Firewall
Filter rules, raw, address list, port knocking, service protection: all dojo articles on this topic.
Howto · Hotspot
MikroTik Hotspot: Protecting the LAN from WiFi Clients
In a MikroTik hotspot, guest clients must not be able to reach the customer's network (servers, printers, NAS). A single firewall rule using the hotspot=from-client matcher is enough; if the network to protect is not known in advance because the WAN gets its address via DHCP, a DHCP client script automatically updates it in an address list.