RDP сервер за NAT

Если сервер на другом порту, сменить 3389 на нужный

/ip firewall filter add action=reject chain=forward reject-with=icmp-network-unreachable src-address-list="Blocked bruteforcers"
/ip firewall filter add action=add-src-to-address-list address-list="Blocked bruteforcers" address-list-timeout=60m chain=forward connection-state=new in-interface=EXT dst-port=3389 log=yes log-prefix="RDP BRUTEFORCE - " protocol=tcp src-address-list=rdp_bruteforce3
/ip firewall filter add action=add-src-to-address-list address-list=rdp_bruteforce3 address-list-timeout=15m chain=forward connection-state=new in-interface=EXT dst-port=3389 protocol=tcp src-address-list=rdp_bruteforce2
/ip firewall filter add action=add-src-to-address-list address-list=rdp_bruteforce2 address-list-timeout=15m chain=forward connection-state=new in-interface=EXT dst-port=3389 protocol=tcp src-address-list=rdp_bruteforce1
/ip firewall filter add action=add-src-to-address-list address-list=rdp_bruteforce1 address-list-timeout=15m chain=forward connection-state=new in-interface=EXT dst-port=3389 protocol=tcp