/ip firewall mangle add action=add-src-to-address-list address-list=rdp_drop address-list-timeout=30m chain=forward comment=rdp_drop connection-state=\ new dst-port=3389 protocol=tcp src-address-list=rdp_stage5 add action=add-src-to-address-list address-list=rdp_stage5 address-list-timeout=30s chain=forward comment=rdp_stage5 \ connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage4 add action=add-src-to-address-list address-list=rdp_stage4 address-list-timeout=30s chain=forward comment=rdp_stage4 \ connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage3 add action=add-src-to-address-list address-list=rdp_stage3 address-list-timeout=30s chain=forward comment=rdp_stage3 \ connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage2 add action=add-src-to-address-list address-list=rdp_stage2 address-list-timeout=30s chain=forward comment=rdp_stage2 \ connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage1 add action=add-src-to-address-list address-list=rdp_stage1 address-list-timeout=1m chain=forward comment=rdp_stage1 \ connection-state=new dst-port=3389 log-prefix=MANGLE protocol=tcp
/ip firewall raw add action=drop chain=prerouting comment="// ~ ~ ~ rdp_drop" in-interface=pppoe-out1 log-prefix=PRE src-address-list=rdp_drop