Workshop Firewall Drop port scanners /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list addresslist="port

Transcription

1 Workshop Firewall Drop port scanners /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list addresslist="port scanners" address-list-timeout=2w comment="port scanners to list " disabled=no add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg address-list-timeout=2w comment="nmap FIN Stealth scan" add chain=input protocol=tcp tcp-flags=fin,syn address-list-timeout=2w comment="syn/fin scan" add chain=input protocol=tcp tcp-flags=syn,rst address-list-timeout=2w comment="syn/rst scan" add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack address-list-timeout=2w comment="fin/psh/urg scan" add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg address-list-timeout=2w comment="all/all scan" add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg address-list-timeout=2w comment="nmap NULL scan" add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no Redirect mail traffic to a specified server p firewall nat add chain=dstnat protocol=tcp dst-port=25 action=dst-nat toaddresses= ( ip server ) to-ports=25

2 Block Websites & Stop Downloading Using Proxy /ip proxy enabled: yes src-address: port: 8080 parent-proxy: :0 cache-drive: system cache-administrator: "webmaster" max-disk-cache-size: none max-ram-cache-size: none cache-only-on-disk: no maximal-client-connections: 1000 maximal-server-connections: 1000 max-object-size: 512KiB max-fresh-time: 3d Now, Make it Transparent /ip firewall nat chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 Make sure that your proxy is NOT a Open Proxy /ip firewall filter chain=input in-interface=<your WAN Port> src-address= /0 protocol=tcp dstport=8080 action=drop Now for Blocking Websites /ip proxy access dst-host= action=deny We can also stop downloading files like.mp3,.exe,.dat,.avi, etc. /ip proxy access path=*.exe action=deny path=*.mp3 action=deny path=*.zip action=deny path=*.rar action=deny. /ip proxy access dst-host=:mail action=deny

3 How to autodetect infected or spammer users and temporary block the SMTP output /ip firewall filter add chain=forward protocol=tcp dst-port=25 src-address-list=spammer action=drop comment="block SPAMMERS OR INFECTED USERS" add chain=forward protocol=tcp dst-port=25 connection-limit=30,32 limit=50,5 action=add-src-to-address-list address-list=spammer address-list-timeout=1d comment="detect and add-list SMTP virus or spammers" /system script add name="spammers" source=":log error \" Users detected like \ SPAMMERS \"; \n:foreach i in \[/ip firewall address-list find \ list=spammer\] do={:set usser \[/ip firewall address-list get \$i \ address\]; \n:foreach j in=\[/ip hotspot active find address=\$usser\] \ do={:set ip \[/ip hotspot active get \$j user\]; \n:log error \$ip; \n:log \ error \$usser} };" policy=ftp,read,write,policy,test,winbox Protect customer /ip firewall filter add chain=forward connection-state=established comment="allow established connections" add chain=forward connection-state=related comment="allow related connections" add chain=forward connection-state=invalid action=drop comment="drop invalid connections" add chain=virus protocol=tcp dst-port= action=drop comment="drop Blaster Worm" add chain=virus protocol=udp dst-port= action=drop comment="drop Messenger Worm" add chain=virus protocol=tcp dst-port=445 action=drop comment="drop Blaster Worm" add chain=virus protocol=udp dst-port=445 action=drop comment="drop Blaster Worm" add chain=virus protocol=tcp dst-port=593 action=drop comment=" " add chain=virus protocol=tcp dst-port= action=drop comment=" "

4 add chain=virus protocol=tcp dst-port=1080 action=drop comment="drop MyDoom" add chain=virus protocol=tcp dst-port=1214 action=drop comment=" " add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" add chain=virus protocol=tcp dst-port= action=drop comment="worm" add chain=virus protocol=tcp dst-port=2745 action=drop comment="bagle Virus" add chain=virus protocol=tcp dst-port=2283 action=drop comment="drop Dumaru.Y" add chain=virus protocol=tcp dst-port=2535 action=drop comment="drop Beagle" add chain=virus protocol=tcp dst-port=2745 action=drop comment="drop Beagle.C-K" add chain=virus protocol=tcp dst-port= action=drop comment="drop MyDoom" add chain=virus protocol=tcp dst-port=3410 action=drop comment="drop Backdoor OptixPro" add chain=virus protocol=tcp dst-port=4444 action=drop comment="worm" add chain=virus protocol=udp dst-port=4444 action=drop comment="worm" add chain=virus protocol=tcp dst-port=5554 action=drop comment="drop Sasser" add chain=virus protocol=tcp dst-port=8866 action=drop comment="drop Beagle.B" add chain=virus protocol=tcp dst-port=9898 action=drop comment="drop Dabber.A-B" add chain=virus protocol=tcp dst-port=10000 action=drop comment="drop Dumaru.Y" add chain=virus protocol=tcp dst-port=10080 action=drop comment="drop MyDoom.B" add chain=virus protocol=tcp dst-port=12345 action=drop comment="drop NetBus" add chain=virus protocol=tcp dst-port=17300 action=drop comment="drop Kuang2" add chain=virus protocol=tcp dst-port=27374 action=drop comment="drop SubSeven" add chain=virus protocol=tcp dst-port=65506 action=drop comment="drop PhatBot, Agobot, Gaobot" add chain=forward action=jump jump-target=virus comment="jump to the virus chain" add chain=forward action=accept protocol=tcp dst-port=80 comment="allow HTTP" add chain=forward action=accept protocol=tcp dst-port=25 comment="allow SMTP" add chain=forward protocol=tcp comment="allow TCP" add chain=forward protocol=icmp comment="allow ping" add chain=forward protocol=udp comment="allow udp" add chain=forward action=drop comment="drop everything else" Firewall Komplit Components of the filter protocol classifier invalid packet filter port-scan detector

5 policy classifier application protocol filter TCP-specific filters application protocol specific filters / ip firewall mangle add chain=prerouting protocol=tcp connection-state=new action=jump jump-target=tcpservices add chain=prerouting protocol=udp connection-state=new action=jump jump-target=udpservices add chain=prerouting connection-state=new action=jump jump-target=other-services add chain=tcp-services protocol=tcp src-port= dst-port=20-21 action=markconnection new-connection-mark=ftp passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=22 action=markconnection new-connection-mark=ssh passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=23 action=markconnection new-connection-mark=telnet passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=25 action=markconnection new-connection-mark=smtp passthrough=no add chain=tcp-services protocol=tcp src-port=53 dst-port=53 action=mark-connection new-connection-mark=dns passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=53 action=markconnection new-connection-mark=dns passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=80 action=markconnection new-connection-mark=http passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=110 action=markconnection new-connection-mark=pop3 passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=113 action=markconnection new-connection-mark=auth passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=119 action=markconnection new-connection-mark=nntp passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=143 action=markconnection new-connection-mark=imap passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=snmp passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=443 action=markconnection new-connection-mark=https passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=465 action=markconnection new-connection-mark=smtps passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=993 action=markconnection new-connection-mark=imaps passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=995 action=markconnection new-connection-mark=pop3s passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=1723 action=markconnection new-connection-mark=pptp passthrough=no

6 add chain=tcp-services protocol=tcp src-port= dst-port=2379 action=markconnection new-connection-mark=kgs passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=3128 action=markconnection new-connection-mark=proxy passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=3389 action=markconnection new-connection-mark=win-ts passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=emule passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=overnet passthrough=no add chain=tcp-services protocol=tcp src-port=4711 dst-port= action=markconnection new-connection-mark=emule passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=vnc passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=irc passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port= action=mark-connection new-connection-mark=bittorrent passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=8080 action=markconnection new-connection-mark=http passthrough=no add chain=tcp-services protocol=tcp src-port= dst-port=8291 action=markconnection new-connection-mark=winbox passthrough=no add chain=tcp-services protocol=tcp action=mark-connection new-connectionmark=other-tcp passthrough=no add chain=udp-services protocol=udp src-port= dst-port=53 action=markconnection new-connection-mark=dns passthrough=no add chain=udp-services protocol=udp src-port= dst-port=123 action=markconnection new-connection-mark=ntp passthrough=no add chain=udp-services protocol=udp src-port= dst-port=1701 action=markconnection new-connection-mark=l2tp passthrough=no add chain=udp-services protocol=udp src-port= dst-port=4665 action=markconnection new-connection-mark=emule passthrough=no add chain=udp-services protocol=udp src-port= dst-port=4672 action=markconnection new-connection-mark=emule passthrough=no add chain=udp-services protocol=udp src-port=4672 dst-port= action=markconnection new-connection-mark=emule passthrough=no add chain=udp-services protocol=udp src-port= dst-port=12053 action=markconnection new-connection-mark=overnet passthrough=no add chain=udp-services protocol=udp src-port=12053 dst-port= action=markconnection new-connection-mark=overnet passthrough=no add chain=udp-services protocol=udp src-port=36725 dst-port= action=markconnection new-connection-mark=skype passthrough=no add chain=udp-services protocol=udp connection-state=new action=mark-connection new-connection-mark=other-udp passthrough=no

7 add chain=other-services protocol=icmp icmp-options=8:0-255 action=mark-connection new-connection-mark=ping passthrough=no add chain=other-services protocol=gre action=mark-connection new-connectionmark=gre passthrough=no add chain=other-services action=mark-connection new-connection-mark=other passthrough=no Most generic invalid packet and port-scan detection techniques /ip firewall mangle add chain=prerouting in-interface=public dst-address-list=nat-addr action=mark-packet new-packet-mark=nat-traversal passthrough=no / ip firewall address-list add list=illegal-addr address= /8 comment="illegal addresses" add list=illegal-addr address= /8 add list=illegal-addr address= /3 add list=illegal-addr address= /8 add list=illegal-addr address= /12 add list=illegal-addr address= /16 add list=local-addr address= /29 comment="my local network" add list=nat-addr address= /29 comment="my local network" / ip firewall filter add chain=forward in-interface=local out-interface=local action=accept comment="allow traffic between wired and wireless networks" / ip firewall filter add chain=forward action=jump jump-target=sanity-check comment="sanity Check" add chain=sanity-check packet-mark=nat-traversal action=jump jump-target=drop comment="deny illegal NAT traversal" add chain=sanity-check protocol=tcp psd=20,3s,3,1 action=add-src-to-address-list address-list=blocked-addr address-list-timeout=1d comment="block port scans" add chain=sanity-check protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-srcto-address-list address-list=blocked-addr address-list-timeout=1d comment="block TCP Null scan" add chain=sanity-check protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=addsrc-to-address-list address-list=blocked-addr address-list-timeout=1d comment="block TCP Xmas scan" add chain=sanity-check protocol=tcp src-address-list=blocked-addr action=jump jumptarget=drop add chain=sanity-check protocol=tcp tcp-flags=rst action=jump jump-target=drop comment="drop TCP RST" add chain=sanity-check protocol=tcp tcp-flags=fin,syn action=jump jump-target=drop comment="drop TCP SYN+FIN" add chain=sanity-check connection-state=invalid action=jump jump-target=drop comment="dropping invalid connections at once"

8 add chain=sanity-check connection-state=established action=accept comment="accepting already established connections" add chain=sanity-check connection-state=related action=accept comment="also accepting related connections" add chain=sanity-check dst-address-type=broadcast,multicast action=jump jumptarget=drop comment="drop all traffic that goes to multicast or broadcast addresses" add chain=sanity-check in-interface=local dst-address-list=illegal-addr dst-addresstype=!local action=jump jump-target=drop comment="drop illegal destination addresses" add chain=sanity-check in-interface=local src-address-list=!local-addr action=jump jump-target=drop comment="drop everything that goes from local interface but not from local address" add chain=sanity-check in-interface=public src-address-list=illegal-addr action=jump jump-target=drop comment="drop illegal source addresses" add chain=sanity-check in-interface=public dst-address-list=!local-addr action=jump jump-target=drop comment="drop everything that goes from public interface but not to local address" add chain=sanity-check src-address-type=broadcast,multicast action=jump jumptarget=drop comment="drop all traffic that goes from multicast or broadcast addresses" / ip firewall filter add chain=forward protocol=tcp action=jump jump-target=restrict-tcp add chain=forward protocol=udp action=jump jump-target=restrict-udp add chain=forward action=jump jump-target=restrict-ip add chain=restrict-tcp connection-mark=auth action=reject add chain=restrict-tcp connection-mark=smtp action=jump jump-target=smtp-first-drop comment="anti-spam policy" add chain=smtp-first-drop src-address-list=first-smtp action=add-src-to-address-list address-list=approved-smtp add chain=smtp-first-drop src-address-list=approved-smtp action=return add chain=smtp-first-drop action=add-src-to-address-list address-list=first-smtp add chain=smtp-first-drop action=reject reject-with=icmp-network-unreachable / ip firewall filter add chain=restrict-tcp connection-mark=other-tcp action=jump jump-target=drop add chain=restrict-udp connection-mark=other-udp action=jump jump-target=drop add chain=restrict-ip connection-mark=other action=jump jump-target=drop / ip firewall filter add chain=input src-address-type=local dst-address-type=local action=accept comment="allow local traffic \(between router applications\)" add chain=input in-interface=local protocol=udp src-port=68 dst-port=67 action=jump jump-target=dhcp comment="dhcp protocol would not pass sanity checking, so enabling it explicitly before other checks" add chain=input action=jump jump-target=sanity-check comment="sanity Check"

9 add chain=input dst-address-type=!local action=jump jump-target=drop comment="dropping packets not destined to the router itself, including all broadcast traffic" add chain=input connection-mark=ping limit=5,5 action=accept comment="allow pings, but at a very limited rate \(5 per sec\)" add chain=input in-interface=local action=jump jump-target=local-services comment="allowing some services to be accessible from the local network" add chain=input in-interface=public action=jump jump-target=public-services comment="allowing some services to be accessible from the Internet" add chain=input action=jump jump-target=drop add chain=dhcp src-address= dst-address= action=accept add chain=dhcp src-address= dst-address-type=local action=accept add chain=dhcp src-address-list=local-addr dst-address-type=local action=accept add chain=local-services connection-mark=ssh action=accept comment="ssh \(22/TCP\)" add chain=local-services connection-mark=dns action=accept comment="dns" add chain=local-services connection-mark=proxy action=accept comment="http Proxy \(3128/TCP\)" add chain=local-services connection-mark=winbox comment="winbox \(8291/TCP\)" disabled=no add chain=local-services action=drop comment="drop Other Local Services" add chain=public-services connection-mark=ssh action=accept comment="ssh \(22/TCP\)" add chain=public-services connection-mark=pptp action=accept comment="pptp \(1723/TCP\)" add chain=public-services connection-mark=gre action=accept comment="gre for PPTP" add chain=public-services action=drop comment="drop Other Public Services" Proxying everything / ip firewall nat add chain=dstnat in-interface=local connection-mark=dns action=redirect comment="proxy for DNS requests" add chain=dstnat in-interface=local connection-mark=http protocol=tcp action=redirect to-ports=3128 comment="proxy for HTTP requests" add chain=dstnat in-interface=local connection-mark=ntp action=redirect comment="proxy for NTP requests" Enable Proxy servers / system ntp server set enabled=yes broadcast=no multicast=no manycast=no / system ntp client set enabled=yes mode=unicast primary-ntp=xxx.xxx.xxx.xxx secondary-ntp= / ip proxy

10 set enabled=yes port=3128 parent-proxy= :1 maximal-client-connections=1000 maximal-server-connections=1000 / ip dns set primary-dns=yyy.yyy.yyy.yyy secondary-dns= allow-remote-requests=yes cache-size=2048kib cache-max-ttl=1w Bruteforce login prevention (FTP & SSH) /ip firewall filter add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop add chain=output action=accept protocol=tcp content="530 Login incorrect" dstlimit=1/1m,9,dst-address/1m add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \ address-list=ftp_blacklist address-list-timeout=3h add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \ comment="drop ssh brute forcers" disabled=no add chain=input protocol=tcp dst-port=22 connection-state=new \ src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=10d comment="" disabled=no add chain=input protocol=tcp dst-port=22 connection-state=new \ src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1m comment="" disabled=no add chain=input protocol=tcp dst-port=22 connection-state=new src-addresslist=ssh_stage1 \ action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-toaddress-list \ address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no