Liberar portas 67 e 68

você pode dropar tudo e liberar as portas upd 67 e 68 do seu servidor DHCP para toda rede.

add action=drop chain=input comment=Anti-DHCPServer-Externo disabled=no \
in-interface=wlan2 ip-protocol=udp mac-protocol=ip src-port=67
add action=drop chain=forward disabled=no in-interface=wlan2 ip-protocol=udp \
mac-protocol=ip src-port=67

add action=drop chain=input comment=Anti-DHCPServer-Externo disabled=no \
in-interface=wlan1 ip-protocol=udp mac-protocol=ip src-port=67
add action=drop chain=forward disabled=no in-interface=wlan1 ip-protocol=udp \
mac-protocol=ip src-port=67

add action=log chain=input comment="Block DHCP servers on 192.168.0.0/16" \
disabled=no dst-address=255.255.255.255/32 ip-protocol=udp log-prefix=\
"ALERT ROGUE DHCP (BLOCKED)" mac-protocol=ip src-address=192.168.0.0/16 \
src-port=67-68

add action=drop chain=input comment="Block DHCP servers on 192.168.0.0/16" \
disabled=no dst-address=255.255.255.255/32 ip-protocol=udp mac-protocol=\
ip src-address=192.168.0.0/16 src-port=67-68