Skip to main content

Mikrotik Bruteforce Login Prevention

Reference: WIKI

FTP Bruteforce prevention

This configuration allows only 10 FTP login incorrect answer per minutes

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop comment="drop ftp brute forcers"

add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" address-list=ftp_blacklist address-list-timeout=3h

SSH Bruteforce prevention

This will prevent SSH bruteforcer to be banned for 10 days after repetitive attemps
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no
Example blocked IP address list:

Labels:

Comments

Post a Comment

Popular posts from this blog

Notes: about de novo assembly

De novo assembly [SFG standford]: http://sfg.stanford.edu/denovo.html A combined approach for de novo dna sequence assembly of very short reads (IPSJ transaction on Bioinformatics): https://www.jstage.jst.go.jp/article/ipsjtbio/4/0/4_0_21/_article to be continued...
Post a Comment
Read more

Ping Statistic Smartfren

Gambar diatas adalah hasil tangkapan layar ping statistics ke facebook.com menggunakan jaringan smartfren. Meski indikator sinyal EVDO menunjukkan full bar , tetap saja bukan jaminan akan mendapatkan koneksi stabil, gambar tersebut adalah buktinya. Statistik ping tersebut diambil pada malam hari antara pukul 22.00 s.d. 01.00. Loss yang didapatkan cukup tinggi, yaitu sebesar 14%. Jangkauan (coverage area) jaringan smartfren yang sudah mendukung EVDO Rev.A sudah cukup luas, hanya saja terkadang koneksinya tidak stabil. Bisa jadi karena pengguna internet dalam BTS tersebut penuh, sehingga bandwidth nya pun harus sharing dengan banyak pengguna . Beberapa waktu lalu, ketika saya menginap di Guest House Kebun Raya Cibodas, saya mendapatkan sinyal EVDO smartfren. Karena (mungkin) penggunanya sedikit, koneksinya stabil dan cepat. Padahal, jaringan GSM di guest house terbebut hanya mendapatkan EDGE, tetapi smartfren malah dapat EVDO. 
Post a Comment
Read more