Взято отсюда: http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention_(FTP_%26_SSH)
/ip firewall filter add chain=input protocol=tcp dst-port=8291,22 src-address-list=ssh_blacklist \ action=drop comment="drop ssh brute forcers" add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=ssh_stage4 \ action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1h add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=ssh_stage3 \ action=add-src-to-address-list address-list=ssh_stage4 address-list-timeout=1m add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=ssh_stage2 \ action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=ssh_stage1 \ action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m add chain=input protocol=tcp dst-port=8291,22 connection-state=new \ action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m
Динамически банит IP на 1 час после 4 неудачных попыток входа в течении минуты по Winbox или SSH