{"id":79489,"date":"2020-04-27T19:41:58","date_gmt":"2020-04-27T17:41:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak"},"modified":"2020-04-27T19:41:58","modified_gmt":"2020-04-27T17:41:58","slug":"legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","title":{"rendered":"Ett enkelt s\u00e4tt att skydda din Mikrotik fr\u00e5n attacker.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jag vill dela med mig till gemenskapen av ett enkelt och fungerande s\u00e4tt att skydda mitt n\u00e4tverk och de tj\u00e4nster som \"tittar\" bakom det med hj\u00e4lp av Mikrotik fr\u00e5n externa attacker. Genom att organisera ett honeypot p\u00e5 Mikrotik med endast tre regler. <\/p>\n

L\u00e5t oss s\u00e4ga att vi har ett litet kontor, med en extern IP-adress bakom vilken en RDP-server finns f\u00f6r medarbetarnas distansarbete. Den f\u00f6rsta regeln \u00e4r naturligtvis att byta port 3389 p\u00e5 det externa gr\u00e4nssnittet till en annan. Men detta r\u00e4cker bara en kort tid, efter ett par dagar b\u00f6rjar loggen f\u00f6r terminalservern att visa flera misslyckade inloggningsf\u00f6rs\u00f6k per sekund fr\u00e5n ok\u00e4nda klienter. <\/p>\n

En annan situation \u00e4r om du har en asterisk g\u00f6md bakom Mikrotik, givetvis inte p\u00e5 udp-port 5060, och efter n\u00e5gra dagar b\u00f6rjar \u00e4ven h\u00e4r l\u00f6senords\u00e5terst\u00e4llningar... ja, jag vet, fail2ban \u00e4r v\u00e5r allt, men det kommer att kr\u00e4vas lite mer arbete... nyligen installerade jag det p\u00e5 ubuntu 18.04 och uppt\u00e4ckte med f\u00f6rv\u00e5ning att fail2ban ur l\u00e5dan inte inneh\u00e5ller aktuella inst\u00e4llningar f\u00f6r asterisk fr\u00e5n samma l\u00e5da med samma ubuntu-distribution... och att googla fram snabba inst\u00e4llningar f\u00f6r f\u00e4rdiga \"recept\" \u00e4r inte l\u00e4ngre m\u00f6jligt, siffrorna f\u00f6r versionerna har \u00f6kat med \u00e5ren, och artiklar med \"recept\" f\u00f6r gamla versioner fungerar inte l\u00e4ngre, och nya dyker n\u00e4stan aldrig upp... Men nog om det...
\n<\/a><\/noindex>
\nS\u00e5, vad \u00e4r ett honeypot i korthet \u2014 det \u00e4r en f\u00e4lla, i v\u00e5rt fall en popul\u00e4r port p\u00e5 den externa IP-adressen, varje f\u00f6rfr\u00e5gan till denna port fr\u00e5n en extern klient skickar src-adressen till svartlistan. Det \u00e4r allt.<\/p>\n

\/ip firewall filter\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox" \n    connection-state=new dst-port=22,3389,8291 in-interface=\n    ether4-wan protocol=tcp\nadd action=add-src-to-address-list address-list="Honeypot Hacker" \n    address-list-timeout=30d0h0m chain=input comment=\n    "block honeypot asterisk" connection-state=new dst-port=5060 \n    in-interface=ether4-wan protocol=udp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\n    "Honeypot Hacker"\n<\/code><\/pre>\n
\nDen f\u00f6rsta regeln f\u00f6r popul\u00e4ra TCP-portar 22, 3389, 8291 p\u00e5 det externa gr\u00e4nssnittet ether4-wan skickar IP-adressen f\u00f6r \"g\u00e4sten\" till listan \"Honeypot Hacker\" (portarna f\u00f6r ssh, rdp och winbox har i f\u00f6rv\u00e4g st\u00e4ngts av eller \u00e4ndrats). Den andra g\u00f6r detsamma p\u00e5 popul\u00e4ra UDP 5060.<\/p>\n
Den tredje regeln i rutingen dropper paket fr\u00e5n \"g\u00e4ster\" vars srs-adress finns i \"Honeypot Hacker\".<\/p>\n
Efter tv\u00e5 veckors drift av min hemmamikrotik hade listan \"Honeypot Hacker\" samlat in cirka 1500 IP-adresser av dem som ville \"h\u00e5llas vid liv\" mina n\u00e4tverksresurser (hemma har vi v\u00e5r egen telefoni, e-post, nextcloud, rdp). Brute-force-attackerna upph\u00f6rde, och saligheten infann sig. <\/p>\n
P\u00e5 jobbet visade sig inte allt vara s\u00e5 enkelt, d\u00e4r forts\u00e4tter rdp-servern att hackas genom l\u00f6senords\u00e5terst\u00e4llningar.<\/p>\n
Det verkar som att portnumret identifierades av skannern l\u00e5ngt innan honeypot aktiverades, och under karant\u00e4nen \u00e4r det inte s\u00e5 enkelt att omkonfigurera \u00f6ver 100 anv\u00e4ndare, varav 20 % \u00e4r \u00f6ver 65 \u00e5r. I fall d\u00e4r porten inte kan \u00e4ndras finns det ett litet arbetsrecept. Jag har sett liknande p\u00e5 n\u00e4tet, men h\u00e4r finns en finjustering: <\/p>\n
                        Regler f\u00f6r att konfigurera Port Knocking<\/b><\/p>\n
 \/ip firewall filter\nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=15m chain=forward comment=rdp_to_blacklist \n    connection-state=new dst-port=3389 protocol=tcp src-address-list=\n    rdp_stage12\nadd action=add-src-to-address-list address-list=rdp_stage12 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage11\nadd action=add-src-to-address-list address-list=rdp_stage11 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage10\nadd action=add-src-to-address-list address-list=rdp_stage10 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage9\nadd action=add-src-to-address-list address-list=rdp_stage9 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage8\nadd action=add-src-to-address-list address-list=rdp_stage8 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage7 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage6\nadd action=add-src-to-address-list address-list=rdp_stage6 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage5\nadd action=add-src-to-address-list address-list=rdp_stage5 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage4\nadd action=add-src-to-address-list address-list=rdp_stage4 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=\n    3389 protocol=tcp src-address-list=rdp_stage3\nadd action=add-src-to-address-list address-list=rdp_stage3 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage2\nadd action=add-src-to-address-list address-list=rdp_stage2 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp src-address-list=rdp_stage1\nadd action=add-src-to-address-list address-list=rdp_stage1 \n    address-list-timeout=4m chain=forward connection-state=new dst-port=3389 \n    protocol=tcp \n\/ip firewall raw\nadd action=drop chain=prerouting in-interface=ether4-wan src-address-list=\nrdp_blacklist\n<\/code><\/pre>\n
\nP\u00e5 4 minuter f\u00e5r den externa kunden endast g\u00f6ra 12 nya \"f\u00f6rfr\u00e5gningar\" till RDP servern<\/a>. Ett inloggningsf\u00f6rs\u00f6k best\u00e5r av 1 till 4 \"f\u00f6rfr\u00e5gningar\". Vid den 12:e \"f\u00f6rfr\u00e5gningen\" blockeras \u00e5tkomsten i 15 minuter. I mitt fall har inte angriparna slutat f\u00f6rs\u00f6ka hacka servern, de har anpassat sig till tidtagarna och nu g\u00f6r de det mycket l\u00e5ngsamt, en s\u00e5dan hastighet minskar effektiviteten av attacken till noll. F\u00f6retagets anst\u00e4llda upplever praktiskt taget inga besv\u00e4r av de vidtagna \u00e5tg\u00e4rderna. <\/p>\n
                        \u00c4nnu ett litet trick<\/b>
\n                         Den h\u00e4r regeln aktiveras enligt schema klockan ett p\u00e5 natten och st\u00e4ngs av klockan fem, n\u00e4r riktiga m\u00e4nniskor definitivt sover, medan automatiserade verktyg forts\u00e4tter att vara vakna.<\/p>\n
\/ip firewall filter \nadd action=add-src-to-address-list address-list=rdp_blacklist \n    address-list-timeout=1w0d0h0m chain=forward comment=\n    "night_rdp_blacklist" connection-state=new disabled=\n    yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8<\/code><\/pre>\n
\nVid det \u00e5ttonde anslutningen hamnar angriparens IP-adress p\u00e5 svartlista i en vecka. Vackert!<\/p>\n
Och till det ovanst\u00e5ende l\u00e4gger jag en l\u00e4nk till en Wiki-artikel med en fungerande konfiguration f\u00f6r att skydda Mikrotik fr\u00e5n n\u00e4tverksskannrar. wiki.mikrotik.com\/wiki\/Drop_port_scanners<\/a><\/noindex><\/p>\n
P\u00e5 mina enheter fungerar den h\u00e4r inst\u00e4llningen tillsammans med de ovan beskrivna honeypot-reglerna och kompletterar dem v\u00e4l.<\/p>\n
UPD: Som n\u00e4mnts i kommentarerna har regeln f\u00f6r paketdropp flyttats till RAW f\u00f6r att minska belastningen p\u00e5 routern.
\n
K\u00e4lla: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a. \u0410 \u0438\u043c\u0435\u043d\u043d\u043e \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0435\u043c\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u041c\u0438\u043a\u0440\u043e\u0442\u0438\u043a\u0435 honeypot. \u0418\u0442\u0430\u043a, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043c, \u0447\u0442\u043e \u0443 \u043d\u0430\u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043e\u0444\u0438\u0441, \u0432\u043d\u0435\u0448\u043d\u0438\u0439 IP \u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0442\u043e\u0438\u0442 RDP \u0441\u0435\u0440\u0432\u0435\u0440, \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u043e\u0432 \u043f\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0435. \u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044d\u0442\u043e \u043a\u043e\u043d\u0435\u0447\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-79489","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ett enkelt s\u00e4tt att skydda din Mikrotik fr\u00e5n attacker | ProHoster","description":"Jag vill dela med mig till samh\u00e4llet av ett enkelt och fungerande s\u00e4tt att anv\u00e4nda Mikrotik f\u00f6r att skydda sitt n\u00e4tverk och de tj\u00e4nster som \"kikar\" bakom det fr\u00e5n externa attacker.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041b\u0435\u0433\u043a\u0438\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 Mikrotik \u043e\u0442 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0425\u043e\u0447\u0443 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e\u043c \u043f\u0440\u043e\u0441\u0442\u044b\u043c \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u043c \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u043c, \u043a\u0430\u043a \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Mikrotik \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u044e \u0441\u0435\u0442\u044c \u0438 \u00ab\u0432\u044b\u0433\u043b\u044f\u0434\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u00bb \u0438\u0437-\u0437\u0430 \u043d\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u043e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0430\u0442\u0430\u043a.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/legkij-sposob-zashhitit-svoj-mikrotik-ot-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-27T17:41:58+00:00","article:modified_time":"2020-04-27T17:41:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"79489","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:37:23","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/79489","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=79489"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/79489\/revisions"}],"predecessor-version":[{"id":160157,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/79489\/revisions\/160157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=79489"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=79489"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=79489"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}