Let’s have a look at rather common situation: someone dislikes your company or wants money and does DDoS.
Things like UDP flood or DNS amplification are filtered by datacenter autimatically but smaller attacks on TCP ports(SYN-flood and HTTP-Get attacks for example) are still there.
On a Linux system they can be handled automatically by CSF(if tuned well but at cost of server resources) but on RouterOS there is a small guide in manual.
Sure, i tried it and it did filter a small part of attack.
But why? 
Rules look logical there but they simply don’t do all the job they are expected to do.
Two nights of investigation and tests gave some results BUT still far from what i need.
Now let’s have a look bit deeper into things(all filters done on connection-state=new so it should be first packet of connection if i understand well):
dst-limit behaves weirdly(no matter if direct or inverse logics used - it does not do job well) and has blurry description in manual.
conn-limit does job almost well but can sometimes misbihave blocking legitimate users.
Weirdly the most effective thing was… queue for SYN packets(just several packets long and heavily limited bitrate to stop initial burst of attack).
So if possible i want to see clear explanation of how dst-limit should work and a fix for it so it will actually work the way it should.
Second thing is regex for Layer-7 filtering - it simply does not work well with .* (example: “^GET /.* HTTP/” does not catch all HTTP GET URLs or maybe i just miss something?)