unknown access attempts

RouterOS General
1

Hello All,
This is the first time i write on this forum, I am not an expert but i can get by.
My problem is… after putting a public ip, i receive these access attempts through SSH.
Can anyone tell me what they are, and if it is possibile to block them.
Sorry for the english as it is not my language :slight_smile:
Thanks
Carlos
log mikrotik.JPG

2

There are multiple programs, which are trying to abuse your router with SSH login attempts.
Possible solution for the problem;

  • setup firewall and allow SSH only for known IP addresses;
  • setup address at /ip service field for SSH server (only one IP address/subnet is allowed there);
  • set different port for SSH access.
3

You could block after so many failed attempts in a certain time limit. This is posted in other forums -

add action=drop chain=input comment=“drop ssh brute forcers” disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=1w3d chain=input comment=“” connection-state=new
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m chain=input comment=“” connection-state=new
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m chain=input comment=“” connection-state=new
disabled=no dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m chain=input comment=“” connection-state=new
disabled=no dst-port=22 protocol=tcp

4

Or just disable SSH on your RB if you don’t need it.

IP → Services → Disable ssh

If you don’t need any of these services, you should disable all of them except winbox and if you using web-interface, keep www enabled too.

5

Thanks a lot folks, i followed your advice. I changed the port and resolved my problem.
:smiley:
Carlos