Hello,
Firstly, I want to clarify that I’m not a System Engineer or a security expert, so please forgive any shortcomings in my understanding.
Recently, I revisited the firewall settings on my HEXs router, following the example provided in the following link:
https://help.mikrotik.com/docs/display/ROS/Building+Advanced+Firewall
I’ve configured the firewall based on the example, with two exceptions. In the RAW section, I omitted the part related to ICMP filtering and added a rule to drop connections from a manually maintained list of IP addresses (RAW rule nr. 3 bellow).
In my network, I have a Linux server (192.168.0.3) running services on HTTPS, HTTP, and SSH (on port 2203) ports. Using NAT, I’ve opened this ports on the router that point to the server.
Now, upon analyzing the logs of the server 192.168.0.3, I’ve noticed continuous SSH brute force or scanning attempts (I’m not sure) on random ports (not the standard SSH port or my SSH port 2203) originating from an IP address in China:
Apr 28 11:36:54 cloud sshd[28265]: Connection closed by 113.XXX.XXX.XXX port 58753 [preauth]
Apr 28 11:36:54 cloud sshd[28271]: Connection closed by 113.XXX.XXX.XXX port 58927 [preauth]
Apr 28 11:36:54 cloud sshd[28266]: Connection closed by 113.XXX.XXX.XXX port 58782 [preauth]
Apr 28 11:36:54 cloud sshd[28269]: Connection closed by 113.XXX.XXX.XXX port 58840 [preauth]
..... (continue to try on many different ports)
As a response, I’ve banned the IP address on HEXs firewall and logged the activity, which shows attempts on different ports:
banIP_ prerouting: in:ether1 out:(unknown 0), connection-state:invalid src-mac XX:XX:XX:XX:XX:XX, proto TCP (SYN), 113.XXX.XXX.XXX:49987->61.XXX.XXX.XXX:10031, len 40
.....
.....
Now, my question is: How is it possible that these requests reach the server 192.168.0.3 when the firewall is supposed to drop new connections for forwarding on all ports, except for those set to be open on NAT rules? Is this normal?
Below are the firewall rules on my HEXs router:
RAW settings:
0 D ;;; special dummy rule to show fasttrack counters
chain=prerouting action=passthrough
1 X ;;; defconf: enable for transparent firewall
chain=prerouting action=accept
2 ;;; defconf: accept DHCP discover
chain=prerouting action=accept in-interface-list=LAN src-port=68 dst-port=67 protocol=udp src-address=0.0.0.0 dst-address=255.255.255.255
3 ;;; Drop banned IPs
chain=prerouting action=drop log=no log-prefix="banIP_" src-address-list=ban_ip
4 ;;; defconf: drop bogon IP's
chain=prerouting action=drop src-address-list=bad_ipv4
5 ;;; defconf: drop bogon IP's
chain=prerouting action=drop dst-address-list=bad_ipv4
6 ;;; defconf: drop bogon IP's
chain=prerouting action=drop src-address-list=bad_src_ipv4
7 ;;; defconf: drop bogon IP's
chain=prerouting action=drop log=no log-prefix="224_bad_dst" dst-address-list=bad_dst_ipv4
8 ;;; defconf: drop non global from WAN
chain=prerouting action=drop in-interface-list=WAN src-address-list=not_global_ipv4
9 ;;; defconf: drop forward to local lan from WAN
chain=prerouting action=drop in-interface-list=WAN dst-address=192.168.0.0/24
10 ;;; defconf: drop local if not from default IP range
chain=prerouting action=drop in-interface-list=LAN log=no log-prefix="not_lan_adrs" src-address=!192.168.0.0/24
11 ;;; defconf: drop bad UDP
chain=prerouting action=drop port=0 protocol=udp
12 ;;; defconf: jump to TCP chain
chain=prerouting action=jump jump-target=bad_tcp protocol=tcp
13 ;;; defconf: accept everything else from LAN
chain=prerouting action=accept in-interface-list=LAN
14 ;;; defconf: accept everything else from WAN
chain=prerouting action=accept in-interface-list=WAN
15 ;;; defconf: drop the rest
chain=prerouting action=drop
16 ;;; defconf: TCP flag filter
chain=bad_tcp action=drop tcp-flags=!fin,!syn,!rst,!ack protocol=tcp
17 ;;; defconf tcp fin, syn flag
chain=bad_tcp action=drop tcp-flags=fin,syn log=no log-prefix="" protocol=tcp
18 ;;; defconf tcp fin, rst flag
chain=bad_tcp action=drop tcp-flags=fin,rst log=no log-prefix="" protocol=tcp
19 ;;; defconf tcp fin, !ack flag
chain=bad_tcp action=drop tcp-flags=fin,!ack log=no log-prefix="" protocol=tcp
20 ;;; defconf tcp fin, urg flag
chain=bad_tcp action=drop tcp-flags=fin,urg log=no log-prefix="" protocol=tcp
21 ;;; defconf tcp syn, rst flag
chain=bad_tcp action=drop tcp-flags=syn,rst log=no log-prefix="" protocol=tcp
22 ;;; defconf tcp rst, urg flag
chain=bad_tcp action=drop tcp-flags=rst,urg log=no log-prefix="" protocol=tcp
23 ;;; defconf: TCP port 0 drop
chain=bad_tcp action=drop port=0 protocol=tcp
Filter settings:
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; defconf: accept ICMP after RAW
chain=input action=accept protocol=icmp log=no log-prefix=""
2 ;;; defconf: accept established,related, untracked
chain=input action=accept connection-state=established,related,untracked log=no log-prefix=""
3 ;;; defconf: drop all not coming from LAN
chain=input action=drop in-interface-list=!LAN log=no log-prefix="drop_nolan"
4 X ;;; defconf: accept all that matches IPSec policy
chain=forward action=accept ipsec-policy=in,ipsec
5 ;;; defconf: fasttrack accept estabilished related
chain=forward action=fasttrack-connection hw-offload=yes connection-state=established,related log=no log-prefix=""
6 ;;; defconf: accept established,related, untracked
chain=forward action=accept connection-state=established,related,untracked log=no log-prefix=""
7 ;;; defconf: drop invalid
chain=forward action=drop connection-state=invalid log=no log-prefix="invalid"
8 ;;; defconf: drop all from WAN not DSTNATed
chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN
9 ;;; defconf: drop bad forward IPs
chain=forward action=drop src-address-list=no_forward_ipv4
10 ;;; defconf: drop bad forward IPs
chain=forward action=drop dst-address-list=no_forward_ipv4
NAT settings:
0 X ;;; defconf: accept all that matches IPSec policy
chain=srcnat action=accept ipsec-policy=out,ipsec
1 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN log=no log-prefix=""
2 ;;; ssh on 192.168.0.3
chain=dstnat action=dst-nat to-addresses=192.168.0.3 to-ports=2203 protocol=tcp dst-address-type=local dst-port=2203 log=no log-prefix=""
3 ;;; using public address from LAN - ssh 192.168.0.3
chain=srcnat action=masquerade to-ports=2203 protocol=tcp src-address=192.168.0.0/24 dst-address=192.168.0.3 out-interface=bridge dst-port=2203 log=no log-prefix=""
4 ;;; https on 192.168.0.3
chain=dstnat action=dst-nat to-addresses=192.168.0.3 to-ports=443 protocol=tcp dst-address-type=local dst-port=443 log=no log-prefix=""
5 ;;; using public address from LAN - https 192.168.0.3
chain=srcnat action=masquerade protocol=tcp src-address=192.168.0.0/24 dst-address=192.168.0.3 out-interface=bridge dst-port=443 log=no log-prefix=""
6 ;;; http on 192.168.0.3
chain=dstnat action=dst-nat to-addresses=192.168.0.3 to-ports=80 protocol=tcp dst-address-type=local dst-port=80 log=no log-prefix=""
7 ;;; using public address from LAN - http 192.168.0.3
chain=srcnat action=masquerade protocol=tcp src-address=192.168.0.0/24 dst-address=192.168.0.3 out-interface=bridge dst-port=80 log=no log-prefix=""
I’ve gone through the RouterOS documentation regarding the firewall, although being not an expert, I might have missed something. Therefore, I’m seeking advice here.
Thank you