Mikrotik – DDoS rünnakute blokeerimine ja Logimiste keelamine

DDos Attack

These rule’s are a little reactive to DoS and port scanning attempts, port scanning is dropped but a DoS attack is ‘tarpitted’ in that all connection’s are slowed down to increase the resource usage on the attackers device
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and drop port scan connections" disabled=no 
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit \ comment="suppress DoS attack" disabled=no 
add chain=input protocol=tcp connection-limit=10,32 action= add-src-to-address-list \ address-list=black_list  address-list-timeout=1d comment="detect DoS attack" disabled=no 

Bruteforce login prevention

To stop SSH/FTP attacks on your router, follow this advice.

This configuration allows only 10 FTP login incorrect answers per minute

in /ip firewall filter

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \ comment="drop ftp brute forcers"
add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m
add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \ address-list=ftp_blacklist address-list-timeout=3h

This will prevent a SSH brute forcer to be banned for 10 days after repetitive attempts. Change the timeouts as necessary.
in /ip firewall filter

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

If you want to block downstream access as well, you need to block the with the forward chain:

add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute downstream" disabled=no

To view the contents of your Blacklist, go to “/ip firewall address-list” and type “print” to see the contents.


/ip firewall filter
add action=log chain=input comment=“Drop FTP Brute Force” disabled=no dstport=21 logprefix=FTP_DROP protocol=tcp srcaddresslist=ftp_blacklist
add action=drop chain=input comment=“Drop FTP Brute Force” disabled=no dstport=21 protocol=tcp srcaddresslist=ftp_blacklist
add action=accept chain=output comment=“Drop FTP Brute Force – Allow ‘Incorrect Login’ reply” content=“530 Login incorrect” disabled=no dstlimit=1/1m,9,dstaddress/1m protocol=tcp
add action=adddsttoaddresslist addresslist=ftp_blacklist addresslisttimeout=3h chain=output comment=“Drop FTP Brute Force – Failed login IP to List: Drop” content=“530 Login incorrect” disabled=no protocol=tcp
add action=log chain=input comment=“Drop SSH Brute Force” disabled=no dstport=22 logprefix=SSH_DROP protocol=tcp srcaddresslist=ssh_blacklist
add action=drop chain=input comment=“Drop SSH Brute Force” disabled=no dstport=22 protocol=tcp srcaddresslist=ssh_blacklist
add action=addsrctoaddresslist addresslist=ssh_blacklist addresslisttimeout=1w3d chain=input comment=“Drop SSH Brute Force – Failed login IP to List: Drop” connectionstate=new disabled=no dstport=22 protocol=tcp srcaddresslist=ssh_stage3
add action=addsrctoaddresslist addresslist=ssh_stage3 addresslisttimeout=1m chain=input comment=“Drop SSH Brute Force – Failed login IP to List: Stage 3” connectionstate=new disabled=no dstport=22 protocol=tcp srcaddresslist=ssh_stage2
add action=addsrctoaddresslist addresslist=ssh_stage2 addresslisttimeout=1m chain=input comment=“Drop SSH Brute Force – Failed login IP to List: Stage 2” connectionstate=new disabled=no dstport=22 protocol=tcp srcaddresslist=ssh_stage1
add action=addsrctoaddresslist addresslist=ssh_stage1 addresslisttimeout=1m chain=input comment=“Drop SSH Brute Force – Failed login IP to List: Stage 1” connectionstate=new disabled=no dstport=22 protocol=tcp