{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"Una manera sencilla de proteger tu Mikrotik de ataques","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Quiero compartir con la comunidad un m\u00e9todo simple y efectivo para proteger tu red y los servicios que dependen de Mikrotik de ataques externos. En resumen, se pueden organizar en Mikrotik un honeypot con solo tres reglas. <\/p>\n

Imaginemos que tenemos una peque\u00f1a oficina, con una IP externa detr\u00e1s de la cual se encuentra un servidor RDP para que los empleados trabajen de forma remota. La primera regla es, por supuesto, cambiar el puerto 3389 en la interfaz externa por otro. Pero esto no dura mucho, despu\u00e9s de un par de d\u00edas, el registro de auditor\u00eda del servidor terminal comenzar\u00e1 a mostrar varios intentos de inicio de sesi\u00f3n fallidos por segundo de clientes desconocidos. <\/p>\n

En otra situaci\u00f3n, si tienes un asterisk oculto detr\u00e1s de Mikrotik, por supuesto no en el puerto 5060 UDP, y despu\u00e9s de unos d\u00edas tambi\u00e9n comienza el intento de adivinar contrase\u00f1as ... s\u00ed, lo s\u00e9, fail2ban es nuestra salvaci\u00f3n, pero a\u00fan hay que trabajar un poco en eso ... por ejemplo, recientemente lo instal\u00e9 en Ubuntu 18.04 y con sorpresa descubr\u00ed que fail2ban, tal cual, no incluye configuraciones actualizadas para asterisk en esa misma versi\u00f3n de Ubuntu ... y buscar configuraciones r\u00e1pidas de 'recetas' ya no funciona, los n\u00fameros de las versiones aumentan con los a\u00f1os, y los art\u00edculos con 'recetas' para versiones antiguas ya no funcionan, y apenas aparecen nuevos ... Pero me estoy desviando ...
\n<\/a><\/noindex>
\nEntonces, \u00bfqu\u00e9 es un honeypot en pocas palabras? Es una trampa, en nuestro caso, alg\u00fan puerto popular en la IP externa, cualquier solicitud a ese puerto de un cliente externo env\u00eda la direcci\u00f3n src a la lista negra. Eso es todo.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nLa primera regla en los populares puertos TCP 22, 3389, 8291 de la interfaz externa ether4-wan env\u00eda la IP del 'invitado' a la lista 'Honeypot Hacker' (los puertos para ssh, rdp y winbox han sido desactivados o cambiados de antemano). La segunda regla hace lo mismo en el popular UDP 5060.<\/p>\n
La tercera regla en la etapa de prerouter bloquea paquetes de 'invitados' cuya direcci\u00f3n srs ha quedado en 'Honeypot Hacker'.<\/p>\n
Despu\u00e9s de dos semanas de funcionamiento de mi Mikrotik en casa, la lista 'Honeypot Hacker' incluy\u00f3 alrededor de mil quinientas IPs de aquellos que intentaban 'tocar mis recursos de red' (en casa tengo mi propia telefon\u00eda, correo, nextcloud, rdp). Los ataques de fuerza bruta se detuvieron, y lleg\u00f3 la paz. <\/p>\n
En el trabajo no result\u00f3 ser tan sencillo, all\u00ed el servidor rdp contin\u00faa siendo atacado por intentos de adivinar contrase\u00f1as.<\/p>\n
Parece que el esc\u00e1ner determin\u00f3 el n\u00famero de puerto mucho antes de que se activara el honeypot, y durante la cuarentena no es f\u00e1cil reconfigurar a m\u00e1s de 100 usuarios, de los cuales el 20% tiene m\u00e1s de 65 a\u00f1os. En los casos en que no se puede cambiar el puerto, hay una peque\u00f1a receta que funciona. He visto algo similar en internet, pero aqu\u00ed hay una mejora y un ajuste fino: <\/p>\n
                        Reglas para configurar Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nSe permite que un cliente remoto haga solo 12 nuevas \"solicitudes\" a RDP en 4 minutos. servidor<\/a>. Un intento de acceso implica de 1 a 4 \"solicitudes\". En la duod\u00e9cima \"solicitud\", se aplica un bloqueo de 15 minutos. En mi caso, los atacantes no han dejado de intentar hackear el servidor, se han adaptado a los temporizadores y ahora lo hacen muy lentamente; esta velocidad de prueba reduce la efectividad del ataque a cero. Los empleados de la empresa pr\u00e1cticamente no experimentan inconvenientes en su trabajo por las medidas tomadas. <\/p>\n
                        Otra peque\u00f1a trampa<\/b>
\n                         Esta regla se activa a la medianoche y se desactiva a las 5, cuando las personas verdaderas est\u00e1n durmiendo, mientras que los recolectores automatizados contin\u00faan despiertos.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nYa en la octava conexi\u00f3n, la IP del atacante se env\u00eda a una lista negra por una semana. \u00a1Espectacular!<\/p>\n
Adem\u00e1s de lo mencionado anteriormente, debo a\u00f1adir un enlace a un art\u00edculo de Wiki con la configuraci\u00f3n funcional de protecci\u00f3n de MikroTik contra esc\u00e1neres de red. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
En mis dispositivos, esta configuraci\u00f3n funciona junto con las reglas de honeypot mencionadas anteriormente, complement\u00e1ndolas bastante bien.<\/p>\n
UPD: Como se sugiri\u00f3 en los comentarios, la regla de ca\u00edda de paquetes se ha movido a RAW para reducir la carga en el enrutador.
\n
Fuente: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Forma sencilla de proteger su MikroTik contra ataques | ProHoster","description":"Quiero compartir con la comunidad un m\u00e9todo simple y efectivo para proteger su red y los servicios que la rodean con MikroTik contra ataques externos.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/es\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}