Allow access to ssh and web interface of Mikrotik router from Internet for a limited time (5 min) by knocking on predefined port combination.
Open ssh session to the router and enter following commands:

/ip firewall filter   

add chain=input action=add-src-to-address-list address-list="stage1" address-list-timeout=30s comment="stage1 list - 30s" dst-port=12345 protocol=tcp in-interface=ether1 place-before=3   

add chain=input action=add-src-to-address-list address-list="stage2" address-list-timeout=30s comment="stage2 list - 30s" dst-port=23456 protocol=udp src-address-list="stage1" in-interface=ether1 place-before=3   

add chain=input action=add-src-to-address-list address-list="allow_ssh" address-list-timeout=5m comment="allow ssh - 05m" dst-port=34567 protocol=tcp src-address-list="stage2" in-interface=ether1 place-before=3   

add chain=input action=accept chain=input comment="Accept 80,22 from IPs in allow_ssh list" dst-port=80,22 protocol=tcp src-address-list="allow_ssh" in-interface=ether1 place-before=3  

Verify rules by printing out ‘input’ chain. The result should look like:

[admin@MikroTik] /ip firewall filter> print chain=input
Flags: X - disabled, I - invalid, D - dynamic
 0    ;;; defconf: accept ICMP
    chain=input action=accept protocol=icmp

 1    ;;; defconf: accept established,related
    chain=input action=accept connection-state=established,related

 2    ;;; Accept 80,22 from IPs in allow_ssh list
    chain=input action=accept protocol=tcp src-address-list=allow_ssh in-interface=ether1 dst-port=80,22

 3    ;;; allow ssh - 05m
    chain=input action=add-src-to-address-list protocol=tcp src-address-list=stage2 address-list=allow_ssh address-list-timeout=5m
    in-interface=ether1 dst-port=34567

 4    ;;; stage2 list - 30s
    chain=input action=add-src-to-address-list protocol=udp src-address-list=stage1 address-list=stage2 address-list-timeout=30s
    in-interface=ether1 dst-port=23456

 5    ;;; stage1 list - 30s
    chain=input action=add-src-to-address-list protocol=tcp address-list=stage1 address-list-timeout=30s in-interface=ether1 dst-port=12345

 6    ;;; defconf: drop all from WAN
    chain=input action=drop in-interface=ether1 log=no
[admin@MikroTik] /ip firewall filter>

To access web interface or ssh from internet use knock (Linux) or GregSowell.con Port Knock (Windows) to knock the ports in right order.
Example using knock on Linux ( is the public IP address of your Mikrotik Router):

knock 12345:tcp 23456:udp 34567:tcp   

Then ssh to the device or open IP in a browser.