1 2 3 4 5 6 7 8 9 | /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "Port scanners to list" disabled=no add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "NMAP FIN Stealth scan" add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "SYN/FIN scan" add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "SYN/RST scan" add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "FIN/PSH/URG scan" add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "ALL/ALL scan" add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list= "port scanners" address-list-timeout=14d comment= "NMAP NULL scan" add chain=input src-address-list= "port scanners" action=drop comment= "dropping port scanners" disabled=no |