OK I think I found it. If you really want to drop this user's MAC.
/ip firewall filter chain=input action=drop src-mac-address=00:1D:0F:E2:E3:D0 \
comment="Drop conections to the router"
/ip firewall filter chain=forward action=drop src-mac-address=00:1D:0F:E2:E3:D0 \ comment="Drop connections through the router"
Bt then he can just spoof another MAC address (if he knows how) and keep trying.
/ip firewall filter chain=input action=drop src-mac-address=00:1D:0F:E2:E3:D0 \
comment="Drop conections to the router"
/ip firewall filter chain=forward action=drop src-mac-address=00:1D:0F:E2:E3:D0 \ comment="Drop connections through the router"
Bt then he can just spoof another MAC address (if he knows how) and keep trying.
EmoticonEmoticon