1     chain=forward action=reject reject-with=icmp-network-unreachable src-address-list=Blocked in-interface=ether1 log=no log-prefix="Blocked"

 2    chain=forward action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=!white_list address-list=rdp_stage1 address-list-timeout=5m in-interface=ether1
      dst-port=3389 log=no log-prefix=""

 3    chain=forward action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=rdp_stage1 address-list=rdp_stage2 address-list-timeout=5m in-interface=ether1
      dst-port=3389 log=no log-prefix=""

 4    chain=forward action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=rdp_stage2 address-list=rdp_stage3 address-list-timeout=5m in-interface=ether1
      dst-port=3389 log=no log-prefix=""

 5    chain=forward action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=rdp_stage3 address-list=Blocked address-list-timeout=4w2d in-interface=ether1
      dst-port=3389 log=yes log-prefix="RDP BRUTEFORCE  "