Hi everyone, been a while since I’ve done a new config on my router so I figured I’d post here for a config review. If you see anything obviously wrong, missing anything that puts me at risk, or just likely to kill my my overall internet throughput performance I’d love to get your feedback. This is …

I would put add action=add-src-to-address-list address-list=\ "Black List (Port Scanner LAN)" address-list-timeout=4w2d chain=forward \ comment="Add TCP port scanner to Port Scanner (LAN) list." in-interface=\ ether1 log=yes log-prefix="Add_Black List (Port Scanner LAN)" protocol=\ …

There’s a philosophy that there should be an unconditional drop in any chain (input, forward) at the end … so when a connection is not explicitly allowed, it gets dropped. So no need to have this conditional drop (condition is that src-address is on black list) at the end. On the contrary, you want …

On the contrary, you want to have this drop at very beginning of forward (and input) chain so that trespassers get dropped also for services which otherwise are available to the public. If not, then there’s no point in collecting addresses in the address list. Thank you for the correction. I gu…

I would ditch all the blacklist / port scan detect / etc stuff. This kind of thing just opens you up to a resource exhaustion attack and can even result in blacklisting legitimate traffic if an attacker has IP spoofing capabilities. The CPUs on these devices are not powerful enough to this kind of s…

Thanks for the feedback. I’ll take a look and make some changes. As it is right now, none of the bruteforce/scanning rules are showing any traffic anyway.

As it is right now, none of the bruteforce/scanning rules are showing any traffic anyway. What a surprise. :wink: You created reasonable firewall for input chain with just those four rules at the beginning. Rule #4 is unconditional drop, nothing will ever get past that. So all following rules w…

I agree, I am coming to the conclusion that a list of common ports (that the router users dont need 20,21,22,23, 139, 8192 etc) in RAW, capturing source address for six days and then dropping them in raw, should catch most of the bad guys probing around full stop and not load up the cpu. (besides s…

It is my way of “drop it ASAP” if attacker scans us again (is already on the list) then drop it right now. A. check if unwanted port is checked. B. if yes, add attacker to the ban list C. drop all packets coming from attacker list /ip firewall raw add action=accept chain=prerouting dst-port=p…

Exactly BartoszP, with that type of ruleset and approach I think most badguys probing/scanning will be caught and with least load on CPU and just a few rules in raw. Notes: 1 - One should be careful because RAW is stateless it doesnt care if a packet is established, related, it doesnt discriminat…

If I’m not doing Winbox from WAN, do I need the rule “add action=accept chain=prerouting dst-port=portofwinboxserviceprotocol=tcp” from BartozP’s rule set? After making some changes, I now have the following firewall ruleset with everything set to interface lists. /ip firewall address-list add lis…

Config Review - Security Conscience Home User

RouterOS General

inteq February 12, 2019, 8:03am 4

Thank you for the correction. I guess too early in the morning and not enough coffee.