Como evitar ataques de força bruta e de scanner de porta MikroTik

    Criando listas de endereços dinâmicas para cada porta e protocolo relevantes; SSH, Telnete as Winboxportas que virão com os Brute Force ataques na Internet ou na rede local impedirão futuras varreduras de portas.

    Em nossa estrutura de código, os ataques de força bruta são evitados passando por quatro diferentes estágios com um salto, regra, nível 1, nível 2, etapa da lista de rastreamento de nível 3 e regra da Black List , que controla a frequência das solicitações de conexão, para cada um dos SSH, regras telnet e Winbox separadamente.

    Desta forma, a estrutura projetada concede o direito de enviar uma solicitação incorreta por 3 vezes para solicitações de conexão de entrada, após 3 tentativas malsucedidas, a fonte de onde vem a solicitação é bloqueada adicionando à lista negra de forma que seja bloqueada por 30 dias.

NOTA: 

    Os códigos em nosso documento podem não ser compatíveis com o nome da interface de acesso à Internet ou com os números de porta usados ​​em seu sistema. Para uma implementação sem problemas, primeiro, copie o código para um bloco de notas e certifique-se de que os campos nas seções ar “ in-interface=” e “ dst-port=” da de todas as regras são compatíveis com seu sistema. Por exemplo, em vez de “ in-interface=WAN”, ” in-interface=modem1″.

Regras de proteção de força bruta para porta SSH

/ ip firewall address-list
add list = “(SSH) Black List” comment = “(SSH) Black List” 

/ ip firewall filter
WAN comment = “(SSH) Blocks everyone in the Black List.” log-yes-log-prefix = “KL_ (SSH) Blacklist” src-address-list = “(SSH) Blacklist”
WAN comment = “(SSH) Black List Chain Skip Rule.” dst-port = 22 jump-target = “(SSH) Blacklist Chain” protocol = tcp
add-in-interface = WAN action = add-src-to-address-list address-list = “(SSH) Blacklist” address-list-timeout = 4w2d chain = “(SSH) Blacklist Chain” comment = “Repeating moves the initiatives (SSH) from the Level-3 Tracking List (SSH) to the Black List. ” connection-state = new log = yes log-prefix = “SSH) Added to Blacklist” src-address-list = “(SSH) Level-3 Tracking List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(SSH) Level-3 Tracking List” address-list-timeout = 1m chain = “(SSH) Blacklist Chain” comment = “Adds recurring attempts to the 1-minute Tracking List (SSH) Level-3.” connection-state = new log = yes log-prefix = “Level-3 (SSH) added to Track List” src-address-list = “(SSH) Level-2 Track List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(SSH) Level-2 Tracking List” address-list-timeout = 1m chain = “(SSH) Blacklist Chain” comment = “Adds recurring attempts to the 1-minute Follow-up List (SSH) Level-2.” log-prefix = “Level-2 (SSH) added to the Track List” src-address-list = “(SSH) Level-1 Track List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(SSH) Level-1 Track List” address-list-timeout = 1m chain = “(SSH) Blacklist Chain” comment = “Adds recurring attempts to the 1-minute Track (SSH) Level-1 Tracking List.” connection-state = new log = yes log-prefix = “Level-1 (SSH) added to the Track List”
add action = return chain = “(SSH) Blacklist Chain” comment = “(SSH) Components from the Blacklist Chain.”

Regras de proteção de força bruta para porta Telnet

/ ip firewall address-list
add list = “(Telnet) Black List” comment = “(Telnet) Black List” 

/ ip firewall filterWAN comment = “(Telnet) Blocks everyone in the Black List.” log-yes-log-prefix = “KL_ (Telnet) Blacklist” src-address-list = “(Telnet) Blacklist”
WAN comment = “(Telnet) Black List Chain Skip Rule.” dst-port = 23 jump-target = “Black List Chain” (Telnet) protocol = tcp
add-in-interface = WAN action = add-src-to-address-list address-list = “Black List” (Telnet) address-list-timeout = 4w2d chain = “Black List Chain” comment = “Repeating moves the initiatives from the Level-3 Tracking List (Telnet) to the Black List. connection-state = new log = yes log-prefix = “Telnet) Added to Blacklist” src-address-list = “(Telnet) Level-3 Tracking List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(Telnet) Level-3 Tracking List” address-list-timeout = 1m chain = “(Telnet) Blacklist Chain” comment = “Adds recurring attempts to the 1-minute (Telnet) Level-3 Tracking List.” connection-state = new log = yes log-prefix = “Added to Level-3 (Telnet) Track List” src-address-list = “(Telnet) Level-2 Track List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(Telnet) Level-2 Tracking List” address-list-timeout = 1m chain = “(Telnet) Black List Chain” comment = “Adds recurring attempts to the 1-minute (Telnet) Level-2 Tracking List.” connection-state = new log = yes log-prefix = “Added to Level-2 (Telnet) Track List” src-address-list = “(Telnet) Level-1 Track List”
add-in-interface = WAN action = add-src-to-address-list Address-list = “(Telnet) Level-1 Track List” address-list-timeout = 1m chain = “(Telnet) Blacklist Chain” comment = “Adds repeated attempts to the 1-minute (Telnet) Level-1 Tracking List.” connection-state = new log = yes log-prefix = “Level-1 (Telnet) added to the Track List”
add action = return chain = “(Telnet) Blacklist Chain” comment = “(Telnet) Blacklist Chain.

Regras de proteção de força bruta para porta Winbox

/ip firewall address-list
add list=”(Winbox) Kara Liste” comment=”(Winbox) Kara Liste”

/ip firewall filter
add action=drop chain=input in-interface=WAN comment=”(Winbox) Kara Liste icerisindeki herkesi engeller.” log=yes log-prefix=”KL_(Winbox) Kara Liste” src-address-list=”(Winbox) Kara Liste”
add action=jump chain=input in-interface=WAN comment=”(Winbox) Kara Liste Zinciri Atlama Kurali.” dst-port=8291 jump-target=”(Winbox) Kara Liste Zinciri” protocol=tcp
add in-interface=WAN action=add-src-to-address-list address-list=”(Winbox) Kara Liste” address-list-timeout=4w2d chain=”(Winbox) Kara Liste Zinciri” comment=”Tekrar eden girisimleri (Winbox) Seviye-3 Takip Listesinden (Winbox) Kara Liste icerisine tasir.” connection-state=new log=yes log-prefix=”Winbox) Kara Listeye Eklendi” src-address-list=”(Winbox) Seviye-3 Takip Listesi”
add in-interface=WAN action=add-src-to-address-list address-list=”(Winbox) Seviye-3 Takip Listesi” address-list-timeout=1m chain=”(Winbox) Kara Liste Zinciri” comment=”Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-3 Takip Listesi icerisine ekler.” connection-state=new log=yes log-prefix=”Seviye-3(Winbox) Takip Listesine eklendi” src-address-list=”(Winbox) Seviye-2 Takip Listesi”
add in-interface=WAN action=add-src-to-address-list address-list=”(Winbox) Seviye-2 Takip Listesi” address-list-timeout=1m chain=”(Winbox) Kara Liste Zinciri” comment=”Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-2 Takip Listesi icerisine ekler.” connection-state=new log=yes log-prefix=”Seviye-2(Winbox) Takip Listesine eklendi” src-address-list=”(Winbox) Seviye-1 Takip Listesi”
add in-interface=WAN action=add-src-to-address-list address-list=”(Winbox) Seviye-1 Takip Listesi” address-list-timeout=1m chain=”(Winbox) Kara Liste Zinciri” comment=”Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-1 Takip Listesi icerisine ekler.” connection-state=new log=yes log-prefix=”Seviye-1(Winbox) Takip Listesine eklendi”
add action=return chain=”(Winbox) Kara Liste Zinciri” comment=”(Winbox) Kara Liste Zincirinden donenler.”

Regras de bloqueio do scanner de porta

/ ip firewall address-list
add list = “Black List (Port Scanner WAN)” comment = “Black List (Port Scanner WAN)” 

/ ip firewall filter
Add action = drop chain = input in-interface = WAN comment = “(Port Scanner WAN) Block everyone in the Black List.” log-yes-log-prefix = “KL_ (Port Scanner WAN) Black List” src-address-list = “(Port Scanner WAN) Black List”
add action = drop chain = forward in-interface = WAN comment = “(Port Scanner WAN) Block everyone in the Black List.” log-yes-log-prefix = “KL_ (Port Scanner WAN) Black List” src-address-list = “(Port Scanner WAN) Black List”
add-in-interface = WAN action = add-src-to-address-list address-list = “Black List (Port Scanner WAN)” address-list-timeout = 4w2d chain = input comment = “IP addresses that scan TCP ports Scanner WAN) Adds to Blacklist and blocks for 30 days “log = yes log-prefix =” (Port Scanner WAN) is added to Blacklist “protocol = tcp psd = 21.3s, 3.1