Rules against scanners

RouterOS Security
41

What I meant is that:

You send 65535 TCP SYN packets (that can be done very fast, the packets are tiny) at the router, and 65535 UDP packets. That is guaranteed to activate the 1st add-to-address-list rule.

Then you pause 30 seconds, repeat that. That activates the 2nd rule.

Then you do it again, and again. 6 times if the target has a sequence of 6 ports.

You can even do that 10 times, even if the target only requires a sequence of 3 ports. Your IP address is guaranteed to be added to the allowed list :).

That's why the solution with ICMP is much better. It's rate limited by default, and tracked as connections, sending 5000 ping packets with 5000 sizes will not help you get on the list.

42

And you are already on timeout of first list...
Two time the same port, and you go already out of the list...

And if the second is a UDP port and the third one ICMP...

43

For me, every ‘add-to-address-list’ rule lasts for 2 seconds, which makes things all the more difficult :wink: Only the last ‘secured’ address lasts for 5 minutes. During that time, I’m connected and therefore established,related :wink:

44

I use 30s because the OP has 1m timeout, but you don't have to wait. If the router drops input from WAN by default, no conntrack entry is added to the table. The next packet with the same port will still hit the rule.

That's not a problem, the attacker doesn't need 2 seconds to send 130K sub 100-byte packets towards you (that's 100Mbits) with today's home internet speed. For IPv4 TCP SYN is 40 bytes.

45

Does anyone know of any iOS app that lets me send these ICMP pings in the right order, with a pause in between? (I don’t want to have to keep getting my MacBook out just to do it via Terminal :-P)

46

Glad to stirring up a little wasp nest (good for learning purpose).
Anyway, as said, that's the first time I see these fussy rules in MT, where indeed a "drop all" one does its dirty job....

47

Not sure for ICMP, but for UDP with secret from my example UDP/TCP/REST Network Utility free app can be used.

48

Thanks for letting us know this interesting icmp portknock approach. Maybe considering to change my knock sequence to that.

I am using a 2 step port knock: first knock on some high tcp port, adds to address list with 1s timeout. second knock must be on another high udp port, within the 1s timeout and must match a "content" payload. For that complex sequence I use https://f-droid.org/packages/me.impa.knockonports

49

Yes, it's faster with dedicated port-knocking app, you can get in instantly. The ping method is much slower and manual, due to the conntrack timeout requirement, you really have to wait. But it's great for emergency remote router management without tools on locked down foreign computers (if you put www-ssl behind the address list check).

50

How can i store a udp sequence with this tool ? i use this one:

https://apps.apple.com/at/app/portknock/id358353536

But unfortunately, you can't include secrets in the UDP packets here.

51

There is no port sequence automation in that app, but it’s easy just to change port…

52

I have found a better way with Apple Shortcuts (for macOS and iOS)

Install App "a-Shell mini" (free) -> New shortcut -> Name "Portknock iOS" -> action: execute comand a-shell mini -> insert sequence:

echo -n "secret 1" | nc -u -w 1 my-router.dyndns.org 12345
echo -n "secret 2" | nc -u -w 1 my-router.dyndns.org 23456
echo -n "secret 3" | nc -u -w 1 my-router.dyndns.org 34567

macOS supports the shell natively, but with a-shell mini, the same shortcut works on both macOS and iOS

works like a charm :wink:

br, Richard

53

Great, you find the way, forgot previously to suggest iSH Shell app which I’m using for some things, it also has functionality to create shortcuts for running shell scripts, so it similar to app which you are using. It is Alpine linux based, it has apk package manager for installing cli tools, possibility to mount host dir from iOS, etc…