Script: port knocking mikrotik-mikrotik ?

What tools can used to “port knocking”?

IP, port, tcp/udp, number of packages, delay packet sending, package size

or as a the minimum version

IP, port, tcp/udp, package size

ping - unsuitable
system telnet - unsuitable

Which there are more options in the RouterOS for this task? :frowning:

Thank you.
Best regards.





PS: for mikrotik-team: there may be an error?
http://joxi.ru/nAyX4L8cWR462Z

tools telnet       
bad command name tools (line 1 column 1)

[/size]

Wouldn’t be a better approach to use VPNs?

Proper CLI syntax for telnet on ROS 6.x AFAIK is:

/system telnet

You can use the tab key and commands will get autocompleted.

there are many guides on forum and internet about port knocking

http://forum.mikrotik.com/search.php?keywords=

Thank you for your interest in my question.
In the first post I wrote: telnet - It does not have the desired functionality.

system telnet  
<address> -- IP address of host
<port> -- Port number
routing-table --

need - IP, port, tcp/udp, package size

[sarcasm]That’s great! Very nice! Very many thanks![/sarcasm] :confused:

Before advising “search”, you yourself found it something that I’ve been asked?

“How to implement “port knoking” with RouterOS? (need options: IP, port, tcp/udp, package size)”

As I already said using port knocking to access between two routers is not a “best practice”, you’re over complicating yourself.

If you want to add security use any of the various VPN tunnels available, SSTP is a great protocol for tunnelling between two Mikrotik Routers in terms of performance, security and convenience.

You can even program firewall rules in a fail2ban way so that scanners get banned, see http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention by applying this technique over the ports the VPN server is using.

However as the port knocking on the server side is something you should manually achieve by using lists and the various firewall filter rules available, (http://wiki.mikrotik.com/wiki/Port_Knocking) you can get creative if you want to, and craft whichever sequence you like to open the port on the server side, and use Tools > Traffic generator on the client side to send whatever you want, see http://wiki.mikrotik.com/wiki/Manual:Tools/Traffic_Generator

In any case, there’s no pre-cooked or “in built” port knocking feature in ROS neither for the server or the client side.

The best you can do is send a port knock from a PC that’s behind the “client” router, assuming the router is doing NAT.
ROS doesn’t have a packet generation tool - if it did, you could script a port knock, but since there’s not one, you can’t do it.