I use ftp function on router. But there are attempts to log in with brute force every day. I changed port 21 to 24 in IP>Services on ftp. I changed the port in firewall settings (all firewall settings are below). When I connect from router network (192.168.3.) it works. But when I connect from outside it doesn’t work. In log from filezilla I see that it is Logged in, but there is error when listing directory. Where is possible to be the problem?
FileZilla log:
Status: Connecting to _MyIP_:24...
Status: Connection established, waiting for welcome message...
Status: Insecure server, it does not support FTP over TLS.
Status: Server does not support non-ASCII characters.
Status: Logged in
Status: Retrieving directory listing...
Command: PWD
Response: 257 "/" is current directory
Command: TYPE I
Response: 200 Type set to I
Command: PASV
Response: 227 Entering Passive Mode (_MyIP_,182,167).
Command: LIST
Response: 425 Can't build data connection
Error: Failed to retrieve directory listing
You should rethink your approach. Changing port will not stop bruteforcing. Someone will rescan your external IP and start bruteforcing that new port. You need to set up a firewall rule that blocks traffic from that ip if such bruteforce attempt is made.
The attempt are from different IP every time. The another way is the last 3 rules in my firewall settings (they are disable, because they are not work properly). But more easy way is change default port. I hope the “hackers” scanned only default port. Ok if somebody try to find ftp on my IP he will succeed, but in this time I want to prevent from random scanning for open 21 port.
Really? So… plan “B”!
In the firewall there are rules for brute force attack - if some ip send n wrong passwords block this ip for 1 day. I added these rules year ago, but there was some problem. I don’t remember. I disabled them, I didn’t use ftp from this time. I will test again and I will write what is the problem
Well that is just the way MT works. I have a bunch of such rules for every open port or portscan attempt. One solution would be to change default ftp port and create port scan detection rules. So the scriptkiddies cant enumerate your ports so they would fly blind.
And put them above all other rules. That should stop the bad guys from enumerating your ports. You can test them out with nmap or some other port scan software. Just remember to disable the drop rule while testing.
Thanks CodeXploit!
I added the rules. I tested with Nmap - Zenmap and they block the IP.
But if I check if port 21 (or other) is open from web site (for example http://www.yougetsignal.com/tools/open-ports/) it says “Port 21 is open” and the router didn’t catch the IP.
The established,related rule is important because the data channel is a “related” connection to any established ftp sessions. Furthermore, it will allow established ftp sessions to continue even after the knock_authentication times out.
The way this works is the client sends a series of packets that opens the FTP service for a short period for the IP address that originated the correct combination. It doesn’t all have to be UDP like in my example. There are free applications that can send a series of port knock packets.
So once the knock is successful, the client has a 5 minute window where they may connect to the FTP service on the router. Once connected, the established,related rule will let the session continue even after the knock window closes.
Port knocking is a measure to increase security by adding “security in depth” - it’s not the same as “security by obscurity” - and it has the benefit of preventing robots from connecting to the FTP port and attempting to brute force login. You could protect all of your services on the Mikrotik with this method. In fact, I should do this on my home router since it won’t let me in from my hotel IP address right now…
I added the rules, but scanning from the web site doesn’t block.
And another note: I am looking for android audio player which can plays files from ftp server. I am testing Neutron (Eval) and when I start playing the router blocks the android device IP
Well that is OK. The port is open, so… that is why i said to use port above 50000 there are rearly some scriptkiddies that scan ports that high. The favorite range is 1 - 1024, most commonly used ports, and some other specific ports like 3389 etc… . And all of them use tools like nmap. But if they want to manualy enumerate 65k ports via website… then let them have their fun. These rules are not buletproof, but it will stop 98%of the people who scan IP ranges and common ports so you will not popup for detailed scanning.
I usualy when i dont know whats blocking specific traffic reset all counters to 0 and start the program/service and look at the block rules if one of them is incrementing.
