/ip firewall filter
add action=jump chain=input comment="sshbruteforces chain" connection-state=
new dst-port=22 jump-target=sshbruteforces protocol=tcp
add action=drop chain=sshbruteforces comment="drop ssh brute forcers"
src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=1w3d chain=sshbruteforces connection-state=new
src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \