ืืื ืืืืื ืฆื ืืืืื ืืื ืื ืงืื ืึท ืคึผืฉืื ืืื ืืจืืขืื ืืืขื ืคืื ืืื ืฆื ื ืืฆื ืืืงืจืึธืืืง ืฆื ืืึทืฉืืฆื ืืืืขืจ ื ืขืฅ ืืื ืื ืกืขืจืืืืกืขืก "ืคึผืืคึผืื ื ืืืืก" ืคึฟืื ืืื ืืขืจ ืขืก ืคืื ืคืื ืืจืืืกื ืืืง ืื ืคืืื. ื ืึทืืขืื, ื ืึธืจ ืืจืืึท ืึผืืืื ืฆื ืึธืจืืึทื ืืืืจื ืึท ืืึทื ืืคึผืึทื ืืืืฃ ืืืงืจืึธืืืง.
ืึทืืื, ืืึธืื ืืื ืื ืืืึทืืืฉืึทื ืึทื ืืืจ ืืึธืื ืึท ืงืืืื ืึธืคืืก ืืื ืึท ืคืื ืืจืืืกื ืืืง IP ืืื ืืขืจ ืืืึธืก ืขืก ืืื ืึท RDP ืกืขืจืืืขืจ ืคึฟืึทืจ ืขืืคึผืืืืื ืฆื ืึทืจืืขืื ืจืืืึธืืืื. ืืขืจ ืขืจืฉืืขืจ ืืขืจืฉื ืืื, ืคืื ืงืืจืก, ืฆื ืืืืฉื ืคึผืึธืจื 3389 ืืืืฃ ืื ืคืื ืืจืืืกื ืืืง ืฆืืืื ื ืฆื ืื ืื ืืขืจ. ืึธืืขืจ ืืึธืก ืืืขื ื ืืฉื ืืืืขืจื ืืึทื ื; ื ืึธื ืึท ืคึผืึธืจ ืคืื ืืขื, ืื ืืืึธืงืืึทื ืกืขืจืืืขืจ ืงืึธื ืืจืึธื ืงืืึธืฅ ืืืขื ืึธื ืืืืื ืฆื ืืืืึทืื ืขืืืขืืข ืืืจืืคืึทื ืืขืจืืืืืขื ืืฉ ืคึผืขืจ ืกืขืงืื ืืข ืคืื โโืืืืืึทืงืึทื ื ืงืืืืึทื ืฅ.
ืื ืื ืืขืจ ืกืืืืึทืฆืืข, ืืืจ ืืึธื ืึท ืึทืกืืขืจืืกืง ืคืึทืจืืึธืจืื ืืื ืืขืจ ืืืงืจืึธืืืง, ืคืื ืงืืจืก ื ืืฉื ืืืืฃ ืื 5060 ืืืคึผ ืคึผืึธืจื, ืืื ื ืึธื ืึท ืคึผืึธืจ ืคืื ืืขื ืื ืคึผืึทืจืึธื ืืืื ืืืื ืืืืื ... ืืึธ, ืืึธ, ืืื ืืืืกื, fail2ban ืืื ืืื ืืืขืจ ืึทืืฅ, ืึธืืขืจ ืืืจ ื ืึธื ืืึธืื ืฆื ืึทืจืืขื ืืืืฃ ืขืก ... ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืื ืืขืฆืื ืก ืืื ืกืืึทืืืจื ืขืก ืืืืฃ ืืืื ืื 18.04 ืืื ืืื ืืขืืืขื ืกืึทืคึผืจืืืื ืฆื ืึทื ืืืขืงื ืึทื ืคืื ืื ืงืขืกืื ืคืึทืื 2 ืืึทื ืืื ื ืืฉื ืึทื ืืืึทืืื ืงืจืึทื ื ืกืขืืืื ืืก ืคึฟืึทืจ ืึทืกืืขืจืืกืง ืคืื ืืขืจ ืืขืืืืงืขืจ ืงืขืกืื ืคืื ืืขืจ ืืขืืืืงืขืจ ืืืื ืื ืคืึทืจืฉืคึผืจืืืืื ื ... ืืื ืืึธืึธืืืื ื ืฉื ืขื ืกืขืืืื ืืก ืคืึทืจ ืคืึทืจืืืง โืจืขืฆืขืคึผืืโ ืืจืืขื ืฉืืื ื ืืฉื, ืื ืฆืึธื ืคืื ืืจืืืกืืขืื ืืืืงืกื ืืื ืื ืืืจื, ืืื ืืจืืืงืืขื ืืื โืจืขืฆืขืคืืโ ืคืืจ ืืืืข ืืืขืจืกืืขืก ืืจืืขืื ืฉืืื ื ืืฉื, ืืื ื ืืืข ืงืืืขื ืืืขื ืงืืื ืืื ื ืืฉื ืืจืืืก... ืืืขืจ ืืื ืคืืจื ืืจืืืก...
ืึทืืื, ืืืึธืก ืืื ืึท ืืึธื ืืงืคึผืึธื ืืื ืึท ื ืึทืืฉืขื - ืขืก ืืื ืึท ืืึธื ืืงืคึผืึธื, ืืื ืืื ืืืขืจ ืคืึทื, ืงืืื ืคืึธืืงืก ืคึผืึธืจื ืืืืฃ ืึท ืคืื ืืจืืืกื ืืืง IP, ืืขืืขืจ ืืงืฉื ืฆื ืืขื ืคึผืึธืจื ืคืื ืึท ืคืื ืืจืืืกื ืืืง ืงืืืขื ื ืกืขื ืื ืื src ืึทืืจืขืก ืฆื ืื ืืืึทืงืืืกื. ืึทืืข.
/ip firewall filter
add action=add-src-to-address-list address-list="Honeypot Hacker"
address-list-timeout=30d0h0m chain=input comment="block honeypot ssh rdp winbox"
connection-state=new dst-port=22,3389,8291 in-interface=
ether4-wan protocol=tcp
add action=add-src-to-address-list address-list="Honeypot Hacker"
address-list-timeout=30d0h0m chain=input comment=
"block honeypot asterisk" connection-state=new dst-port=5060
in-interface=ether4-wan protocol=udp
/ip firewall raw
add action=drop chain=prerouting in-interface=ether4-wan src-address-list=
"Honeypot Hacker"
ืืขืจ ืขืจืฉืืขืจ ืืขืจืฉื ืืืืฃ ืคืึธืืงืก TCP ืคึผืึธืจืฅ 22, 3389, 8291 ืคืื ืื ether4-wan ืคืื ืืจืืืกื ืืืง ืฆืืืื ื ืกืขื ืื ืื "ืืึทืกื" IP ืฆื ืื "ืืึธื ืืืคึผืึธื ืืขืงืขืจ" ืจืฉืืื (ืคึผืึธืจืฅ ืคึฟืึทืจ ssh, rdp ืืื winbox ืืขื ืขื ืคืึทืจืงืจืืคึผืื ืืื ืฉืืืึทืื ืึธืืขืจ ืืขืืืื ืฆื ืื ืืขืจืข). ืื ืจืืข ืืื ืื ืืขืืืข ืืืืฃ ืื ืคืึธืืงืก UDP 5060.
ืื ืืจืื ืืขืจืฉื ืืื ืื ืคืึทืจ - ืจืืืื ื ืืื ืข ืืจืืคื ืก ืคึผืึทืงืืฅ ืคืื "ืืขืกื" ืืืขืืขื ืก srs-ืึทืืจืขืก ืืื ืึทืจืืึทื ืืขืจืขืื ื ืืื ืื "ืืึธื ืืืคึผืึธื ืืขืงืขืจ".
ื ืึธื ืฆืืืื ืืืึธืื ืคืื ืืจืืขืื ืืื ืืืื ืืืื ืืืงืจืึธืืืง, ืื "ืืึธื ืืืคึผืึธื ืืขืงืขืจ" ืจืฉืืื ืื ืงืืืืขื ืืืขืื ืืืื ืืื ืึท ืืึทืื ืืืืื ื IP ืึทืืจืขืกืขืก ืคืื ืื ืืืืก ืืื ืฆื "ืืึทืืื ืืื ืื ืืืืขืจ" ืืืื ื ืขืฅ ืจืขืกืืจืกื (ืืื ืฉืืื ืขืก ืืื ืืืื ืืืืืขื ืข ืืขืืขืคืึธื, ืคึผืึธืกื, nextcloud, rdp). ืืจืืืข-ืงืจืึทืคื ืื ืคืืื ืคืืจืฉืืืคื, ืืืืง ืืขืงืืืขื.
ืืื ืึทืจืืขื, ื ืื ืึทืืฅ ืืื ืืขืืืขื ืึทืืื ืคึผืฉืื, ืืื ืคืึธืจืืขืฆื ืฆื ืืจืขืื ืื rdp ืกืขืจืืืขืจ ืืืจื ืืจืื-ืคืึธืจืกืื ื ืคึผืึทืกืืืขืจืื.
ืืฉืืขืืช, ืื ืคึผืึธืจื ื ืืืขืจ ืืื ืืขืืืขื ืืืฉืืืกื ืืืจื ืื ืกืงืึทื ื ืขืจ ืืึทื ื ืืืืืขืจ ืื ืืึธื ืืืคึผืึธื ืืื ืืืืกืืขืืจืืื ืืืืฃ, ืืื ืืขืฉืึทืก ืงืึทืจืึทื ืืื ืขืก ืืื ื ืืฉื ืึทืืื ืืจืื ื ืฆื ืจืืงืึทื ืคืืืืขืจ ืืขืจ ืืื 100 ืืืืขืจื, ืคืื ืืืึธืก 20% ืืขื ืขื ืืืืขืจ 65 ืืึธืจ ืึทืื. ืืื ืืขื ืคืึทื ืืืขื ืื ืคึผืึธืจื ืงืขื ืขื ื ืื ืืืื ืืขืืืื, ืขืก ืืื ืึท ืงืืืื ืึทืจืืขื ืจืขืฆืขืคึผื. ืืื ืืืข ืืขืืขื ืขืคึผืขืก ืขื ืืขื ืืืืฃ ืืขืจ ืืื ืืขืจื ืขืฅ, ืึธืืขืจ ืขืก ืืื ืขืืืขืืข ื ืึธื ืึทืืืฉืึทื ืืื ืคืืื ืืื ืื ื ืื ืืืึทืืืื:
ืึผืืืื ืคึฟืึทืจ ืงืึทื ืคืืืืขืจ ืคึผืึธืจื ื ืึทืงืื ื
/ip firewall filter
add action=add-src-to-address-list address-list=rdp_blacklist
address-list-timeout=15m chain=forward comment=rdp_to_blacklist
connection-state=new dst-port=3389 protocol=tcp src-address-list=
rdp_stage12
add action=add-src-to-address-list address-list=rdp_stage12
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage11
add action=add-src-to-address-list address-list=rdp_stage11
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage10
add action=add-src-to-address-list address-list=rdp_stage10
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage9
add action=add-src-to-address-list address-list=rdp_stage9
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage8
add action=add-src-to-address-list address-list=rdp_stage8
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage4
add action=add-src-to-address-list address-list=rdp_stage7
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage6
add action=add-src-to-address-list address-list=rdp_stage6
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage5
add action=add-src-to-address-list address-list=rdp_stage5
address-list-timeout=4m chain=forward connection-state=new dst-port=
3389 protocol=tcp src-address-list=rdp_stage4
add action=add-src-to-address-list address-list=rdp_stage4
address-list-timeout=4m chain=forward connection-state=new dst-port=
3389 protocol=tcp src-address-list=rdp_stage3
add action=add-src-to-address-list address-list=rdp_stage3
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage2
add action=add-src-to-address-list address-list=rdp_stage2
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp src-address-list=rdp_stage1
add action=add-src-to-address-list address-list=rdp_stage1
address-list-timeout=4m chain=forward connection-state=new dst-port=3389
protocol=tcp
/ip firewall raw
add action=drop chain=prerouting in-interface=ether4-wan src-address-list=
rdp_blacklist
ืืื 4 ืืื ืื, ืืขืจ ืืืืึทื ืงืืืขื ื ืืื ืขืจืืืืื ืฆื ืืึทืื ืืืืื 12 ื ืืึทืข "ืจืืงืืืขืก" ืฆื ืื RDP ืกืขืจืืืขืจ. ืืืื ืืึธืืื ืคึผืจืืืื ืืื ืคืื 1 ืฆื 4 "ืจืืงืืืขืก". ืืื ืื 12 "ืืขืื" - ืืืึทืงืื ื ืคึฟืึทืจ 15 ืืื ืื. ืืื ืืืื ืคืึทื, ืื ืึทืืึทืงืขืจื ืืึธืื ื ืืฉื ืืึทืืื ืืึทืงืื ื ืื ืกืขืจืืืขืจ, ืืื ืึทืืืฉืึทืกืืื ืฆื ืื ืืืืืขืจื ืืื ืืืฆื ืืึธื ืืึธืก ืืืืขืจ ืกืืึธืืื, ืึทืืึท ืึท ืืืืงืืึทื ืคืื ืกืขืืขืงืฆืืข ืจืึทืืืกืึทื ืื ืืคืขืงืืืืื ืึทืก ืคืื ืื ืืึทืคืึทืื ืฆื ื ืื. ืื ืึธื ืืขืฉืืขืืืข ืคืื โโืื ืคืืจืืข ืืขืจืคืึทืจืื ื ืึผืืขื ืงืืื ืืืืึทืงืืืขืืงืืึทื ืืื ืึทืจืืขื ืคืื ืื ืืืืืขื ืืขื ืืืขื.
ืื ืื ืืขืจ ืงืืืื ืงืื ืฅ
ืืขืจ ืืขืจืฉื ืฆืื ืื ืืื ืื ืืืื ื ืกืงืขืืืฉืื 5 ืืืืืืขืจ ืืื ืืจืืื ืืื ืืค ืืื XNUMX ืืืืืืขืจ, ืืืขื ืืืช'ืข ืืขื ืืฉื ืฉืืืคื ืืืืืื, ืืื ืืืืืืืืืืฉืข ืคึผืืงืขืจืก ืืขื ืขื ืืืืืืขืจ ืืืื.
/ip firewall filter
add action=add-src-to-address-list address-list=rdp_blacklist
address-list-timeout=1w0d0h0m chain=forward comment=
"night_rdp_blacklist" connection-state=new disabled=
yes dst-port=3389 protocol=tcp src-address-list=rdp_stage8ืฉืืื ืืืืฃ ืื 8 ืงืฉืจ, ืื IP ืคืื ืื ืึทืืึทืงืขืจ ืืื ืืืึทืงืืืกืืื ืคึฟืึทืจ ืึท ืืืึธื. ืฉืืื ืงืืื!
ื ื, ืืื ืึทืืืฉืึทื ืฆื ืื ืืืืื, ืืื ืืืขื ืืืืื ืึท ืืื ืง ืฆื ืึท Wiki ืึทืจืืืงื ืืื ืึท ืืจืืขืื ืกืขืืึทืคึผ ืคึฟืึทืจ ืคึผืจืึทืืขืงืืื ื ืืืงืจืึธืืืง ืคืื ื ืขืฅ ืกืงืึทื ืขืจื.
ืืืืฃ ืืืื ืืขืืืืกืขืก, ืืขื ืืึทืฉืืขืืืงื ืึทืจืืขื ืฆืืืึทืืขื ืืื ืื ืืึธื ืืงืคึผืึธื ืึผืืืื ืืืกืงืจืืืื ืืืืื, ืงืึทืืคึผืืึทืืขื ืืื ื ืืื ืืขืืื ื.
UPD: ืืื ืกืึทืืืืฉืขืกืืื ืืื ืื ืืึทืืขืจืงืื ืืขื, ืื ืคึผืึทืงืึทื ืงืึทืคึผ ืืขืจืฉื ืืื ืืจืืืขืจืืขืคืืจื ืฆื RAW ืฆื ืจืขืืืฆืืจื ืื ืืึทืกืข ืืืืฃ ืื ืจืึทืืืขืจ.
ืืงืืจ: www.habr.com