How to Prevent MikroTik Brute Force and Port Scanner Attacks

By creating dynamic address lists for each relevant port and protocol; SSH, Telnet and Winbox ports to come with the Brute Force attacks on the Internet or local network will prevent future port scans.

In our code structure, Brute Force attacks are prevented by going through four different Stages with one Jump, rule, Level1, Level2, Level3 Tracking list step, and Black List rule, which controls the frequency of connection requests, for each of the SSH, telnet and Winbox rules separately.

In this way, the designed structure grants the right to send an incorrect request for 3 times to incoming connection requests, after 3 unsuccessful attempts, the source from which the request comes is blocked by adding to the blacklist in such a way that it is blocked for 30 days.

NOTE: The codes in our document may not be compatible with the internet access interface name or port numbers used in your system. For trouble-free implementation, first, copy the code to a notebook, and ensure that the fields in the ar “in-interface=” and “dst-port=” da sections of all rules are compatible with your system. For example, instead of “in-interface=WAN”,”in-interface=modem1″.

Brute Force Protection Rules for SSH Port

/ ip firewall address-list
add list = "(SSH) Black List" comment = "(SSH) Black List"
 
/ ip firewall filter
WAN comment = "(SSH) Blocks everyone in the Black List." log-yes-log-prefix = "KL_ (SSH) Blacklist" src-address-list = "(SSH) Blacklist"
WAN comment = "(SSH) Black List Chain Skip Rule." dst-port = 22 jump-target = "(SSH) Blacklist Chain" protocol = tcp
add-in-interface = WAN action = add-src-to-address-list address-list = "(SSH) Blacklist" address-list-timeout = 4w2d chain = "(SSH) Blacklist Chain" comment = "Repeating moves the initiatives (SSH) from the Level-3 Tracking List (SSH) to the Black List. " connection-state = new log = yes log-prefix = "SSH) Added to Blacklist" src-address-list = "(SSH) Level-3 Tracking List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(SSH) Level-3 Tracking List" address-list-timeout = 1m chain = "(SSH) Blacklist Chain" comment = "Adds recurring attempts to the 1-minute Tracking List (SSH) Level-3." connection-state = new log = yes log-prefix = "Level-3 (SSH) added to Track List" src-address-list = "(SSH) Level-2 Track List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(SSH) Level-2 Tracking List" address-list-timeout = 1m chain = "(SSH) Blacklist Chain" comment = "Adds recurring attempts to the 1-minute Follow-up List (SSH) Level-2." log-prefix = "Level-2 (SSH) added to the Track List" src-address-list = "(SSH) Level-1 Track List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(SSH) Level-1 Track List" address-list-timeout = 1m chain = "(SSH) Blacklist Chain" comment = "Adds recurring attempts to the 1-minute Track (SSH) Level-1 Tracking List." connection-state = new log = yes log-prefix = "Level-1 (SSH) added to the Track List"
add action = return chain = "(SSH) Blacklist Chain" comment = "(SSH) Components from the Blacklist Chain."

Brute Force Protection Rules for Telnet Port

/ ip firewall address-list
add list = "(Telnet) Black List" comment = "(Telnet) Black List"
 
/ ip firewall filter
WAN comment = "(Telnet) Blocks everyone in the Black List." log-yes-log-prefix = "KL_ (Telnet) Blacklist" src-address-list = "(Telnet) Blacklist"
WAN comment = "(Telnet) Black List Chain Skip Rule." dst-port = 23 jump-target = "Black List Chain" (Telnet) protocol = tcp
add-in-interface = WAN action = add-src-to-address-list address-list = "Black List" (Telnet) address-list-timeout = 4w2d chain = "Black List Chain" comment = "Repeating moves the initiatives from the Level-3 Tracking List (Telnet) to the Black List. connection-state = new log = yes log-prefix = "Telnet) Added to Blacklist" src-address-list = "(Telnet) Level-3 Tracking List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(Telnet) Level-3 Tracking List" address-list-timeout = 1m chain = "(Telnet) Blacklist Chain" comment = "Adds recurring attempts to the 1-minute (Telnet) Level-3 Tracking List." connection-state = new log = yes log-prefix = "Added to Level-3 (Telnet) Track List" src-address-list = "(Telnet) Level-2 Track List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(Telnet) Level-2 Tracking List" address-list-timeout = 1m chain = "(Telnet) Black List Chain" comment = "Adds recurring attempts to the 1-minute (Telnet) Level-2 Tracking List." connection-state = new log = yes log-prefix = "Added to Level-2 (Telnet) Track List" src-address-list = "(Telnet) Level-1 Track List"
add-in-interface = WAN action = add-src-to-address-list Address-list = "(Telnet) Level-1 Track List" address-list-timeout = 1m chain = "(Telnet) Blacklist Chain" comment = "Adds repeated attempts to the 1-minute (Telnet) Level-1 Tracking List." connection-state = new log = yes log-prefix = "Level-1 (Telnet) added to the Track List"
add action = return chain = "(Telnet) Blacklist Chain" comment = "(Telnet) Blacklist Chain.

Brute Force Protection Rules for Winbox Port

/ip firewall address-list
add list="(Winbox) Kara Liste" comment="(Winbox) Kara Liste"
 
/ip firewall filter
add action=drop chain=input in-interface=WAN comment="(Winbox) Kara Liste icerisindeki herkesi engeller." log=yes log-prefix="KL_(Winbox) Kara Liste" src-address-list="(Winbox) Kara Liste"
add action=jump chain=input in-interface=WAN comment="(Winbox) Kara Liste Zinciri Atlama Kurali." dst-port=8291 jump-target="(Winbox) Kara Liste Zinciri" protocol=tcp
add in-interface=WAN action=add-src-to-address-list address-list="(Winbox) Kara Liste" address-list-timeout=4w2d chain="(Winbox) Kara Liste Zinciri" comment="Tekrar eden girisimleri (Winbox) Seviye-3 Takip Listesinden (Winbox) Kara Liste icerisine tasir." connection-state=new log=yes log-prefix="Winbox) Kara Listeye Eklendi" src-address-list="(Winbox) Seviye-3 Takip Listesi"
add in-interface=WAN action=add-src-to-address-list address-list="(Winbox) Seviye-3 Takip Listesi" address-list-timeout=1m chain="(Winbox) Kara Liste Zinciri" comment="Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-3 Takip Listesi icerisine ekler." connection-state=new log=yes log-prefix="Seviye-3(Winbox) Takip Listesine eklendi" src-address-list="(Winbox) Seviye-2 Takip Listesi"
add in-interface=WAN action=add-src-to-address-list address-list="(Winbox) Seviye-2 Takip Listesi" address-list-timeout=1m chain="(Winbox) Kara Liste Zinciri" comment="Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-2 Takip Listesi icerisine ekler." connection-state=new log=yes log-prefix="Seviye-2(Winbox) Takip Listesine eklendi" src-address-list="(Winbox) Seviye-1 Takip Listesi"
add in-interface=WAN action=add-src-to-address-list address-list="(Winbox) Seviye-1 Takip Listesi" address-list-timeout=1m chain="(Winbox) Kara Liste Zinciri" comment="Tekrar eden girisimleri 1 dakikaliginia (Winbox) Seviye-1 Takip Listesi icerisine ekler." connection-state=new log=yes log-prefix="Seviye-1(Winbox) Takip Listesine eklendi"
add action=return chain="(Winbox) Kara Liste Zinciri" comment="(Winbox) Kara Liste Zincirinden donenler."

Port Scanner Blocking Rules

/ ip firewall address-list
add list = "Black List (Port Scanner WAN)" comment = "Black List (Port Scanner WAN)"
 
/ ip firewall filter
Add action = drop chain = input in-interface = WAN comment = "(Port Scanner WAN) Block everyone in the Black List." log-yes-log-prefix = "KL_ (Port Scanner WAN) Black List" src-address-list = "(Port Scanner WAN) Black List"
add action = drop chain = forward in-interface = WAN comment = "(Port Scanner WAN) Block everyone in the Black List." log-yes-log-prefix = "KL_ (Port Scanner WAN) Black List" src-address-list = "(Port Scanner WAN) Black List"
add-in-interface = WAN action = add-src-to-address-list address-list = "Black List (Port Scanner WAN)" address-list-timeout = 4w2d chain = input comment = "IP addresses that scan TCP ports Scanner WAN) Adds to Blacklist and blocks for 30 days "log = yes log-prefix =" (Port Scanner WAN) is added to Blacklist "protocol = tcp psd = 21.3s, 3.1