Why might firewall rules be removed?

Question

Mikrotik

For some reason, some of the firewall filters on the remote mikrotik rb750r2 are removed, the firmware is different. Specifically, the input rules are removed.
/ip firewall filter
add action=accept chain=input comment=Ping protocol=icmp
add action=accept chain=forward protocol=icmp
add action=accept chain=input comment="Allow IPsec" dst-port=500 protocol=udp
add action =accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=accept chain=input protocol=udp src-port=4500
add action=accept chain=forward comment="Local to net " dst-address-list=test \
in-interface=!ether1-gateway out-interface=ether1-gateway
add action=accept chain=input comment="Accept connection" connection-state=\
established,related
add action=accept chain=forward connection-state=established,related
add action=accept chain=forward comment="Online kass" dst-address=\
91.213.144.29
add action=accept chain=forward dst-address=46.17 .204.250
add action=accept chain=input comment="Local network" in-interface=\
!ether1-gateway src-address=192.64.1.0/24
add action=accept chain=input comment="allow l2tp" dst-port= 1701 protocol=udp
add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
add action=accept chain=input src-address=192.168.2.0/23
add action=accept chain=input src-address=external office address
add action=accept chain=forward comment="Bank Terminal" src-address=\
192.64.1.2-192.64.1.10
add action=accept chain=forward dst-address=192.64.1.2-192.64.1.10
add action=accept chain=forward src-address=185.170.204.91
add action=accept chain=forward dst-address=185.170.204.91
add action=drop chain=input comment="Drop incoming" in-interface=\
ether1-gateway
add action=accept chain=forward comment ="VPN traffic" src-address=\
192.168.2.0/23
add action=accept chain=forward dst-address=192.168.2.0/23
add action=reject chain=forward comment="Drop all" protocol=tcp reject-with =\
tcp-reset

Answer 1

As far as I know, the rules created in manual mode cannot be deleted by themselves.
Someone intentionally extinguishes them, a script or hands.
Check logs, check scripts, scheduler, set up e-mail notification if someone is logged in, disable unused services, restrict login from certain ports.
I think that 90% of you someone breaks.
In short, go in the direction of increasing the level of security!

Answer 2

I was tormented for a long time why the rules were deleted, and did not understand ..... I strongly doubt that this is done by an evil hacker.
Today, almost before our eyes, these input rules have disappeared. They changed the provider, launched the winbox on my computer and on the remote one, changed the settings, rebooted the Mikrotik and they disappeared. Maybe at the same time you can’t open the winbox for one Mikrotik ... or who knows