Forum

Olá pessoal.

Só para compartilhar com vocês.

Tenho notado muitas tentativas de ataque por força bruta no log do meu mikrotik.

Então vamos a solução Essas regras que eu to postando aqui ela ira adicionar a uma black list o ip "atacante" que tentar mais de 3 vezes logar no ssh do mikrotik.

Retirado do Wiki do Mikrotik.

Segue export.

/ip firewall filter

add action=drop chain=input comment="Drop ssh brute forcers" disabled=no dst-port=22 \
protocol=tcp src-address-list=ssh_blacklist

add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=4w2d \
chain=input comment="" connection-state=new disabled=no dst-port=22 protocol=tcp \
src-address-list=ssh_stage3

add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=\
input comment="" connection-state=new disabled=no dst-port=22 protocol=tcp \
src-address-list=ssh_stage2

add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=\
input comment="" connection-state=new disabled=no dst-port=22 protocol=tcp \
src-address-list=ssh_stage1

add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=\
input comment="" connection-state=new disabled=no dst-port=22 protocol=tcp