hi, this script put in black list every ip that try to connect using vpn with false credentials, the first part is for the black list then it has "modules" that are for different vpns, you can copy the whole thing and delete the "modules" that are for vpns that you dont need. i hope you like them i use the log in the router for this and it runs every 5 minutes enjoy them, i have set as first rule a black list rule in the input, fordward of firewall filter and raw so anything from those black listed ip will droop from the start. and copy those rules and set them after the rules that open ports for those vpns
evething works fine my cpu works fine my memory its ok
this script check the log for some items and if those arent in the right way of connection it send those ip to blacklist...
:global ipCommentArray
:set ipCommentArray [:toarray ""]
:local addToBlackList do={
:global ipCommentArray
:local blacklist "Black List"
:foreach entry in=$ipCommentArray do={
:local ip [:pick $entry 0 [:find $entry ";"]]
:local comment [:pick $entry ([:find $entry ";"] + 1) [:len $entry]]
:if ([:len [/ip firewall address-list find where list=$blacklist address=$ip]] = 0) do={
/ip firewall address-list add list=$blacklist address=$ip comment=$comment
/log warning "Bloqueada IP $ip por $comment"
}
}
:set ipCommentArray [:toarray ""]
}
# Bloque para PPTP
{
:local connections [:toarray [/log find where topics~"pptp" && topics~"info" && message~"TCP connection established from"]]
:foreach logEntry in=$connections do={
:local logText [/log get $logEntry message]
:local srcIP [:pick $logText ([:find $logText "from "] + 5) [:len $logText]]
:local logTime [/log get $logEntry time]
:local success [:toarray [/log find where topics~"pptp" && topics~"ppp" && message~"logged in" && message~$srcIP]]
:if ([:len $success] = 0) do={
:set ($ipCommentArray->[:len $ipCommentArray]) "$srcIP;VPN PPTP Attack"
#/log warning "Por bloquear $srcIP por intento sospechoso en VPN PPTP"
}
}
}
# Bloque para IPsec
{
:local logContent
:local ipAddress
:foreach logLine in=[/log find where (topics~"ipsec" and topics~"error" and message~"phase1 negotiation failed")] do={
:set logContent [/log get $logLine message]
:local ipPos [:find $logContent "<=>"]
:if ($ipPos > 0) do={
:local ipStart ($ipPos + 3)
:local ipEnd [:find $logContent "[" $ipStart]
:if ($ipEnd > $ipStart) do={
:set ipAddress [:pick $logContent $ipStart $ipEnd]
#/log warning "Por contenido $ipAddress "
:set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IPSEC Attack"
#/log warning "Por 1 bloquear $ipAddress por intento sospechoso en VPN IPSEC"
}
} else={
:local ipStart [:find $logContent " "]
:if ($ipStart > 0) do={
:set ipAddress [:pick $logContent 0 $ipStart]
:set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IPSEC Attack"
#/log warning "Por 2 bloquear $ipAddress por intento sospechoso en VPN IPSEC"
}
}
}
}
# Bloque para L2TP
{
:local connections [:toarray [/log find where topics~"l2tp" && topics~"info" && message~"first L2TP UDP packet received from"]]
:foreach logEntry in=$connections do={
:local logText [/log get $logEntry message]
:local fromPos ([:find $logText "from "] + 5)
:local portPos [:find $logText " port" $fromPos]
:local srcIP [:pick $logText $fromPos $portPos]
:local logTime [/log get $logEntry time]
:local success [:toarray [/log find where topics~"l2tp" && topics~"info" && message~"logged in" && message~$srcIP]]
:if ([:len $success] = 0) do={
:set ($ipCommentArray->[:len $ipCommentArray]) "$srcIP;VPN L2TP Attack"
#/log warning "Por bloquear $srcIP por intento sospechoso en VPN L2TP "
}
}
}
# Bloque para IKEV/IPsec (Invalid exchange type 243)
{
:local connections [:toarray [/log find where topics~"ipsec" and message~"Invalid exchange type 243 from"]]
:foreach logEntry in=$connections do={
:local logText [/log get $logEntry message]
:local srcIP [:pick $logText ([:find $logText "from "] + 5) [:find $logText "["]]
:set ($ipCommentArray->[:len $ipCommentArray]) "$srcIP;VPN IPSEC IKEV Attack"
#/log warning "Por bloquear $srcIP por intento sospechoso en VPN IPSEC IKEV "
}
}
# Bloque para IKEv2/IPsec (SA_INIT sin autorizaciĂłn)
{
:local logContent
:local ipAddress
:foreach saInitLogs in=[/log find where (topics~"ipsec" and message~"ike2 request, exchange: SA_INIT:")] do={
:set logContent [/log get $saInitLogs message]
:local ipPos [:find $logContent ": SA_INIT:"]
:if ($ipPos> 0) do={
:local ipStart ($ipPos + 12)
:local ipEnd [:find $logContent "[" $ipStart]
:if ($ipEnd > $ipStart) do={
:set ipAddress [:pick $logContent $ipStart $ipEnd]
#/log warning "Por contenido $ipAddress "
#/log warning "Por 1 bloquear $ipAddress por intento sospechoso en VPN IKEv2"
}
:if ([:len $ipAddress] > 0 && [:len [/ip firewall address-list find list="Black List" address=$ipAddress]] = 0) do={
:local valid false;
:local recent [/log find where ((message~$ipAddress && message~"peer authorized") || (message~$ipAddress && message~"acquired "))]
:if ([:len $recent] > 0) do={
:set valid true
}
:if (!$valid) do={
:set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IKEv2 Attack"
}
}
}
}
}
# Bloque para IKEv2/IPsec (AUTH sin autorizaciĂłn)
{
:local logContent
:local ipAddress
:foreach saInitLogs in=[/log find where (topics~"ipsec" and message~"ike2 request, exchange: AUTH:")] do={
:set logContent [/log get $saInitLogs message]
:local ipPos [:find $logContent ": AUTH:"]
:if ($ipPos> 0) do={
:local ipStart ($ipPos + 9)
:local ipEnd [:find $logContent "[" $ipStart]
:if ($ipEnd > $ipStart) do={
:set ipAddress [:pick $logContent $ipStart $ipEnd]
#/log warning "Por contenido $ipAddress "
#/log warning "Por 1 bloquear $ipAddress por intento sospechoso en VPN IKEv2"
}
:if ([:len $ipAddress] > 0 && [:len [/ip firewall address-list find list="Black List" address=$ipAddress]] = 0) do={
:local valid false;
:local recent [/log find where ((message~$ipAddress && message~"peer authorized") && (message~$ipAddress && message~"acquired "))]
:if ([:len $recent] > 0) do={
:set valid true
}
:if (!$valid) do={
:set ($ipCommentArray->[:len $ipCommentArray]) "$ipAddress;VPN IKEv2 Attack"
}
}
}
}
}
$addToBlackList
okey i created those scripts because i need a way to stop attackers that try to access my network using the vpns i have,sadly i need them because i need to connect sometimes from pc or public networks... i have set some firewall too to helpme too
the l2tp conections are blocked usind fht eexample of a bad and good stablished conections
first L2TP UDP packet received from 87.236.176.140 port 37284
but this one dont have any logged in conection
REMOTEiT logged in, 172.16.AAA.BBB from aaa.bbb.ccc.ddd
REMOTEiT: authenticated
so i took the ip from the packet received and search the log if there is no any looged in or athenticated with that ip i put it in the black list
the same with some other ipsec conections
respond new phase 1 (Identity Protection): aaa.bbb.ccc.ddd[500]<=>xxx.zzz.vvv.ddd[56732]
the same with the pptp conections
i used the log info
TCP connection established from aaa.bbb.ccc.ddd
then i search for the ip in message that have this info
RemoteIT logged in,172.16.aaa.bbb from aaa.bbb.ccc.ddd
RemoteIT: authenticated
RemoteIT: connected