Scribd Logo
Upload

Welcome to Scribd!

  • Drop Mikrotik Brute Forcers

    Uploaded by

    Albert Kamuni
    13 views2 pages
    The document contains firewall rules to block brute force attacks on SSH, FTP, and Telnet services. It sets up multiple address lists and stages rules to add offending source IPs to address lists for dropping after multiple offenses. It also includes a rule to drop DNS hackers and add them to an address list.

    Original Description:

    Original Title

    drop mikrotik brute forcers

    Copyright

    © © All Rights Reserved

    Available Formats

    TXT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document contains firewall rules to block brute force attacks on SSH, FTP, and Telnet services. It sets up multiple address lists and stages rules to add offending source IPs to address lists for dropping after multiple offenses. It also includes a rule to drop DNS hackers and add them to an address list.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    13 views2 pages

    Drop Mikrotik Brute Forcers

    Uploaded by

    Albert Kamuni
    The document contains firewall rules to block brute force attacks on SSH, FTP, and Telnet services. It sets up multiple address lists and stages rules to add offending source IPs to address lists for dropping after multiple offenses. It also includes a rule to drop DNS hackers and add them to an address list.

    Copyright:

    © All Rights Reserved
    Download as TXT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 2

    add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop

    \
    comment="drop ssh brute forcers" disabled=no

    add chain=input protocol=tcp dst-port=22 connection-state=new \


    src-address-list=ssh_stage3 action=add-src-to-address-list address-
    list=ssh_blacklist \
    address-list-timeout=10d comment="" disabled=no

    add chain=input protocol=tcp dst-port=22 connection-state=new \


    src-address-list=ssh_stage2 action=add-src-to-address-list address-
    list=ssh_stage3 \
    address-list-timeout=1m comment="" disabled=no

    add chain=input protocol=tcp dst-port=22 connection-state=new src-address-


    list=ssh_stage1 \
    action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m
    comment="" disabled=no

    add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-


    address-list \
    address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

    add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop


    \
    comment="drop ftp brute forcers"

    add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-


    limit=1/1m,9,dst-address/1m

    add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login


    incorrect" \
    address-list=ftp_blacklist address-list-timeout=3h

    add chain=input protocol=tcp dst-port=23 src-address-list=black_list action=drop \


    comment=”drop telnet brute forcers” disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage3 action=add-src-to-address-list address-
    list=black_list address-list-timeout=1d \
    comment=”” disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage2 action=add-src-to-address-list address-
    list=telnet_stage3 address-list-timeout=1m \
    comment=”” disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage1 action=add-src-to-address-list address-
    list=telnet_stage2 address-list-timeout=1m \
    comment=”” disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m
    comment=”” \
    disabled=no

    add chain=input protocol=tcp dst-port=23 src-address-list=black_list action=drop \


    comment="drop telnet brute forcers" disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage3 action=add-src-to-address-list address-
    list=black_list address-list-timeout=1d \
    comment="" disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage2 action=add-src-to-address-list address-
    list=telnet_stage3 address-list-timeout=1m \
    comment="" disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    src-address-list=telnet_stage1 action=add-src-to-address-list address-
    list=telnet_stage2 address-list-timeout=1m \
    comment="" disabled=no
    add chain=input protocol=tcp dst-port=23 connection-state=new \
    action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m
    comment="" \
    disabled=no

    16 ;;; drop dns hackers


    chain=input action=drop protocol=udp src-address-li
    dst-port=53 log=no log-prefix=""

    17 chain=input action=add-src-to-address-list connecti


    protocol=udp address-list=dns_hackers address-list-
    log=no log-prefix=""

    You might also like