/ip firewall filter add action=drop chain=input comment=\ "Drop Invalid connections" connection-state=invalid add chain=input comment="Allow established connections" connection-state=\ established,related,new add chain=input comment="Allow ICMP" protocol=icmp add chain=input comment="allow l2tp" dst-port=1701 protocol=udp add chain=input comment="allow pptp" dst-port=1723 protocol=tcp add chain=input comment="allow sstp" dst-port=443 protocol=tcp add chain=input comment="Allow connections to router only localy" \ in-interface=!ppp-out1-vip src-address=x.x.x.x/x add chain=input in-interface=!ppp-out1-vip src-address=x.x.x.x/x add chain=input in-interface=!ppp-out1-vip src-address=x.x.x.x/x add chain=input in-interface=!ppp-out1-vip src-address=x.x.x.x/x add action=drop chain=input comment="Drop everything else" add action=drop chain=forward comment=\ "drop invalid connections" connection-state=invalid \ protocol=tcp add chain=forward comment="allow already established & related connections" \ connection-state=established,related,new add action=drop chain=forward comment="Block \"bogon\" IP addresses " \ src-address=0.0.0.0/8 add action=drop chain=forward dst-address=0.0.0.0/8 add action=drop chain=forward src-address=127.0.0.0/8 add action=drop chain=forward dst-address=127.0.0.0/8 add action=drop chain=forward src-address=224.0.0.0/3 add action=drop chain=forward dst-address=224.0.0.0/3 add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 \ protocol=tcp src-address-list=ftp_blacklist add chain=output content="530 Login incorrect" dst-limit=\ 1/1m,9,dst-address/1m protocol=tcp add action=add-dst-to-address-list address-list=ftp_blacklist \ address-list-timeout=3h chain=output content="530 Login incorrect" \ protocol=tcp add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1m chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1m chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1m chain=input connection-state=new dst-port=22 \ protocol=tcp add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist