Here is the answer from here:
http://forum.mikrotik.com/t/new-firewall-matcher-connection-rate/31487/1
First, make accept rules for each subnet (src to dst) like:
/ip firewall filter add chain=forward action=accept src-address=192.168.0.0/24 dst-addresss=192.168.0.0/24
Then, make one list of all subnets (ALL_subnets) and make rule:
/ip firewall filter add chain=forward action=drop src-address-list=ALL_subnets dst-address-list=All-subnets