تشخیص و مسدودسازی Port Scan در MikroTik

/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w comment="Detect TCP port scan"
add chain=input protocol=udp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w
add chain=input src-address-list=port-scanners action=drop comment="Drop port scanners"

/ip firewall filter
add chain=input protocol=tcp dst-port=23 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-TELNET:"
add chain=input protocol=tcp dst-port=21 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-FTP:"
add chain=input protocol=tcp dst-port=445 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-SMB:"

/ip firewall filter
# XMAS scan
add chain=input protocol=tcp tcp-flags=fin,urg,psh action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="XMAS-SCAN:"

# Null scan
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="NULL-SCAN:"

# FIN scan
add chain=input protocol=tcp tcp-flags=fin action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="FIN-SCAN:"

/ip firewall address-list print where list=port-scanners

/ip firewall filter
add chain=input src-address=192.168.88.10 action=accept comment="Management IP - never block" place-before=0