Mikrotik, 3rd party openvpn, no ping between openvpn network and LAN. How to set up a firewall?

Question

openvpn

Please help with setting up a firewall in Mikrotik. The network configuration is as follows:
Mikrotik LAN IP 192.168.88.1/24. It is the gateway for the local network.
There is a separate OpenVPN server on Ubuntu (with routing enabled), has the address 192.168.88.30.
OpenVPN is configured in L3 mode, subnet 10.0.8.0/24. Also, Mikrotik has a route to the 10.0.8.0/24 network through 192.168.88.30 (so that LAN clients can contact OpenVPN clients). The OpenVPN server has 192.168.88.1 as the gateway.
Also, DST-NAT is made on Mikrotik so that clients from the Internet can access the OpenVPN server and through it get into the main LAN.
When setting up a firewall, namely the drop invalid connections rule in the forward chain, clients cannot reach local LAN resources, pings do not go from OpenVPN clients. However, from the LAN, pings reach OpenVPN clients. If you disable the rule with invalid, then OpenVPN clients start pinging LAN resources. Please help or at least indicate in which direction to go in order to establish the correct two-way interaction between OpenVPN clients and the LAN. Also, it is not clear why this traffic gets into invalid.

Answer 1

Show me the correct firewall filter

Answer 2

Here are the current rules:
add action=drop chain=input comment="Drop echo request" icmp-options=8:0 in-interface-list=WAN protocol=icmp
add action=accept chain=input comment="Accept ICMP" protocol= icmp
add action=accept chain=input comment="Accept established,related,untracked" connection-state=established,related,untracked
add action=accept chain=input comment="Allow remote WinBox access from WAN" dst-port=8291 in -interface-list=WAN protocol=tcp
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=drop chain=input comment="Drop all not coming from LAN" in-interface-list= !LAN
add action=accept chain=forward comment="Accept established,related, untracked"connection-state=established, related, untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment="Drop all from WAN not DSTNATed"connection-nat-state=!dstnat connection-state=new in- interface-list=WAN