MikroTik RouterOS block attack

以下的 Policy 是引用網路上網友的設定,微調符合自己的需求。
Policy 順序依 comment 欄位的說明。

/ip firewall filter
add chain=forward action=drop protocol=tcp src-address-list=login_blacklist dst-port=80 comment="drop login forcers 1"
add chain=input action=drop protocol=tcp src-address-list=login_blacklist dst-port=22 comment="drop login forcers 1"

add chain=forward action=jump jump-target=login_check connection-state=new protocol=tcp src-address-list=!Local_LAN dst-port=80 comment="drop login forcers 2"
add chain=input action=jump jump-target=login_check connection-state=new protocol=tcp src-address-list=!Local_LAN dst-port=22 comment="drop login forcers 2"

add chain=login_check action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=login_stage3 address-list=login_blacklist address-list-timeout=1d dst-port=80,22 comment="drop login forcers 3"

add chain=login_check action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=login_stage2 address-list=login_stage3 address-list-timeout=1m dst-port=80,22 comment="drop login forcers 4"

add chain=login_check action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=login_stage1 address-list=login_stage2 address-list-timeout=1m dst-port=80,22 comment="drop login forcers 5"

add chain=login_check action=add-src-to-address-list connection-state=new protocol=tcp address-list=login_stage1 address-list-timeout=1m dst-port=80,22 comment="drop login forcers 6"

它的作法是限制來源 IP 在短時間新建立多條連線。

MikroTik RouterOS L2TP over IPSec 連線設定

寫得太麻煩了,直接看圖

L2TP 設定:

IP >> Pool 新增一個給 L2TP 使用的 IP 網段(使用的 IP address: 192.168.125.100~192.168.125.200 )

PPP >> Profiles 按 ＋ 新增一個 L2TP Profile

PPP >> Interface 啟用 L2TP Server

IPSec 設定:

IP >> IPSec >> Peer
按 ＋ 新增一筆設定

IP >> IPSec >> Proposals 按 ＋ 新增

新增使用者帳號:

PPP >> Secret 新增一個使用者帳號

防火牆設定:

IP >> Firewall >> NAT 新增允許透過 VPN 上外網

IP >> Firewall >> Mangle 新增允許透過 VPN 內網

設定完成內、外網都可以連通。