Các Firewall Filter Rules giúp tăng cường bảo mật cho Mikrotik

Như các bạn sử dụng Mikrotik đã biết thì vấn đề bảo mật trên Mikrotik cũng khá là nhức nhối, chủ yếu đến từ lỗi của người dùng như không thay đổi admin password, đặt password kém an toàn, reset về mặc định và không tắt các dịch vụ như SSH, Telnet … tạo điều kiện cho Hacker xâm nhập và chiếm đoạt quyền điều khiển hoặc lợi dụng vào mục đích xấu.

Dưới đây là các Filter Rules mình tổng hợp được từ trên internet giúp tăng cường thêm mức độ bảo mật cho Router của các bạn. (cũng không nhớ nguồn ở đâu, bác nào là tác giả xin hãy liên hệ mình đặt credit nha)

Copy từng dòng lệnh và dán vào Terminal trên Winbox

/ip firewall filter    add chain=forward dst-port=11211 protocol=udp action=drop comment="Memcrashed - Amplification Attacks UDP 11211"

/ip firewall filter    add chain=forward connection-state=new action=jump jump-target=block-ddos comment="Anti DDoS Attacks"    add chain=forward connection-state=new src-address-list=ddoser dst-address-list=ddosed action=drop    add chain=block-ddos dst-limit=50,50,src-and-dst-addresses/10s action=return    add chain=block-ddos action=add-dst-to-address-list address-list=ddosed address-list-timeout=10m    add chain=block-ddos action=add-src-to-address-list address-list=ddoser address-list-timeout=10m

/ip firewall filter    # Mark Source ip port scanner to Address list    add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Mark Source ip port scanner to Address list " disabled=no    # NMAP FIN Stealth scan    add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"    # SYN/FIN scan    add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"    # SYN/RST scan    add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"    # FIN/PSH/URG scan    add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"    # ALL/ALL scan    add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"    # NMAP NULL scan    add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"    # Drop port scanners    add chain=input src-address-list="port scanners" action=drop comment="Drop port scanners" disabled=no

/ip firewall filter    # drop ftp BRUTE FORCErs    add action=drop chain=input comment="drop ftp BRUTE FORCErs" dst-port=21 protocol=tcp src-address-list=ftp_blacklist    add action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp    add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp    # drop ssh/telnet BRUTE FORCErs    add action=drop chain=input comment="drop ssh BRUTE FORCErs" dst-port=22-23 protocol=tcp src-address-list=ssh_blacklist    add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage3    add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage2    add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage1    add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcp    add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22-23 protocol=tcp src-address-list=ssh_blacklist

Ngoài các Firewall rules ở trên các bạn hãy nhớ tắt hết các dịch vụ không cần thiết ở menu IP > Service.

Nếu các bạn có các firewall rule hay, hãy chia sẽ bên dưới bình luận nha, mình sẽ bổ sung vào bài viết giúp mọi người an toàn hơn trước các cuộc tấn công của tin tặc.

/ip firewall filteradd chain=forward dst-port=11211 protocol=udp action=drop comment="Memcrashed - Amplification Attacks UDP 11211"/ip firewall filteradd chain=forward connection-state=new action=jump jump-target=block-ddos comment="Anti DDoS Attacks"add chain=forward connection-state=new src-address-list=ddoser dst-address-list=ddosed action=dropadd chain=block-ddos dst-limit=50,50,src-and-dst-addresses/10s action=returnadd chain=block-ddos action=add-dst-to-address-list address-list=ddosed address-list-timeout=10madd chain=block-ddos action=add-src-to-address-list address-list=ddoser address-list-timeout=10m/ip firewall filteradd chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Mark Source ip port scanner to Address list " disabled=noadd chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"add chain=input src-address-list="port scanners" action=drop comment="Drop port scanners" disabled=no/ip firewall filteradd action=drop chain=input comment="drop ftp BRUTE FORCErs" dst-port=21 protocol=tcp src-address-list=ftp_blacklistadd action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcpadd action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcpadd action=drop chain=input comment="drop ssh BRUTE FORCErs" dst-port=22-23 protocol=tcp src-address-list=ssh_blacklistadd action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage3add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage2add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcp src-address-list=ssh_stage1add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22-23 protocol=tcpadd action=drop chain=forward comment="drop ssh brute downstream" dst-port=22-23 protocol=tcp src-address-list=ssh_blacklist