/ip firewall filter add chain=input connection-state=set up,related action=take remark="settle for recognized,linked"; include chain=input connection-condition=invalid motion=drop; include chain=input in-interface=ether1 protocol=icmp motion=settle for comment="let ICMP"; incorporate chain=input in-interface=ether1 protocol=tcp port=8291 motion=ack