Bridge filtering help

I need to set up my 450 in a bridge so that it implicitly drops all traffic, but allows hosts by approved mac address.
I was able to set up an input chain deny rule, based on mac address, but need to do the opposite by dropping all traffic, and then allowing only approved mac addresses through the bridge.

I tries a couple rules, but am not getting it to work that way.

http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Firewall

Add rules that permit based on src-mac-address and dst-mac-address, and then do a default deny at the end.