限制DNS遞迴查詢

http://forum.mikrotik.com/viewtopic.php?t=77542

/ip firewall filter
add action=drop chain=input comment=”Detect & drop DNS amplification attack.” \
disabled=no dst-port=53 in-interface=WAN  protocol=udp \
src-address-list=BL-dns
add action=add-src-to-address-list address-list=BL-dns address-list-timeout=12h \
chain=input connection-limit=30,32 disabled=no dst-port=53 in-interface=WAN    protocol=udp

上面紅字的部份自行調整