diff --git a/apps/api/src/agent-scripts/mikrotik-install.rsc b/apps/api/src/agent-scripts/mikrotik-install.rsc
index 038aed5..a3733d8 100644
--- a/apps/api/src/agent-scripts/mikrotik-install.rsc
+++ b/apps/api/src/agent-scripts/mikrotik-install.rsc
@@ -51,13 +51,13 @@
   /system script add name=evofw-env policy=read,write,policy,test source=(" :global EvofwCpUrl \"" . $EvofwCpUrl . "\"; :global EvofwToken \"" . $EvofwToken . "\" ")
 }
 
-# Filter rules (idempotent by comment)
+# Filter rules (idempotent by comment) — names must match policy.rsc (mikrotik-rsc.ts)
 :do { /ip firewall filter remove [find comment~"^evofw-"] } on-error={}
 
-/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-input disabled=no
-/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-bl-drop-forward disabled=no
-/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-wl-accept-forward disabled=yes
-/ip firewall filter add chain=forward action=drop comment=evofw-wl-drop-forward disabled=yes
+/ip firewall filter add chain=input action=drop src-address-list=EVOFW_DENY comment=evofw-deny-drop-input disabled=no
+/ip firewall filter add chain=forward action=drop src-address-list=EVOFW_DENY comment=evofw-deny-drop-forward disabled=no
+/ip firewall filter add chain=forward action=accept src-address-list=EVOFW_ALLOW comment=evofw-allow-accept-forward disabled=no
+/ip firewall filter add chain=forward action=drop comment=evofw-default-drop-forward disabled=yes
 
 # Sync: fetch policy.rsc → import address-lists + toggle mode
 :do { /system script remove [find name="evofw-sync"] } on-error={}
diff --git a/apps/api/src/services/install-links.test.ts b/apps/api/src/services/install-links.test.ts
index 5071423..7b0aa46 100644
--- a/apps/api/src/services/install-links.test.ts
+++ b/apps/api/src/services/install-links.test.ts
@@ -140,7 +140,7 @@ describe('install-links', () => {
     expect(byId.headers['content-type']).toContain('text/plain')
     expect(byId.body).toContain(':global EvofwCpUrl "https://fw.example.com"')
     expect(byId.body).toContain(`:global EvofwInstallLinkId "${body.id}"`)
-    expect(byId.body).toContain('evofw-bl-drop-input')
+    expect(byId.body).toContain('evofw-deny-drop-input')
     expect(byId.body).toContain('/v1/agent/policy.rsc')
   })