Block IP after X login failures

RouterOS General
1

Is there a way to automatically block IP-adresses after X times login failures and put them on the block list for XX hours?

So if host 66.344.222.35 is trying to login in my routerboard 5 times and do not succed, routerboard automatically put this IP to drop packets from it on the firewall.

is that possible?


Regards Peter

2

No, not natively supported.

You could, however, parse the log for failed login attempts, disabling accounts (or block IP) once a threshold is reached.
This should get you started: Log Parser - Event Trigger Script

3

To block ssh and ftp bruteforcers, use this one
http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention

4

I can see the ip in the blacklist, however, the ip in the blacklist still attempting to access according to the log …

5

You need to put in a filter rule (preferably in the RAW table) to block the blacklisted IP’s

6

end up, i add this in:
add chain=input src-address-list=ssh_blacklist action=drop comment=“drop ssh brute forcers IP” disabled=no

7

That’s find, but make sure that the rule is placed above any accept rule for established connections.