Mikrotik How To

Mikrotik Router Port Forwarding - Its possible to configure port forwarding with mikrotik router. There is very simple configuration to make port forwarding, i. e. you can access your PC's or any local devices from the internet.

• Restrict bandwidth usage for embedded video streaming

Second, marking data packets using firewall mangle:
Then finally, add new rule in simple queue to limit bandwidth usage for http-video packets (in this example, download for embedded video streaming was capped at 64kbps, you can define this to suite your needs).

•  Blocking embedded video streaming with mikrotik

First, add a video content filter at Layer7 protocol:
Second, marking data packets using firewall mangle:
Finally, drop all http-video packets :)

Mikrotik Layer 7 Firewall Setup - Layer 7 is the application layer of the OSi system model and allows the Mikrotik router to analyze each and every packet that enters your network, and decide what to do with it.


The first step is to get a script file with the list of the most common Layer 7 protocols. This can be obtained from the Mikrotik Wiki via the following link :

http://www.mikrotik.com/download/l7-protos.rsc

We can now copy this script file into the Mikrotik 'Files' list.

Once you have the script file copied into the 'Files' window we can now proceed to import it via the terminal.
To make sure the script file imported properly, head to the 'IP' -> 'Firewall' menu and go to the 'Layer 7 Protocol' tab. You should now have a list ofthe most common types of traffic found within a network.

We can now create a firewall rule to block any type of Layer 7 traffic we choose. Go to the 'Filter' tab and add a new Firewall rule. Leave the chain set to 'forward'.

In the ' Advanced' tab you may now choose the Layer 7 traffic type you would like to block/allow.

Once the Layer 7 traffic type has been selected, proceed to the 'Action' tab and define the action of your choice. Drop is the most common action to stop a certain type off traffic flowing through your network.

The bane of most ISPs is Peer to Peer traffic(p2p). If you run hotels or apartments, especially apartments full of students, p2p will be your main source of issues. In some cases, extreme measure must be taken. So how does one go about taking back their network? The first thing to do is to find the offending traffic.
Mikrotik has some built in matching functionality for p2p traffic. You can use this in mangle rules or firewall rules. In mangle, you can mark the packets and then lower their precedence, or stick them in a smaller queue. In the firewall, you can block them all together.

/ip firewall filter add chain=input protocol=tcp dst-port=21
src-address-list=ftp_blacklist action=drop comment="Drop FTP brute forcers"
disabled=no

/ip firewall filter add chain=input protocol=tcp
connection-state=established action=accept comment="Allow packets belonging
to existing connections" disabled=no
/ip firewall filter add chain=input connection-state=related action=accept
comment="Allow packets related to existing connections" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=safe action=accept comment="Allow SSH
safe hosts" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
src-address-list=ssh_blacklist action=drop comment="Drop SSH brute forcers"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage3
action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=10d comment="SSH brute forcers blacklisting"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage2
action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m comment="SSH brute forcers the third stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new src-address-list=ssh_stage1
action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m comment="SSH brute forcers the second stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m comment="SSH brute forcers the first stage"
disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=safe action=accept comment="Allow
WinBox safe hosts" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
src-address-list=wb_blacklist action=drop comment="Drop WinBox brute
forcers" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage3
action=add-src-to-address-list address-list=wb_blacklist
address-list-timeout=10d comment="WinBox brute forcers blacklisting"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage2
action=add-src-to-address-list address-list=wb_stage3
address-list-timeout=1m comment="WinBox brute forcers the third stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new src-address-list=wb_stage1
action=add-src-to-address-list address-list=wb_stage2
address-list-timeout=1m comment="WinBox brute forcers the second stage"
disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new action=add-src-to-address-list address-list=wb_stage1
address-list-timeout=1m comment="WinBox brute forcers the first stage"
disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22
connection-state=new action=accept comment="Allow SSH" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=8291
connection-state=new action=accept comment="Allow WinBox" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=20-21
connection-state=new action=accept comment="Allow FTP" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=1337
action=add-src-to-address-list address-list=knock address-list-timeout=15s
comment="Port knocking the first stage" disabled=no
/ip firewall filter add chain=input protocol=tcp dst-port=7331
src-address-list=knock action= add-src-to-address-list address-list=safe
address-list-timeout=15m comment="Port knocking whitelisting" disabled=no

/ip firewall filter add chain=input action=drop comment="Drop everything
else"

/ip firewall filter add chain=output action=accept protocol=tcp content="530
Login incorrect" dst-limit=1/1m,9,dst-address/1m comment="Allow only 10 FTP
login incorrect answers per minute" disabled=no
/ip firewall filter add chain=output action=add-dst-to-address-list
protocol=tcp content="530 Login incorrect" address-list=ftp_blacklist
address-list-timeout=3h comment="FTP brute forcers blacklisting" disabled=no

This article is about bandwidth share for users to get same average speed for each user. Queue Tree can make this prevent users to download that can spend lot of bandwidth and make other user can't use another bandwidth.

Here's the configuration for inbound trafic:

I Try this configuration at mikrotik 4.x os version.

/ip firewall mangle
add action=mark-connection chain=input comment="" disabled=no in-interface=ether2 new-connection-mark=int_conn1 passthrough=yes
add action=mark-connection chain=input comment="" disabled=no in-interface=ether3 new-connection-mark=int_conn2 passthrough=yes
add action=mark-routing chain=output comment="" connection-mark=2 disabled=no new-routing-mark=route1 passthrough=no
add action=mark-routing chain=output comment="" connection-mark=3 disabled=no new-routing-mark=route2 passthrough=no
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=Lokal new-connection-mark=pre_conn1 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/0
add action=mark-connection chain=prerouting comment="" disabled=no dst-address-type=!local in-interface=Lokal new-connection-mark=pre_conn2 passthrough=yes \
per-connection-classifier=both-addresses-and-ports:2/1
add action=mark-routing chain=prerouting comment="" connection-mark=pre_conn1 disabled=no in-interface=Lokal new-routing-mark=route1 passthrough=no
add action=mark-routing chain=prerouting comment="" connection-mark=pre_conn2 disabled=no in-interface=Lokal new-routing-mark=route2 passthrough=no

first set web proxy
/ ip web-proxy
set enabled=yes –>> to make ip web proxy enable
set src-address=0.0.0.0 –>> to make source address to access web proxy will allow
set port=8080 –>> to make port for web proxy
set hostname=”proxy.war.net.id” –>> setting for visble hostname web proxy
set transparent-proxy=yes –>> make transparant proxy enable
set parent-proxy=0.0.0.0:0–>> if we used parent proxy x
set cache-administrator=”support@somethink.org” –>> make set administrator info support

Three simple rules for for Create DOTA Server
/ip
firewall
nat
add
chain=srcnat
action=masquerade
out-interface=Public

/ip
firewall
nat
add
chain=dstnat
dst-address=202.xxx.xxx.xxx(ip public)
protocol=tcp
dst-port=xxx(DOTA port)
action=dst-nat
to-addresses=192.168.xxx.xxx(private ip)
to-port=xxx(DOTA port)

To prevent our network from hacker attack, i use this Minimum Mikrotik Firewall Rules. This Rules is my minimum setting, you can expand it dpend on your network necessery. Here's the code :


/ip firewall filter

add action=drop chain=input comment="" disabled=no dst-port=20-21 protocol=\
tcp src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=22 protocol=tcp \
src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=23 protocol=tcp \
src-address-list=!allow
add action=drop chain=input comment="" disabled=no dst-port=80 protocol=tcp \
src-address-list=!allow

add action=drop chain=forward comment="" disabled=no dst-port=445 \
out-interface=public_interface protocol=tcp
add action=drop chain=forward comment="" disabled=no dst-port=137-139 \
out-interface=public_interface protocol=tcp
add action=drop chain=forward comment="" disabled=no dst-port=137-139 \
out-interface=public_interface protocol=udp
add action=drop chain=forward comment="block spammer or infected users" \
disabled=no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 protocol=tcp \
src-address-list=spammer
add action=log chain=forward comment="trap spammers" connection-limit=30,32 \
disabled=no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 limit=50,5 \
log-prefix=spammertrap protocol=tcp
add action=add-src-to-address-list address-list=spammer address-list-timeout=\
1d chain=forward comment="trap spammers" connection-limit=30,32 disabled=\
no dst-address=!xxx.xxx.xxx.xxx/xx dst-port=25 limit=50,5 protocol=tcp