> /ip firewall filter
> add action=jump chain=forward comment="drop ddos" connection-state=new jump-target=block-ddos
> add action=drop chain=forward connection-state=new dst-address-list=ddosed log=yes log-prefix=ddos src-address-list=ddoser
> add action=return chain=block-ddos dst-limit=50,50,src-and-dst-addresses/10s
> add action=add-dst-to-address-list address-list=ddosed address-list-timeout=10m chain=block-ddos
> add action=add-src-to-address-list address-list=ddoser address-list-timeout=10m chain=block-ddos
1 287
