I have router board RB 1000, 4-lan port ,i want to use lan1 for public internet,lan2 and lan3 for users using hotpots and i want to pot pix firewall before lan1 this is static (not change).Now the question is who can i use lan4 for remote management using winbox ? ,and i want the users (lan2&lan3)take the internet from lan1 only not from lan4 if i connect lan4 to same switch that lan1 is connected ??

I did not understand what you need with LAN4
Who can manage rb with winbox?
If lan4 is exposed on internet with his ip all user with user and pwd can manage the rb..
You should use at least 2 separate switches for lan2&3 and

I didn't understand to well what did you meant but, If you connect lan1 and lan4 to the same switch ( I don't know why ) you are gaining acces to your mikrotik from the both devices ( If you won't block it in firewall ), and if you are connected using lan1 to the internet, then you can connect to the mt using internet as well. If you are afraid that someone can connect to your mt if he will have acces to the switch,then you can create a VPN, and set allow only acces to mt from the ip adress you will add in the VPN.