Mikrotik How To

The bane of most ISPs is Peer to Peer traffic(p2p). If you run hotels or apartments, especially apartments full of students, p2p will be your main source of issues. In some cases, extreme measure must be taken. So how does one go about taking back their network? The first thing to do is to find the offending traffic.
Mikrotik has some built in matching functionality for p2p traffic. You can use this in mangle rules or firewall rules. In mangle, you can mark the packets and then lower their precedence, or stick them in a smaller queue. In the firewall, you can block them all together.

/ip firewall filter add chain=input protocol=tcp dst-port=21
src-address-list=ftp_blacklist action=drop comment="Drop FTP brute forcers"
disabled=no

/ip firewall filter add chain=input protocol=tcp
connection-state=established action=accept comment="Allow packets belonging
to existing connections" disabled=no
/ip firewall filter add chain=input connection-state=related action=accept
comment="Allow packets related to existing connections" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=safe action=accept comment="Allow SSH
safe hosts" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
src-address-list=ssh_blacklist action=drop comment="Drop SSH brute forcers"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage3
action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=10d comment="SSH brute forcers blacklisting"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage2
action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m comment="SSH brute forcers the third stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage1
action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m comment="SSH brute forcers the second stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m comment="SSH brute forcers the first stage"
disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=safe action=accept comment="Allow
WinBox safe hosts" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
src-address-list=wb_blacklist action=drop comment="Drop WinBox brute
forcers" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage3
action=add-src-to-address-list address-list=wb_blacklist
address-list-timeout=10d comment="WinBox brute forcers blacklisting"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage2
action=add-src-to-address-list address-list=wb_stage3
address-list-timeout=1m comment="WinBox brute forcers the third stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage1
action=add-src-to-address-list address-list=wb_stage2
address-list-timeout=1m comment="WinBox brute forcers the second stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new action=add-src-to-address-list address-list=wb_stage1
address-list-timeout=1m comment="WinBox brute forcers the first stage"
disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new action=accept comment="Allow SSH" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new action=accept comment="Allow WinBox" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=20-21
connection-state=new action=accept comment="Allow FTP" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=1337
action=add-src-to-address-list address-list=knock address-list-timeout=15s
comment="Port knocking the first stage" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=7331
src-address-list=knock action= add-src-to-address-list address-list=safe
address-list-timeout=15m comment="Port knocking whitelisting" disabled=no

/ip firewall filter add chain=input action=drop comment="Drop everything
else"

/ip firewall filter add chain=output action=accept protocol=tcp content="530
Login incorrect" dst-limit=1/1m,9,dst-address/1m comment="Allow only 10 FTP
login incorrect answers per minute" disabled=no
/ip firewall filter add chain=output action=add-dst-to-address-list
protocol=tcp content="530 Login incorrect" address-list=ftp_blacklist
address-list-timeout=3h comment="FTP brute forcers blacklisting" disabled=no

To prevent our network from hacker attack, i use this Minimum Mikrotik Firewall Rules. This Rules is my minimum setting, you can expand it dpend on your network necessery. Here's the code :


/ip firewall filter

add action=drop chain=input comment="" disabled=no dst-port=20-21 protocol=\
tcp src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=22 protocol=tcp \
src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=23 protocol=tcp \
src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=80 protocol=tcp \
src-address-list=!allow

add action=drop chain=forward comment="" disabled=no dst-port=445 \
out-interface=public_interface protocol=tcp
add action=drop chain=forward comment="" disabled=no dst-port=137-139 \
out-interface=public_interface protocol=tcp
add action=drop chain=forward comment="" disabled=no dst-port=137-139 \
out-interface=public_interface protocol=udp
add action=drop chain=forward comment="block spammer or infected users" \
disabled=no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 protocol=tcp \
src-address-list=spammer
add action=log chain=forward comment="trap spammers" connection-limit=30,32 \
disabled=no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 limit=50,5 \
log-prefix=spammertrap protocol=tcp
add action=add-src-to-address-list address-list=spammer address-list-timeout=\
1d chain=forward comment="trap spammers" connection-limit=30,32 disabled=\
no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 limit=50,5 protocol=tcp