Mikrotik Standard Firewall rules + useful settings 

Firewall settings

/ip firewall filter

add action=accept chain=forward comment=”Accepted Connections” \

connection-state=established disabled=no

add action=accept chain=input comment=”” disabled=no dst-port=80 protocol=tcp

add action=accept chain=input comment=”” disabled=no dst-port=25 protocol=tcp

add action=drop chain=forward comment=”Drop invalid connections” \

connection-state=invalid disabled=no

Drop Virus Port

/ip firewall filter

add action=drop chain=forward comment=”Drop Virus Port” disabled=no \

dst-port=40016 protocol=udp

add action=drop chain=virus comment=”” disabled=no dst-port=135-139 protocol=\

udp

add action=drop chain=virus comment=”” disabled=no dst-port=135-139 protocol=\

tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1433-1434 \

protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=445 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=445 protocol=udp

add action=drop chain=virus comment=”” disabled=no dst-port=593 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1024-1030 \

protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1080 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1214 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1363 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1364 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1368 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1373 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=1377 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=2745 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=2283 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=2535 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=2745 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=3127 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=3410 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=4444 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=4444 protocol=udp

add action=drop chain=virus comment=”” disabled=no dst-port=5554 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=8866 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=9898 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=10080 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=12345 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=17300 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=27374 protocol=tcp

add action=drop chain=virus comment=”” disabled=no dst-port=65506 protocol=tcp

Drop Port Scanner

/ip firewall filter

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”Drop Port Scanner” disabled=\

no protocol=tcp psd=21,3s,3,1

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=fin,!syn,!rst,!psh,!ack,!urg

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=fin,syn

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=fin,syn,rst,psh,ack,urg

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=syn,rst

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=fin,psh,urg,!syn,!rst,!ack

add action=add-src-to-address-list address-list=PortScanner \

address-list-timeout=2w chain=input comment=”” disabled=no protocol=tcp \

tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg

add action=drop chain=input comment=”” disabled=no src-address-list=\

PortScanner

Drop Brute Force

/ip firewall filter

add action=accept chain=output comment=”Drop Brute Force” content=\

“530 Login incorrect” disabled=no dst-limit=1/1m,9,dst-address/1m \

protocol=tcp

add action=add-dst-to-address-list address-list=Blacklist \

address-list-timeout=23h chain=output comment=”” content=\

“530 Login incorrect” disabled=no protocol=tcp

add action=drop chain=input comment=”” disabled=no dst-port=22 protocol=tcp \

src-address-list=Blacklist

Drop Trace route

/ip firewall filter

add action=drop chain=forward comment=”Drop Traceroute” disabled=no \

icmp-options=11:0 protocol=icmp

add action=drop chain=forward comment=”” disabled=no icmp-options=3:3 \

protocol=icmp

add action=drop chain=input comment=”” disabled=no protocol=\

icmp src-address-list=!Local

Drop ICMP Ping

/ip firewall filter

add action=drop chain=input comment=”Drop ICMP Ping” disabled=no protocol=\

icmp

Drop Netcut Attack

/ip firewall filter

add action=accept chain=input comment=”NETCUT BLOCK” disabled=no dst-port=\

0-65535 protocol=tcp src-address=61.213.183.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=67.195.134.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=68.142.233.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=68.180.217.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=203.84.204.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=69.63.176.0/24

add action=accept chain=input comment=”” disabled=no dst-port=0-65535 \

protocol=tcp src-address=69.63.181.0/24

Block Mikrotik from discovery 

/tool mac-server

add disabled=yes interface=all

/tool mac-server ping

set enabled=no

/ip firewall filter

add action=drop chain=input comment=”block mikrotik discovery” disabled=no dst-port=5678 protocol=udp

add action=drop chain=input comment=”ALL WINBOX REQUEST By MAC Address” disabled=no dst-port=20561 protocol=udp

add action=drop chain=input comment=”ALL WINBOX REQUEST EXCEPT FROM MY PC” disabled=no dst-port=8291 protocol=tcp src-address=!192.168.2.6

Allow VPN (PPTP) Connections for Mikrotik VPN Server

\ip firewall filter

add action=accept chain=input disabled=no dst-port=1723 protocol=tcp

add action=accept chain=input disabled=no protocol=gre

 Sumber : Mikrotik Standard Firewall rules + useful settings – http://wp.me/p8hKmO-Z

Advertisements

Leave a Reply