FIREWALL FILTER RULE NOT DOING ALL I WANT

RouterOS supports scripting in which you could find the marked connection and then disconnect it. However, it might be more useful to simply throttle it down to nearly nothing and let them disconnect on their own.

You can see how I do this here with HTTP_BIG connections.