Please critique my firewall config

Hi all,

After an extensive re-work of my home network I'm hoping some of you could possibly critique my current filter rules and suggest any improvements or glaring omissions, please?

For context here's my interface list

/interface list add name=LAN_ISOLATED add name=LAN add name=WAN /interface list member add interface=ether1 list=WAN add interface=vlan99-mgmt list=LAN add interface=vlan10-trusted list=LAN add interface=vlan20-iot list=LAN_ISOLATED add interface=vlan40-kids-wifi list=LAN_ISOLATED add interface=vlan30-guest-wifi list=LAN_ISOLATED add interface=vlan50-lab-1 list=LAN add interface=vlan60-xbox list=LAN_ISOLATED 

LAN_ISOLATED Is for VLANs that only have outbound connectivity only

LAN is for other networks that can route to one another.

Filter config (based on the default RB5009 config)

 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; defconf: accept established,related,untracked chain=input action=accept connection-state=established,related,untracked 2 ;;; defconf: drop invalid chain=input action=drop connection-state=invalid 3 ;;; defconf: accept to local loopback (for CAPsMAN) chain=input action=accept src-address=127.0.0.1 dst-address=127.0.0.1 in-interface=lo 4 ;;; defconf: fasttrack chain=forward action=fasttrack-connection connection-state=established,related 5 ;;; defconf: accept established,related, untracked chain=forward action=accept connection-state=established,related,untracked 6 ;;; defconf: drop invalid chain=forward action=drop connection-state=invalid 7 ;;; Allow IoT to Plex chain=forward action=accept protocol=tcp dst-address=172.16.10.233 in-interface=vlan20-iot dst-port=32400 log=no log-prefix="" 8 ;;; Drop LAN_ISOLATED to anything but WAN chain=forward action=drop in-interface-list=LAN_ISOLATED out-interface-list=!WAN log=no log-prefix="" 9 ;;; Allow DNS for ISOLATED chain=input action=accept protocol=udp in-interface-list=LAN_ISOLATED dst-port=53 10 ;;; Allow DNS for ISOLATED (TCP) chain=input action=accept protocol=tcp in-interface-list=LAN_ISOLATED dst-port=53 11 ;;; Allow DHCP for ISOLATED chain=input action=accept protocol=udp in-interface-list=LAN_ISOLATED dst-port=67 12 ;;; Allow mDNS Discovery chain=input action=accept protocol=udp dst-address=224.0.0.251 in-interface-list=!WAN src-port=5353 dst-port=5353 log=no log-prefix="" 13 ;;; defconf: drop all not coming from LAN chain=input action=drop in-interface-list=!LAN log=no log-prefix="" 14 ;;; defconf: drop all from WAN not DSTNATed chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN 

Thanks