Block Port Scanner using Mikrotik

Port scanning is the first step for hackers to find the open port from your network or server and it's very dangerous if you let them to scan your network without prevention. Even you change and hide your default port e.g. port 8008 for HTTP, they will find your port easily using port scanner software like Nmap, Angry Super Scanner, or Super Scan. When they find the open port on your network, they can move the other step like Bruteforce Attack to crack your username and password.

This below picture as an example when hacker know your port number and attack with brute force technique :

So, we don't want it be happen.
To make a prevention, we should create a firewall rules to block who is scanning your network and also we can record the IPs of hackers. Using this address list we can drop connection from those IP:

in /ip firewall filter

 add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list " disabled=no  

Next, we can detect port scanning from various combinations of TCP flags.

 add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"  
 add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"  
 add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"  
 add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"  
 add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"  
 add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"  

Then, drop hackers packet data using :

 add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no  

And voila, they can not touch your network again, even just test ping your IP address :