{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"En nem m\u00e5de at beskytte din Mikrotik mod angreb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jeg vil dele en simpel og funktionel metode med f\u00e6llesskabet til, hvordan man ved hj\u00e6lp af Mikrotik kan beskytte sit netv\u00e6rk og de \"synlige\" tjenester imod eksterne angreb. Det handler om at organisere et honeypot p\u00e5 Mikrotik med tre enkle regler. <\/p>\n

Lad os sige, at vi har et lille kontor, en ekstern IP bag hvilken der st\u00e5r en RDP-server til fjernarbejde for medarbejderne. Den f\u00f8rste regel er selvf\u00f8lgelig at \u00e6ndre port 3389 p\u00e5 den eksterne gr\u00e6nseflade til en anden. Men det varer ikke l\u00e6nge, efter et par dage begynder loggen for terminalserveren at vise flere mislykkedes godkendelser i sekundet fra ukendte klienter. <\/p>\n

En anden situation er, hvis du har en Asterisk skjult bag Mikrotik, naturligvis ikke p\u00e5 port 5060 UDP, og efter et par dage begynder passwordet ogs\u00e5 at blive fors\u00f8gt... ja, jeg ved, at fail2ban er vores alt, men det kr\u00e6ver stadig lidt arbejde at f\u00e5 det til at fungere... For eksempel har jeg for nylig installeret det p\u00e5 Ubuntu 18.04, og blev overrasket over, at fail2ban ikke indeholder aktuelle indstillinger til Asterisk fra den samme Ubuntu-distribution... Og at s\u00f8ge efter hurtige indstillinger i f\u00e6rdige \"opskrifter\" fungerer heller ikke l\u00e6ngere, tallene i udgivelserne stiger med \u00e5rene, men artiklerne med \"opskrifter\" til gamle versioner virker ikke l\u00e6ngere, og der dukker n\u00e6sten ikke nye op... Men jeg kom lidt v\u00e6k fra emnet...
\n<\/a><\/noindex>
\nS\u00e5, hvad er et honeypot i to ord - det er en f\u00e6lde, i vores tilf\u00e6lde en popul\u00e6r port p\u00e5 den eksterne IP, enhver anmodning til denne port fra en ekstern klient sender kildeadressen til den sorte liste. Det er alt.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nDen f\u00f8rste regel p\u00e5 popul\u00e6re TCP-porter 22, 3389, 8291 p\u00e5 den eksterne gr\u00e6nseflade ether4-wan sender IP'en \"g\u00e6sten\" ind i listen \"Honeypot Hacker\" (portene til ssh, rdp og winbox er p\u00e5 forh\u00e5nd deaktiveret eller \u00e6ndret til andre). Den anden g\u00f8r det samme p\u00e5 den popul\u00e6re UDP 5060.<\/p>\n
Den tredje regel i prerouting-k\u00e6den droppede pakker fra \"g\u00e6ster\", hvis kildeadresse er kommet ind i \"Honeypot Hacker\".<\/p>\n
Efter to uger med mit hjemme-Mikrotik har listen \"Honeypot Hacker\" inkluderet omkring halvanden tusinde IP-adresser af dem, der elsker at \"tjekke\" mine netv\u00e6rksressourcer (hjemme har jeg min egen telefoni, e-mail, nextcloud, rdp). Brute-force angrebene stoppede, og der indtr\u00e5dte en tilstand af lykke. <\/p>\n
P\u00e5 arbejdet viste det sig ikke at v\u00e6re s\u00e5 enkelt, der forts\u00e6tter angrebene p\u00e5 RDP-serveren ved hj\u00e6lp af passwordfors\u00f8g.<\/p>\n
Tilsyneladende blev portnummeret identificeret af scanneren l\u00e6nge f\u00f8r honeypot'en blev aktiveret, og det er ikke s\u00e5 let at omkonfigurere mere end 100 brugere under en lockdown, hvoraf 20 % er over 65 \u00e5r. Hvis porten ikke kan \u00e6ndres, er der en lille fungerende opskrift. Jeg har set noget lignende p\u00e5 internettet, men der er en finjustering her: <\/p>\n
                        Regler for ops\u00e6tning af Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nEn fjernklient har kun 4 minutter til at lave 12 nye 'foresp\u00f8rgsler' til RDP. server<\/a>. \u00c9t loginfors\u00f8g svarer til mellem 1 og 4 'foresp\u00f8rgsler'. Ved den 12. 'foresp\u00f8rgsel' - bliver der blokkeret i 15 minutter. I mit tilf\u00e6lde stoppede angriberne ikke med at fors\u00f8ge at hacke serveren, men tilpassede sig timerne og g\u00f8r det nu meget langsomt, hvilket reducerer angrebseffektiviteten til nul. Medarbejderne i virksomheden oplever n\u00e6sten ingen ulemper ved de trufne foranstaltninger. <\/p>\n
                        Endnu et lille trick<\/b>
\n                         Denne regel aktiveres p\u00e5 et fast tidspunkt kl. 01.00 og deaktiveres kl. 05.00, n\u00e5r de levende mennesker helt sikkert sover, mens automatiserede brute force-angreb stadig er v\u00e5gne.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nAllerede ved den ottende forbindelse sendes angriberens IP i sortliste i en uge. Smukt!<\/p>\n
Som et ekstra punkt vil jeg tilf\u00f8je et link til en Wiki-artikel med en fungerende ops\u00e6tning af beskyttelse mod netv\u00e6rksscannere p\u00e5 Mikrotik. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
P\u00e5 mine enheder fungerer denne ops\u00e6tning sammen med de tidligere n\u00e6vnte honeypot-regler, hvilket godt suppleres.<\/p>\n
UPD: Som n\u00e6vnt i kommentarerne er reglen for drop af pakker flyttet til RAW for at mindske belastningen p\u00e5 routeren.
\n
Kilde: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Let m\u00e5de at beskytte din Mikrotik mod angreb | ProHoster","description":"Jeg vil dele en simpel og fungerende metode med samfundet, hvordan man med Mikrotik kan beskytte sit netv\u00e6rk og de 'synlige' tjenester imod eksterne angreb.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}