Brute forcing MikroTik's demo site

RouterOS General
1

I logged in to one of your demo routers and I saw in the log that someone started to brute force the router a few minutes after I logged in. I also discovered a few filter rules at the top in the firewall settings that means that you obviously have some problem with ssh brute forcers. I would add a few rules like the following ones to automatically block the abusers after a few unsuccessful login attempts within a certain time period. This example will add the brute forcers IP address to the blacklist at the fourth connection within a minute. It will give normal users 9 login attempts within a minute before they are added to the blacklist.





Can I have a free beta license now? :smiley:

/ ip firewall filter 
add chain=input protocol=tcp dst-port=22 src-address-list=black_list action=drop \
    comment="drop ssh brute forcers" disabled=no
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage3 action=add-src-to-address-list address-list=black_list address-list-timeout=1d \
    comment="auto-firewall ssh - stage 4" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m \
    comment="auto-firewall ssh - stage 3" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m \
    comment="auto-firewall ssh - stage 2" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m comment="auto-firewall ssh - \
    stage 1" disabled=no
2

I’m not sure that this works as you anticipate. When I experimented with this some time back I found that multiple login attempts could be made within the same tcp connection. As your rules only match a new connection state you don’t see these additional attempts.

Regards

Andrew

3

If you have additional IPs lower than yours, you can action=add-src-to-address-list ips that probe that additional IP, that way if they are trying ssh at all you know they are hacking. Block them the first time.

4

That’s why I wrote 9 login attempts for normal logins, i.e. after the third login attempt, your connection to the host will be lost. Brute forcers usually use a script, and what I’ve seen, they always disconnect after the first login attempt. I’ve been using this method the last 6 months and I’ve never run into any problems, and brute forcers always gets blocked at the fourth login attempt.