http://www.rmk.soseza.sk/spravca_soue/Mikrotik/Mikrotik_Brute-Force/Brute-Force.htm

ip firewall filter add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop comment="1_FTP* drop ftp brute forcers"
ip firewall filter add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m comment="2_FTP* drop ftp brute forcers"
ip firewall filter add chain=output action=add-dst-to-address-list protocol=tcp content= "530 Login incorrect" address-list=ftp_blacklist address-list-timeout=3h comment="3_FTP* drop ftp brute forcers"


RMK 18.V.2022