Something is hammering your router's WinBox, SSH, or API port with connection attempts — most likely an automated scanner trying credentials, not a targeted attack. Static address lists can't keep up with attackers using rotating source IPs. What you actually want is a rule that recognizes the behavior itself — many new connections from one source in a short window — and blocks it automatically, regardless of where it's coming from.
Add a rule that watches for the pattern
connection-limit=3,32 matches an address that already has more than 3 connections open to this port, using a /32 (per single address) granularity. When it matches, add that source to a blacklist for a day:
/ip firewall filter add chain=input protocol=tcp dst-port=8291 \
connection-limit=3,32 action=add-src-to-address-list \
address-list=winbox-blacklist address-list-timeout=1d8291 is the default WinBox port — swap in 22 for SSH, or whatever port your API/API-SSL services use, and repeat the rule per service you want protected.
Add a rule above it to drop blacklisted addresses
Rule order matters — this drop rule needs to come before the detection rule above (or at least before the source gets a chance to keep connecting), so anything already on the list is rejected immediately:
/ip firewall filter add chain=input src-address-list=winbox-blacklist action=drop place-before=0Repeat for every exposed management service
Apply the same pair of rules — detect-and-list, then drop-if-listed — for each management port you actually have open: SSH, the plain API, API-SSL. Use a separate address list per service if you want to track them independently, or share one list if you'd rather treat any brute-force attempt against any service as reason to block the source everywhere.
Confirm it's catching real attempts
Check the address list periodically to see who's been caught:
/ip firewall address-list print where list=winbox-blacklistWhy do it this way
Connection-limit blocks based on behavior — too many new connections, too fast, from one source — instead of matching against a fixed signature or a manually maintained list of known-bad addresses. That means it catches an attacker the first time it sees them, using a new IP nobody has ever blocked before, with no update or subscription required. A static blacklist only stops attackers you already know about; this stops the pattern itself, which is what actually matters against scanners that rotate source addresses constantly.
How MoniTik helps
A rule like this handles the blocking automatically, but you still want to know it fired — a sustained brute-force attempt is worth knowing about even after it's been blocked. MoniTik alerts on anomalous connection spikes on a monitored device, so you find out about the attempt from the alert feed instead of stumbling across it in the firewall logs days later.
Isabela writes about the everyday MikroTik tasks that never quite make it into the official docs.