add action=drop chain=input comment="Drop l2tp brute forcers" dst-port=1701,500,4500 in-interface=IT log=yes log-prefix="drop drop" protocol=udp src-address-list=banlist
add action=accept chain=output connection-state="" content="M=bad" dst-limit=1/1m,2,dst-address/8m20s log-prefix="l2tp bruteforce detected" protocol=udp src-port=1701,500,4500
add action=add-dst-to-address-list address-list=banlist address-list-timeout=3m chain=output content="M=bad" log-prefix="brute l2tp banned" protocol=udp src-port=1701,500,4500