title: customize mikrotik hotspot firewall rules
body: <p>I have a router os installed on a virtual server, with 3 interfaces:</p>
  <blockquote>
  <p>lan-192.168.1.1/24</p>
  <p>wan-192.168.2.1/24</p>
  <p>wifi-192.168.3.1/24</p>
  </blockquote>
  <p>I have a PPOE client to connect over WAN to ISP and get static public IP</p>
  <blockquote>
  <p>x.x.x.x</p>
  </blockquote>
  <p>I have a windows server with DNS, HTTP services on LAN interface, and 1 wireless access point on WIFI interface.</p>
  <p>I have created rules for block incoming connection from internet, except 80,53,...</p>
  <p>I have created dst-nat from my public IP <code>x.x.x.x</code> to local server IP.
  Another <code>dst-nat</code> from LAN to server LAN IP address.
  Also <code>SRC NAT to masqurade</code>, <code>LAN and WIFI</code> connections to server.
  Another <code>SRC-NAT</code> masqurade for access internet.</p>
  <p>Also mikrotik DNS service used to get records and catch from my local server DNS service.</p>
  <p>All things work good, until, I want create hotspot service on WIFI interface.
  dynamic firewall filters and NATs destroy all things work.</p>
  <hr />
  <p>Scenario is access WIFI users to internet by authentication and access local server locally and free.
  Also internet access for lan users free.
  Also public web access to my server from internet.</p>
  <p>Thanks in advance!</p>