User Tools
networking:router:mikrotik_fw
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
networking:router:mikrotik_fw [2014/07/06 14:26] gcooper |
networking:router:mikrotik_fw [2022/07/22 10:06] (current) gcooper |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Mikrotik RouterOS Firewall ====== | ====== Mikrotik RouterOS Firewall ====== | ||
| - | |||
| - | http:// | ||
| ===== Denial of Service ===== | ===== Denial of Service ===== | ||
| Line 27: | Line 25: | ||
| ===== Destination NAT (Port Forwarding) Examples ===== | ===== Destination NAT (Port Forwarding) Examples ===== | ||
| - | :!: "Destination NAT" | + | :!: '' |
| - | :!: With Mikrotik RouterOS, you don't have to add a separate | + | :!: With Mikrotik RouterOS, you do not add an explicit '' |
| < | < | ||
| Line 48: | Line 46: | ||
| http:// | http:// | ||
| - | Normal ' | + | Normal |
| < | < | ||
| /ip firewall nat | /ip firewall nat | ||
| - | + | add action=masquerade chain=srcnat comment=" | |
| - | add action=masquerade chain=srcnat comment=" | + | |
| </ | </ | ||
| Line 77: | Line 74: | ||
| ===== Basic Firewall ===== | ===== Basic Firewall ===== | ||
| + | |||
| + | FIXME This basic firewall script needs modernization, | ||
| Firewall/ | Firewall/ | ||
| Line 144: | Line 143: | ||
| http:// | http:// | ||
| + | |||
| + | ==== Country Code ==== | ||
| + | |||
| + | :!: This is probably **for more powerful routers with lots of RAM** as it could add many rules. | ||
| + | |||
| + | :!: You probably want to put the rules **near the top** of the list. | ||
| + | |||
| + | **Country Code List**: https:// | ||
| + | |||
| + | - **Create the script/ | ||
| + | - **Copy the '' | ||
| + | - **Import the script** | ||
| + | - **Create a firewall rule** referencing the new address list | ||
| + | |||
| + | < | ||
| + | /import IP-Firewall-Address-List.rsc | ||
| + | /ip firewall filter | ||
| + | add action=drop chain=input comment=" | ||
| + | log-prefix=" | ||
| + | add action=drop chain=forward comment=" | ||
| + | log-prefix=" | ||
| + | </ | ||
| ==== FTP ==== | ==== FTP ==== | ||
| Line 153: | Line 174: | ||
| :!: This appears to be specific to the response of the Mikrotik FTP service ('' | :!: This appears to be specific to the response of the Mikrotik FTP service ('' | ||
| - | :!: To have the attacker blocked completely, you can probably just remove the '' | + | :!: **To have the attacker blocked completely**, you can probably just **remove** the '' |
| This example allows only 10 FTP login incorrect answers per minute, then bans the attacker (from FTP) for 10 days: | This example allows only 10 FTP login incorrect answers per minute, then bans the attacker (from FTP) for 10 days: | ||
| Line 394: | Line 415: | ||
| * NAT Traversal (NAT-T) | * NAT Traversal (NAT-T) | ||
| - | Accept L2TP/IPSec: | + | Accept L2TP/ |
| :!: These rules could be further limited by interface and/or source address. | :!: These rules could be further limited by interface and/or source address. | ||
networking/router/mikrotik_fw.1404678371.txt.gz · Last modified: 2014/07/06 14:26 by gcooper
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
