Skip to content

Instantly share code, notes, and snippets.

@pashamray

pashamray/mikrotik_stop_ssh_brutforce.md

Last active May 21, 2018 07:37
Show Gist options
  • Save pashamray/9ca105b5e1ad5c27d480b581371a0d09 to your computer and use it in GitHub Desktop.
Save pashamray/9ca105b5e1ad5c27d480b581371a0d09 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
mikrotik_stop_ssh_brutforce.md

/ip firewall filter

add action=jump chain=input comment="sshbruteforces chain" connection-state=
new dst-port=22 jump-target=sshbruteforces protocol=tcp add action=drop chain=sshbruteforces comment="drop ssh brute forcers"
src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=1w3d chain=sshbruteforces connection-state=new
src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m chain=sshbruteforces connection-state=new
src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m chain=sshbruteforces connection-state=new
src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m chain=sshbruteforces connection-state=new add chain=sshbruteforces dst-port=22 protocol=tcp add action=drop chain=forward comment="drop ssh brute downstream" disabled=
no dst-port=22 protocol=tcp src-address-list=ssh_blacklist add chain=sshbruteforces dst-port=22 protocol=tcp connection-state=new add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22
protocol=tcp src-address-list=ssh_blacklist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment