SSH bruteforcing help?

RouterOS General
1

6 ;;; auto-firewall ssh - stage 1
chain=input action=add-src-to-address-list in-interface=internet
dst-port=22 protocol=tcp address-list=ssh_stage1 address-list-timeout=1m

7 ;;; auto-firewall ssh - stage 2
chain=output action=add-dst-to-address-list content=530 Login incorrect
dst-address-list=ssh_stage1 address-list=ssh_stage2
address-list-timeout=1m

8 ;;; auto-firewall ssh - stage 3
chain=output action=add-dst-to-address-list content=530 Login incorrect
dst-address-list=ssh_stage2 address-list=ssh_stage3
address-list-timeout=1m

9 ;;; auto-firewall ssh - stage 4
chain=output action=add-dst-to-address-list content=530 Login incorrect
dst-address-list=ssh_stage3 address-list=ssh_stage4
address-list-timeout=1m
10 ;;; auto-firewall ssh - stage 5
chain=output action=add-dst-to-address-list content=530 Login incorrect
dst-address-list=ssh_stage4 address-list=ssh_blacklist
address-list-timeout=1w

11 ;;; drop ssh brute forcers
chain=input action=drop in-interface=internet dst-port=22 protocol=tcp
src-address-list=ssh_blacklist

I have these rules in firewall filter, to prevent ssh attacking, but not work well, Could you help or give better idea to prevent ssh attacks?

2

or you can write what working for you

3

Run SSH on a non standard port? /ip service…

Create input rules in your firewall, and do not allow everyone to connect to your router via SSH? I always find it mind bothering that everyone complains because the whole world comes down brute forcing passwords via SSH, but no attempt is made to secure SSH in the first place… -sigh-

4

[R-C@MikroTik] ip service> print
Flags: X - disabled, I - invalid

NAME PORT ADDRESS CERTIFICATE

0 telnet 23 0.0.0.0/0
1 ftp 21 0.0.0.0/0
2 www 80 0.0.0.0/0
3 ssh 21 0.0.0.0/0
4 X www-ssl 443 0.0.0.0/0 none

You mean this? I changed the ssh port(original 22) to 21(ftp port). Can it be?

5

Yup…

However, that should be seen as a invalid configuration IMHO… Can’t have SSH and FTP listening on port 21…

6

This is what I use - blocks ssh/telnet/ftp from outside our network (networks other than the two in the example:

/ ip firewall filter
add chain=input src-address=10.0.0.0/8 protocol=tcp dst-port=21-23 \
    action=accept comment="" disabled=no
add chain=input src-address=69.39.96.0/20 protocol=tcp dst-port=21-23 \
    action=accept comment="" disabled=no
add chain=input src-address=0.0.0.0/0 protocol=tcp dst-port=21-23 \
    action=reject reject-with=icmp-network-unreachable comment=""

One must VPN into the network in order to use ssh/ftp/telnet to our MTs.