{"id":722,"date":"2017-04-05T08:33:37","date_gmt":"2017-04-05T05:33:37","guid":{"rendered":"https:\/\/helia.ee\/koolitus\/?page_id=722"},"modified":"2017-04-05T08:33:37","modified_gmt":"2017-04-05T05:33:37","slug":"mikrotik-ddos-runnakute-blokeerimine-ja-logimiste-keelamine","status":"publish","type":"page","link":"https:\/\/helia.ee\/koolitus\/?page_id=722","title":{"rendered":"Mikrotik – DDoS r\u00fcnnakute blokeerimine ja Logimiste keelamine"},"content":{"rendered":"

DDos Attack<\/h3>\n
These rule\u2019s are a little reactive to DoS and port scanning attempts, port scanning is dropped but a DoS attack is \u2018tarpitted\u2019 in that all connection\u2019s are slowed down to increase the resource usage on the attackers device<\/pre>\n
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment=\"detect and drop port scan connections\" disabled=no \r\nadd chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit \\ comment=\"suppress DoS attack\" disabled=no \r\nadd chain=input protocol=tcp connection-limit=10,32 action= add-src-to-address-list \\ address-list=black_list  address-list-timeout=1d comment=\"detect DoS attack\" disabled=no \r\n\r\n<\/pre>\n
Bruteforce login prevention
\n<\/span><\/h3>\n
To stop SSH\/FTP attacks on your router, follow this advice.<\/p>\n
This configuration allows only 10 FTP login incorrect answers per minute<\/p>\n
in \/ip firewall filter<\/b><\/p>\n
add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \\ comment=\"drop ftp brute forcers\"<\/pre>\n
add chain=output action=accept protocol=tcp content=\"530 Login incorrect\" dst-limit=1\/1m,9,dst-address\/1m\r\nadd chain=output action=add-dst-to-address-list protocol=tcp content=\"530 Login incorrect\" \\ address-list=ftp_blacklist address-list-timeout=3h\r\n\r\n<\/pre>\n
This will prevent a SSH brute forcer to be banned for 10 days after repetitive attempts. Change the timeouts as necessary.
\nin \/ip firewall filter<\/b><\/p>\n
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \\\r\ncomment=\"drop ssh brute forcers\" disabled=no\r\n\r\nadd chain=input protocol=tcp dst-port=22 connection-state=new \\\r\nsrc-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \\\r\naddress-list-timeout=10d comment=\"\" disabled=no\r\n\r\nadd chain=input protocol=tcp dst-port=22 connection-state=new \\\r\nsrc-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \\\r\naddress-list-timeout=1m comment=\"\" disabled=no\r\n\r\nadd chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \\\r\naction=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment=\"\" disabled=no\r\n\r\nadd chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \\\r\naddress-list=ssh_stage1 address-list-timeout=1m comment=\"\" disabled=no\r\n<\/pre>\n
If you want to block downstream access as well, you need to block the with the forward chain:<\/p>\n
add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \\\r\ncomment=\"drop ssh brute downstream\" disabled=no\r\n<\/pre>\n
To view the contents of your Blacklist, go to “\/ip firewall address-list” and type “print” to see the contents.<\/p>\n
<\/pre>\n
\/<\/span>ip <\/span>firewall <\/span>filter<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>log <\/span>chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop FTP Brute Force”<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>21<\/span> log<\/span>–<\/span>prefix<\/span>=<\/span>FTP_DROP <\/span>protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ftp_blacklist<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>drop <\/span>chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop FTP Brute Force”<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>21<\/span> protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ftp_blacklist<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>accept <\/span>chain<\/span>=<\/span>output <\/span>comment<\/span>=<\/span>“Drop FTP Brute Force – Allow ‘Incorrect Login’ reply”<\/span> content<\/span>=<\/span>“530 Login incorrect”<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>limit<\/span>=<\/span>1<\/span>\/<\/span>1m<\/span>,<\/span>9<\/span>,<\/span>dst<\/span>–<\/span>address<\/span>\/<\/span>1m<\/span> protocol<\/span>=<\/span>tcp<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>add<\/span>–<\/span>dst<\/span>–<\/span>to<\/span>–<\/span>address<\/span>–<\/span>list <\/span>address<\/span>–<\/span>list<\/span>=<\/span>ftp_blacklist <\/span>address<\/span>–<\/span>list<\/span>–<\/span>timeout<\/span>=<\/span>3h<\/span> chain<\/span>=<\/span>output <\/span>comment<\/span>=<\/span>“Drop FTP Brute Force – Failed login IP to List: Drop”<\/span> content<\/span>=<\/span>“530 Login incorrect”<\/span> disabled<\/span>=<\/span>no <\/span>protocol<\/span>=<\/span>tcp<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>log <\/span>chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force”<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> log<\/span>–<\/span>prefix<\/span>=<\/span>SSH_DROP <\/span>protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_blacklist<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>drop <\/span>chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force”<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_blacklist<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>add<\/span>–<\/span>src<\/span>–<\/span>to<\/span>–<\/span>address<\/span>–<\/span>list <\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_blacklist <\/span>address<\/span>–<\/span>list<\/span>–<\/span>timeout<\/span>=<\/span>1w3d<\/span> chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force – Failed login IP to List: Drop”<\/span> connection<\/span>–<\/span>state<\/span>=<\/span>new<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage3<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>add<\/span>–<\/span>src<\/span>–<\/span>to<\/span>–<\/span>address<\/span>–<\/span>list <\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage3 <\/span>address<\/span>–<\/span>list<\/span>–<\/span>timeout<\/span>=<\/span>1m<\/span> chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force – Failed login IP to List: Stage 3”<\/span> connection<\/span>–<\/span>state<\/span>=<\/span>new<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage2<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>add<\/span>–<\/span>src<\/span>–<\/span>to<\/span>–<\/span>address<\/span>–<\/span>list <\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage2 <\/span>address<\/span>–<\/span>list<\/span>–<\/span>timeout<\/span>=<\/span>1m<\/span> chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force – Failed login IP to List: Stage 2”<\/span> connection<\/span>–<\/span>state<\/span>=<\/span>new<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> protocol<\/span>=<\/span>tcp <\/span>src<\/span>–<\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage1<\/span><\/div>\n
add <\/span>action<\/span>=<\/span>add<\/span>–<\/span>src<\/span>–<\/span>to<\/span>–<\/span>address<\/span>–<\/span>list <\/span>address<\/span>–<\/span>list<\/span>=<\/span>ssh_stage1 <\/span>address<\/span>–<\/span>list<\/span>–<\/span>timeout<\/span>=<\/span>1m<\/span> chain<\/span>=<\/span>input <\/span>comment<\/span>=<\/span>“Drop SSH Brute Force – Failed login IP to List: Stage 1”<\/span> connection<\/span>–<\/span>state<\/span>=<\/span>new<\/span> disabled<\/span>=<\/span>no <\/span>dst<\/span>–<\/span>port<\/span>=<\/span>22<\/span> protocol<\/span>=<\/span>tcp<\/span><\/div>\n
\r\n\r\n<\/pre>\n
<\/h1>\n","protected":false},"excerpt":{"rendered":"
DDos Attack These rule\u2019s are a little reactive to DoS and port scanning attempts, port scanning is dropped but a DoS attack is \u2018tarpitted\u2019 in that all connection\u2019s are slowed down to increase the resource usage on the attackers device add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment=”detect and drop port scan connections” disabled=no add chain=input protocol=tcp […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":612,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"class_list":["post-722","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/pages\/722","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=722"}],"version-history":[{"count":1,"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/pages\/722\/revisions"}],"predecessor-version":[{"id":723,"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/pages\/722\/revisions\/723"}],"up":[{"embeddable":true,"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=\/wp\/v2\/pages\/612"}],"wp:attachment":[{"href":"https:\/\/helia.ee\/koolitus\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=722"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}