Drop port scanners in Mikrotik

To protect the Router from port scanners, we can record the IPs of hackers who try to scan your box. Using this address list we can drop connection from those IP

in /ip firewall filter

/ip firewall filter

add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="Port scanners to list " disabled=yes

Various combinations of TCP flags can also indicate port scanner activity.
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="NMAP FIN Stealth scan" disabled=yes

add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="SYN/FIN scan" disabled=yes

add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="SYN/RST scan" disabled=yes

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="FIN/PSH/URG scan" disabled=yes

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="ALL/ALL scan" disabled=yes

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port_scanners_list" address-list-timeout=30d comment="NMAP NULL scan" disabled=yes

Set below rule top of all rule mentioned here.

add chain=input src-address-list="port_scanners_list" action=drop comment="dropping port scanners" disabled=yes



Similarly, we can drop these port scanners in the forward chain, but using the above rules with "chain=forward".