############################
 Mikrotik RouterOS Firewall 
############################

Several Block for filter

o Block Bogus IP Address
o Drop SSH brute forcers
o Port Scanners to list
o Filter FTP to Box
o Separate Protocol into Chains
  - UDP  :: Blocking UDP Packet
  - TCP  :: Bloking TCP Packet
  - ICMP :: Limited Ping Flood 
o Allow Broadcast Traffic
o Connection State


## Basic Configuration -

- Begin

/ ip firewall filter 
add chain=forward src-address=0.0.0.0/8 action=drop comment="Block Bogus IP \
    Address" disabled=no 
add chain=forward dst-address=0.0.0.0/8 action=drop comment="" disabled=no 
add chain=forward src-address=127.0.0.0/8 action=drop comment="" disabled=no 
add chain=forward dst-address=127.0.0.0/8 action=drop comment="" disabled=no 
add chain=forward src-address=224.0.0.0/3 action=drop comment="" disabled=no 
add chain=forward dst-address=224.0.0.0/3 action=drop comment="" disabled=no 

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist \
    action=drop comment="Drop SSH brute forcers" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage3 action=add-src-to-address-list \
    address-list=ssh_blacklist address-list-timeout=1w3d comment="" \
    disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage2 action=add-src-to-address-list \
    address-list=ssh_stage3 address-list-timeout=1m comment="" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    src-address-list=ssh_stage1 action=add-src-to-address-list \
    address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no 
add chain=input protocol=tcp dst-port=22 connection-state=new \
    action=add-src-to-address-list address-list=ssh_stage1 \
    address-list-timeout=1m comment="" disabled=no 

add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=2w comment="Port \
    Scanners to list " disabled=no 
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="" disabled=no 
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=2w comment="" \
    disabled=no 
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=2w comment="" \
    disabled=no 
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="" disabled=no 
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="" disabled=no 
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="" disabled=no 
add chain=input src-address-list="port scanners" action=drop comment="" \
    disabled=no 

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist \
    action=drop comment="Filter FTP to Box" disabled=no 
add chain=output protocol=tcp content="530 Login incorrect" \
    dst-limit=1/1m,9,dst-address/1m action=accept comment="" disabled=no 
add chain=output protocol=tcp content="530 Login incorrect" \
    action=add-dst-to-address-list address-list=ftp_blacklist \
    address-list-timeout=3h comment="" disabled=no 

add chain=forward protocol=tcp action=jump jump-target=tcp comment="Separate \
    Protocol into Chains" disabled=no 
add chain=forward protocol=udp action=jump jump-target=udp comment="" \
    disabled=no 
add chain=forward protocol=icmp action=jump jump-target=icmp comment="" \
    disabled=no 

add chain=udp protocol=udp dst-port=69 action=drop comment="Blocking UDP \
    Packet" disabled=no 
add chain=udp protocol=udp dst-port=111 action=drop comment="" disabled=no 
add chain=udp protocol=udp dst-port=135 action=drop comment="" disabled=no 
add chain=udp protocol=udp dst-port=137-139 action=drop comment="" disabled=no 
add chain=udp protocol=udp dst-port=2049 action=drop comment="" disabled=no 
add chain=udp protocol=udp dst-port=3133 action=drop comment="" disabled=no 

add chain=tcp protocol=tcp dst-port=69 action=drop comment="Bloking TCP \
    Packet" disabled=no 
add chain=tcp protocol=tcp dst-port=111 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=119 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=135 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=137-139 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=445 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="" \
    disabled=no 
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="" disabled=no 
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="" disabled=no 

add chain=icmp protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept \
    comment="Limited Ping Flood" disabled=no 
add chain=icmp protocol=icmp icmp-options=3:3 limit=5,5 action=accept \
    comment="" disabled=no 
add chain=icmp protocol=icmp icmp-options=3:4 limit=5,5 action=accept \
    comment="" disabled=no 
add chain=icmp protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept \
    comment="" disabled=no 
add chain=icmp protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept \
    comment="" disabled=no 
add chain=icmp protocol=icmp action=drop comment="" disabled=no 

add chain=input dst-address-type=broadcast action=accept comment="Allow \
    Broadcast Traffic" disabled=no 

add chain=input connection-state=established action=accept comment="Connection \
    State" disabled=no 
add chain=input connection-state=related action=accept comment="" disabled=no 
add chain=input connection-state=invalid action=drop comment="" disabled=no 

- End

############################
Arranged by baratev
~baratev.sourceforge.net
contact:baratev[at]yahoo.com
----------------------------
Ref: wiki.mikrotik.com

1:42 05/06/2008