I have a small Mikrotik router for home use and I am wondering if I need to do other settings in order to be protected from router hacking.
Are these settings are enough to protect me from WAN attacks on the router?
Before restarting the router, I had around 6000 login attempts(winbox/ssh/http/etc ports) in just 2 weeks of uptime:
NO!
Show your firewall setup first.
And follow these instructions:
https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router
Pea, how do I show my firewall setup?
/ip firewall filter export
I do not agree with you.
All services are disabled, the Winbox is running but protected with ACL 10/8
To protect THE ROUTER, this is already pretty good. Even if you do not have any specific added firewall rules, the Mikrotik SHOULD NOT allow anyone to connect on the Winbox service port if not coming from 10.0.0.0/8 and all other services are simply not running.
Extra tips :
Sorry but router wan port fully open to internet without firewall filtering is naive and seriously wrong. Even Mikrotik strongly suggest to keep at least default firewall on. Disabled or limited services are fine till new exploit comes…
The default settings that come with the firmwares is safe to use out of the box.
DO NOT tinker with this until you know what you are doing - and avoid youtube recommendations - forum is safer.
This is the recommended starting point.
Nothing wrong with turning off all services not required and leaving winbox up and running.
I would change the winbox port to a different port however and dont tell us what it is
Make sure you add a new admin user name and then remove the old admin user name.
Make sure you have a decent strong password.
If you want to show us your config you go to winbox and select terminal.
then type in
/export hide-sensitive file=anynameyouwish
This will cause the config to be shown in winbox under files.
Right click this file and download to your desktop.
Open the file in Notepadd ++
Review and remove if by chance your WANIP is displayed or winbox port number etc…
Then Copy and paste into the thread.
Best if you then select the text and apply the code tags above (to the right of Bold and Italic - black square with white square brackets)
Guys, these are my firewall rules:
/ip firewall filter
add action=drop chain=forward disabled=yes dst-address=10.223.45.0/26 src-address=10.223.44.0/29
add action=drop chain=forward disabled=yes src-address=10.223.44.5
add action=drop chain=forward disabled=yes dst-address=10.223.44.0/29 src-address=10.223.45.0/26
add action=drop chain=forward disabled=yes dst-address=10.223.44.5
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Port scanners to list " protocol=tcp psd=\
21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=\
fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=\
fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=\
!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" src-address-list="port scanners"
add action=add-src-to-address-list address-list="ping checkers" address-list-timeout=2w chain=input comment="Ping checkers" icmp-options=8:0-255 protocol=\
icmp
add action=drop chain=input comment="dropping Ping checkers" icmp-options=0:0-255 protocol=icmp src-address-list="ping checkers"
add action=add-src-to-address-list address-list=winbox_login_attempt address-list-timeout=none-dynamic chain=input dst-port=8291 in-interface=pppoe-out1 \
protocol=tcp
add action=add-src-to-address-list address-list=ssh_attempt address-list-timeout=none-dynamic chain=input dst-port=60001 in-interface=pppoe-out1 protocol=tcp
add action=add-src-to-address-list address-list=http_attempt address-list-timeout=none-dynamic chain=input dst-port=80 in-interface=pppoe-out1 protocol=tcp
add action=add-src-to-address-list address-list=https_attempt address-list-timeout=none-dynamic chain=input dst-port=443 in-interface=pppoe-out1 protocol=tcp
@anav, this would be my configuration, I’ve deleted every line that had disabled=yes, because there were some past queue prioritization attempts of mine that I disabled after some time.
Can you spot anything sketchy? Or things that I should have configured/enabled?
I am by no means advanced in networking, barely a beginner.
/export hide-sensitive
# jul/04/2020 17:20:08 by RouterOS 6.47
# software id = VWEW-Z7AR
#
# model = 450G
# serial number =
/interface bridge
add fast-forward=no name=bridge1
/interface ethernet
set [ find default-name=ether4 ] speed=100Mbps
set [ find default-name=ether5 ] speed=100Mbps
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 max-mru=1492 max-mtu=1492 name=pppoe-out1 use-peer-dns=yes user=...
/interface list
add exclude=dynamic name=discover
/interface wireless security-profiles
set [ find default=yes ] group-ciphers="" supplicant-identity=MikroTik unicast-ciphers=""
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool1 ranges=10.223.44.2-10.223.44.254
add name=dhcp_pool2 ranges=10.223.45.2-10.223.45.6
add name=openvpnpool1 ranges=172.25.10.1-172.25.10.2
/ip dhcp-server
add address-pool=dhcp_pool1 authoritative=after-2sec-delay disabled=no interface=ether2 lease-time=3d name=dhcp1
add address-pool=dhcp_pool2 authoritative=after-2sec-delay disabled=no interface=ether3 lease-time=3d name=dhcp2
/ppp profile
add local-address=dhcp_pool1 name=openvpnprofile remote-address=dhcp_pool1
/queue simple
/queue type
set 1 pfifo-limit=1000
/queue interface
set ether1 queue=ethernet-default
set ether2 queue=ethernet-default
set ether3 queue=ethernet-default
set ether4 queue=ethernet-default
set ether5 queue=ethernet-default
/queue simple
/queue tree
/routing bgp instance
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=500
/tool user-manager customer
set admin access=own-routers,own-users,own-profiles,own-limits,config-payment-gw
/ip firewall connection tracking
set tcp-syn-received-timeout=1m tcp-syn-sent-timeout=1m
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface list member
add interface=ether1 list=discover
add interface=ether2 list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=bridge1 list=discover
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes256 default-profile=openvpnprofile enabled=yes port=... require-client-certificate=yes
/interface sstp-server server
set authentication=mschap2 certificate=server default-profile=default-encryption
/ip address
add address=10.223.44.1/24 interface=ether2 network=10.223.44.0
add address=10.223.45.1/26 interface=ether3 network=10.223.45.0
/ip dhcp-server lease
add address=10.223.44.2 mac-address=...
add address=10.223.44.5 lease-time=4d3h mac-address=...
/ip dhcp-server network
add address=10.223.44.0/24 gateway=10.223.44.1
add address=10.223.45.0/26 gateway=10.223.45.1
/ip dns
set max-udp-packet-size=512 servers=1.1.1.1,1.0.0.1
/ip firewall address-list
/ip firewall filter
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" src-address-list="port scanners"
add action=add-src-to-address-list address-list="ping checkers" address-list-timeout=2w chain=input comment="Ping checkers" icmp-options=8:0-255 protocol=icmp
add action=drop chain=input comment="dropping Ping checkers" icmp-options=0:0-255 protocol=icmp src-address-list="ping checkers"
add action=add-src-to-address-list address-list=winbox_login_attempt address-list-timeout=none-dynamic chain=input dst-port=8291 in-interface=pppoe-out1 protocol=tcp
add action=add-src-to-address-list address-list=ssh_attempt address-list-timeout=none-dynamic chain=input dst-port=60001 in-interface=pppoe-out1 protocol=tcp
add action=add-src-to-address-list address-list=http_attempt address-list-timeout=none-dynamic chain=input dst-port=80 in-interface=pppoe-out1 protocol=tcp
add action=add-src-to-address-list address-list=https_attempt address-list-timeout=none-dynamic chain=input dst-port=443 in-interface=pppoe-out1 protocol=tcp
/ip firewall mangle
/ip firewall nat
add action=masquerade chain=srcnat src-address=10.223.44.0/24 to-addresses=0.0.0.0
add action=masquerade chain=srcnat src-address=10.223.45.0/26
/ip firewall service-port
/ip proxy
set cache-path=web-proxy1
/ip route
add distance=1 gateway=pppoe-out1
/ip service
set winbox address=10.0.0.0/8
/ip ssh
set allow-none-crypto=yes always-allow-password-login=yes forwarding-enabled=both
/ipv6 nd
set [ find default=yes ] advertise-dns=no
/ppp secret
/system clock
set time-zone-autodetect=no time-zone-name=Europe/...
/system identity
set name=Nord
/system lcd
set contrast=0 enabled=no port=parallel type=24x4
/system lcd page
/system logging
set 1 action=disk
set 3 action=disk
add topics=info
add topics=pppoe
/system ntp client
set enabled=yes primary-ntp=... secondary-ntp=...
/system scheduler
/system script
/tool bandwidth-server
set enabled=no
/tool sniffer
set file-limit=10KiB filter-interface=ether1 filter-ip-address=0.0.0.0/32 filter-stream=yes memory-limit=10KiB memory-scroll=no
/tool traffic-monitor
/tool user-manager database
set db-path=web-proxy1
5.5 hours later. 55 attempts to check/try to do something:
Congratulations, you have no firewall 
Who did this?
Seeing the rest I recommend to start again with the default as proposed by anav. Then study documentation or ask here or follow the wiki advise (see second post).
How do I enable the firewall? By adding the rules stated here? https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router#Firewall
/ip firewall filter
add action=accept chain=input comment="default configuration" connection-state=established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input
/ip firewall address-list
add address=192.168.88.2-192.168.88.254 list=allowed_to_router
/ip firewall filter
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related
add action=accept chain=forward comment="Established, Related" connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid log=yes log-prefix=invalid
add action=drop chain=forward comment="Drop tries to reach not public addresses from LAN" dst-address-list=not_in_internet in-interface=bridge1 log=yes log-prefix=!public_from_LAN out-interface=!bridge1
add action=drop chain=forward comment="Drop incoming packets that are not NATted" connection-nat-state=!dstnat connection-state=new in-interface=ether1 log=yes log-prefix=!NAT
add action=drop chain=forward comment="Drop incoming from internet which is not public IP" in-interface=ether1 log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment="Drop packets from LAN that do not have LAN IP" in-interface=bridge1 log=yes log-prefix=LAN_!LAN src-address=!192.168.88.0/24
/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet
My advice was to reset to defaults and start from there.
Dare I repeat myself.
I will go further, as was pointed out you have very little protection on your router.
Therefore I would go on the premise that its been compromised.
In fact you should pull the plug on the router ASAP but first.
What you need to do is download NETINSTALL and choose 6.45.9 as its a decent stable recent version
ALso download the corresponding version of 6.45.9 (the one for your router type ARM, tile MIPSBE etc..)
Then follow the instructions here… (copy a version to your desktop)
https://help.mikrotik.com/docs/display/ROS/Netinstall
Then you will have a clean router with default firewall rules.
Then you can change the user from admin, strong password, change winbox port etc…
I want to add the rules without resetting it. Where can I find the rules?
How can I check if it was ever compromised? Is Mikrotik that lousy? The password is like 20-30 characters long.
How can you bet on it being compromised if you don’t see anything suspicious in the config? There are no suspicious files stored on it, either.
Now I’m scared. It has been running for 10 years on this configuration.
I want to understand how did my config made my router vulnerable. Can you give an example?
Instead of panicking just follow the plain advice to ensure your router is setup properly with a clean config.
To get the default rules simply reset the router to defaults and they will magically appear.
Then add in your old config bits for setup but not touching the firewall rules.
However since it appears you have no input rules to protect the router itself, it is advisable to ‘swipe’ the router to a clean state,
hence the recommendation for netinstall.
Take the advice or leave it, peace out.
Can you give some examples for input rules that protect the router itself?
I just want to understand the situation.
Take a look factory default configuration
/system default-configuration print
can you explain me with an example, how I destroyed my security with my configuration?
Certain RouterOS versions had really some flaws in them in the sense that IF you ever exposed the mangement interfaces externally (eg. http/https) your device could be hacked! No login needed 
I was under the impression that you had a “default” config (with enabled/active firewall rules rules) hence my remark that what you did extra was pretty OK.
anav, you scared me so much that i’ve just reset the router, reinstalled routeros 6.45 using netinstall and I’ve connected to it’s default ip/credentials.
I went straight to the Firewall window in Winbox, and I find it empty.
Why?
jvanhambelgium, they are talking about some default configuration for the firewall rules that I was somehow missing and that could have had some bad consequences. So I reset and reinstalled RouterOS, and I see no default firewall config to exist.
Where is the mistake?