Scribd Logo
Upload

Welcome to Scribd!

  • 6 views

    Firewall Basico

    Uploaded by

    Soporte BJ
    This document contains firewall filter rules for a Mikrotik router. It allows common protocols like HTTP, HTTPS, SNMP and blocks DNS requests from WAN. It also implements rules to prevent brute force attacks on FTP ports including logging and blocking sources after multiple failed attempts. DNS settings are also configured to allow remote requests and use public DNS servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Firewall Basico

    Uploaded by

    Soporte BJ
    6 views1 page
    This document contains firewall filter rules for a Mikrotik router. It allows common protocols like HTTP, HTTPS, SNMP and blocks DNS requests from WAN. It also implements rules to prevent brute force attacks on FTP ports including logging and blocking sources after multiple failed attempts. DNS settings are also configured to allow remote requests and use public DNS servers.

    Original Description:

    fire basic

    Original Title

    firewall basico

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document contains firewall filter rules for a Mikrotik router. It allows common protocols like HTTP, HTTPS, SNMP and blocks DNS requests from WAN. It also implements rules to prevent brute force attacks on FTP ports including logging and blocking sources after multiple failed attempts. DNS settings are also configured to allow remote requests and use public DNS servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    6 views1 page

    Firewall Basico

    Uploaded by

    Soporte BJ
    This document contains firewall filter rules for a Mikrotik router. It allows common protocols like HTTP, HTTPS, SNMP and blocks DNS requests from WAN. It also implements rules to prevent brute force attacks on FTP ports including logging and blocking sources after multiple failed attempts. DNS settings are also configured to allow remote requests and use public DNS servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as docx, pdf, or txt
    of 1

    /ip firewall filter

    add action=drop chain=input connection-state=new dst-port=53 in-interface="sfp1


    - WAN" protocol=udp
    add action=drop chain=input connection-state=new dst-port=53 in-interface="sfp1
    - WAN" protocol=tcp
    add action=accept chain=input dst-port=53 protocol=udp
    add action=accept chain=input dst-port=53 protocol=tcp
    add action=accept chain=input comment="Allow SSTP connections" dst-port=443
    protocol=tcp
    add action=accept chain=input comment="Allow Mikrotik Discovery" dst-port=5678
    protocol=udp
    add action=accept chain=input comment="Allow Winbox connections" dst-port=8291
    protocol=tcp
    add action=jump chain=input comment="Brute force login prevent" dst-port=21-23
    jump-target="Brute force login prevent" protocol=tcp
    add action=accept chain=input comment="Allow PPTP connections" dst-port=1723
    protocol=tcp
    add action=accept chain=input comment="Allow SNMP connections" dst-port=161
    protocol=udp
    add action=accept chain=input comment="Allow Mikrotik Web interface" dst-port=80
    protocol=tcp
    add action=accept chain=input comment="Allow Mikrotik API" dst-port=8728,8729
    protocol=tcp
    add action=accept chain=input comment="Accept ICMP" protocol=icmp
    add action=accept chain=input comment="Accept established,related,untracked"
    connection-state=established,related,untracked
    add action=drop chain=input comment="Drop invalid" connection-state=invalid
    add action=drop chain=input comment="Drop all not coming from LAN" in-
    interface="!LAN Bridge"
    add action=fasttrack-connection chain=forward comment="Fasttrack" connection-
    state=established,related
    add action=accept chain=forward comment="Accept established,related, untracked"
    connection-state=established,related,untracked
    add action=drop chain=forward comment="Drop invalid" connection-state=invalid
    add action=drop chain="Brute force login prevent" comment="Block Blacklist
    addresses IPs" src-address-list=blacklist
    add action=add-src-to-address-list address-list=blacklist address-list-
    timeout=none-static chain="Brute force login prevent" comment="Block login error
    3rd Attemp" connection-state=new dst-port=21-23 log=yes protocol=tcp src-
    address-list=\
    login_attemp_stage2
    add action=add-src-to-address-list address-list=login_attemp_stage2 address-
    list-timeout=5m chain="Brute force login prevent" comment="Log login error 2st
    Attemp" connection-state=new dst-port=21-23 protocol=tcp src-address-
    list=login_attemp_stage1
    add action=add-src-to-address-list address-list=login_attemp_stage1 address-
    list-timeout=5m chain="Brute force login prevent" comment="Log login error 1st
    Attemp" connection-state=new dst-port=21-23 protocol=tcp src-address-list=!
    login_attemp_stage2
    add action=accept chain="Brute force login prevent" comment="Accept 21-23 TCP
    connections" dst-port=21-23 protocol=tcp

    /ip dns
    set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8

    You might also like