MT Firewall TLS-host example

/ip firewall filter
add action=jump chain=forward comment="Goto check TLS-hello" \
    connection-bytes=0-3000 dst-port=443 in-interface=eth2 jump-target=\
    tls-filter protocol=tcp
add action=accept chain=forward comment=\
    "Defconf: accept estableshed, related" connection-state=\
    established,related
add action=drop chain=forward comment="Defconf: drop invalid packets" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface=eth1
add action=reject chain=tls-filter comment=vk.com protocol=tcp reject-with=\
    tcp-reset tls-host=vk.com
add action=reject chain=tls-filter protocol=tcp reject-with=tcp-reset \
    tls-host=*.vk.com
add action=reject chain=tls-filter comment=mikrotik.com protocol=tcp \
    reject-with=tcp-reset tls-host=mikrotik.com
add action=reject chain=tls-filter protocol=tcp reject-with=tcp-reset \
    tls-host=*.mikrotik.com