AfricanTech
Honorary Master
Thanks for this - I'll compare these to the existing rules and adjust them appropriately - fortunately (unfortunately) my ISP doesn't support IPV6 yet so I don't need those (yet).Mikrotik includes a pretty good default config, but it's always good to harden it further against common attacks. The most obvious changes are of course using a non-default username and a good password, and only allowing administrative access from restricted networks/subnetworks/VLANs.
Here is what I am running:
Code:/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked /ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp /ip firewall filter add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1 /ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec /ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec /ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related disabled=yes hw-offload=yes /ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid /ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid /ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN /ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=pppoe0 ##/ip firewall nat add action=dst-nat chain=dstnat comment=Wireguard dst-port=51820 protocol=udp to-addresses=10.0.0.5 ##/ip firewall nat add action=dst-nat chain=dstnat comment=Transmission dst-port=51413 protocol=tcp to-addresses=10.0.0.5 /ip firewall raw add action=drop chain=prerouting comment="TCP invalid combination of flags attack (7 rules)" log=yes log-prefix=RAW protocol=tcp tcp-flags=!fin,!syn,!rst,!ack /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=fin,syn /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=fin,rst /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=fin,!ack /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=fin,urg /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=syn,rst /ip firewall raw add action=drop chain=prerouting log=yes log-prefix=RAW protocol=tcp tcp-flags=rst,urg /ip firewall raw add action=drop chain=prerouting comment="TCP Port 0 attack (2 rules)" log=yes log-prefix=RAW protocol=tcp src-port=0 /ip firewall raw add action=drop chain=prerouting dst-port=0 log=yes log-prefix=RAW protocol=tcp /ip firewall raw add action=drop chain=prerouting comment="UDP Port 0 attack (2 rules)" log=yes log-prefix=RAW protocol=udp src-port=0 /ip firewall raw add action=drop chain=prerouting dst-port=0 log=yes log-prefix=RAW protocol=udp /ip firewall raw add action=drop chain=prerouting comment="SYN fragmented attack" fragment=yes log=yes log-prefix=RAW protocol=tcp tcp-flags=syn /ip firewall raw add action=drop chain=prerouting comment="IP option loose-source-routing" ipv4-options=loose-source-routing log=yes log-prefix=RAW /ip firewall raw add action=drop chain=prerouting comment="IP option strict-source-routing" ipv4-options=strict-source-routing log=yes log-prefix=RAW /ip firewall raw add action=drop chain=prerouting comment="IP option record-route" ipv4-options=record-route log=yes log-prefix=RAW /ip firewall raw add action=drop chain=prerouting comment="IP option router-alert" ipv4-options=router-alert log=yes log-prefix=RAW /ip firewall raw add action=drop chain=prerouting comment="IP option timestamp" ipv4-options=timestamp log=yes log-prefix=RAW /ip firewall raw add action=drop chain=prerouting comment="IP options left, except IP Stream used by the IGMP protocol" ipv4-options=any log=yes log-prefix=RAW protocol=!igmp
You will notice I use mostly standard rules, with a few added. It's controversial to allow ICMP pings in but I allow it for PMTU discovery to work properly. I've commented out some DSTNAT rules that you likely won't use as it's just port forwarding for my Wireguard server and Transmission. I also don't use Fasttrack, I think for another script that I used, but in my case, I can probably enable it again.
The raw rules are meant to stop most attacks that are commonly seen from botnets. I've only seen one or two actual attempts blocked, though.
These rules only allow access to router services from my local LAN:
Code:/ip service set telnet address=10.0.0.0/24 /ip service set ftp address=10.0.0.0/24 /ip service set www address=10.0.0.0/24 /ip service set ssh address=10.0.0.0/24 /ip service set api address=10.0.0.0/24 /ip service set winbox address=10.0.0.0/24 /ip service set api-ssl address=10.0.0.0/24
IPv6 firewall rules:
Code:/ipv6 firewall address-list add address=::/128 comment="defconf: unspecified address" list=bad_ipv6 /ipv6 firewall address-list add address=::1/128 comment="defconf: lo" list=bad_ipv6 /ipv6 firewall address-list add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6 /ipv6 firewall address-list add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6 /ipv6 firewall address-list add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6 /ipv6 firewall address-list add address=100::/64 comment="defconf: discard only " list=bad_ipv6 /ipv6 firewall address-list add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6 /ipv6 firewall address-list add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6 /ipv6 firewall address-list add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked log=yes log-prefix=IPv6 /ipv6 firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid /ipv6 firewall filter add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp /ipv6 firewall filter add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10 /ipv6 firewall filter add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp /ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah /ipv6 firewall filter add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp /ipv6 firewall filter add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec /ipv6 firewall filter add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked /ipv6 firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid /ipv6 firewall filter add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6 /ipv6 firewall filter add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6 /ipv6 firewall filter add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6 /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6 /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept HIP" protocol=139 /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp /ipv6 firewall filter add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec /ipv6 firewall filter add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
This should be a good starting point for you
Eish, I forgot how little I know about RouterOS...
Upgraded from RB2011 to RB3011 this weekend. Wanted to do the right thing and start from scratch so did a clean boot with just the factory default settings and then tried to set things up by copying relevant settings line by line (copy/pasta with appropriate tweaks from an export of the RB2011 config).....what a painful exercise and then reached a point where I couldn't figure out how to activate the NAT properly so ja...
Eventually capitulated and just did a backup from the RB2011 and restore to the RB3011 - everything working but I'm not really happy about it since I know there's cruft that I've now copied across to the new router
I know right - you'd think that 100 Meg is plenty but then I have a son who games and streams and uploads YT vids and when he gets going (and Xbox updates are running) he can saturate that line pretty damn quickly (at which point I throttle him to 50 Meg via Unifi profile)
