synadd action=drop chain=input comment="DROP INVALID" connection-state=invalidLokamaya
Statistics: Posted by Lokamaya — Mon Mar 18, 2024 6:23 am