Prevent SSH & FTP attacks to Mikrotik

Prevent attacks to your Mikrotik router

If you have  a valid static IP address on your router interface then you have to be cautious and prevent any unwanted login.

This configuration allows only 10 FTP login incorrect answers per minute

in  /ip firewall filter

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \

comment="drop ftp attack"

add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \

address-list=ftp_blacklist address-list-timeout=1h

This will prevent  an unwanted ssh attempt
in /ip firewall filter

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \

comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \

src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \

address-list-timeout=2h comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \

src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \

address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \

action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \

address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

If you want to block downstream access as well, you need to block the with the forward chain:

add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \

comment="drop ssh brute downstream" disabled=no

To view the Blacklist, go to "/ip firewall address-list" and type "print"

Cisco 2811 as PPTP VPN Server

 

We can use a cisco 2800 series router as a VPN server in a network, it can be used in a medium business, so there is a sample configuration for cisco 2811 as a PPTP VPN server:

Building configuration...

Current configuration : 1236 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
resource policy
!
ip subnet-zero
!
!
ip cef
!
 --More--         !
vpdn enable
!
vpdn-group vpn
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
!
!
!
voice-card 0
 no dspfarm
!
!
!
!
!
!
!
!
!
!
 --More--         !
!
!
!
!
username test password 0 test
!
!
!
!
!
!
!
interface Loopback0
 ip address 200.200.200.200 255.255.255.255
!
interface FastEthernet0/0
 ip address 210.10.10.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 --More--         shutdown
 duplex auto
 speed auto
!
interface Serial0/0/0
 no ip address
 shutdown
 no fair-queue
 clock rate 2000000
!
interface Serial0/0/1
 no ip address
 shutdown
 clock rate 2000000
!
interface Virtual-Template1
 ip unnumbered FastEthernet0/0
 peer default ip address pool vpn
 ppp encrypt mppe auto required
 ppp authentication ms-chap ms-chap-v2
!
ip local pool vpn 100.0.0.1 100.0.0.10
ip classless
 --More--         !
!
ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
 --More--         login
!
scheduler allocate 20000 1000
!
end

Router#