Regra Basicas de Firewall do Mikrotik RB 750

Drop port scanners

https://wiki.mikrotik.com/wiki/Drop_port_scanners

To protect the Router from port scanners, we can record the IPs of hackers who try to scan your box. Using this address list we can drop connection from those IP

in /ip firewall filter

add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="Port scanners to list " disabled=no

Various combinations of TCP flags can also indicate port scanner activity.

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP FIN Stealth scan"

add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/FIN scan"

add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="SYN/RST scan"

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="FIN/PSH/URG scan"

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="ALL/ALL scan"

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w comment="NMAP NULL scan"

Then you can drop those IPs:

add chain=input src-address-list="port scanners" action=drop comment="dropping port scanners" disabled=no

Similarly, you can drop these port scanners in the forward chain, but using the above rules with "chain=forward".

Category:

• Firewall

Bruteforce login prevention

https://wiki.mikrotik.com/wiki/Bruteforce_login_prevention

To stop SSH/FTP attacks on your router, follow this advice.

This configuration allows only 10 FTP login incorrect answers per minute

in /ip firewall filter

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \
comment="drop ftp brute forcers"

add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \
address-list=ftp_blacklist address-list-timeout=3h

This will prevent a SSH brute forcer to be banned for 10 days after repetitive attempts. Change the timeouts as necessary.

in /ip firewall filter

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

If you want to block downstream access as well, you need to block the with the forward chain:

add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute downstream" disabled=no

To view the contents of your Blacklist, go to "/ip firewall address-list" and type "print" to see the contents.

VPN automatica no Windows

VPN automatica no Windows



Já precisou alguma vez fazer com que o Windows se conectasse altomaticamente em uma VPN antes do Logon.

Segue uma solução para o problema que vem funcionando muito bem para mim.

Para seu funcionamento será necessário à instalação de algumas ferramentas:
Pacote “Windows Server 2003 Resource Kit Tools” (que também pode ser instalado no Windows XP e 2000), o mesmo pode ser baixado através dos site http://www.microsoft.com/en-us/download/details.aspx?id=17657 .

Após instalar o pacote crie uma conexão VPN normalmente coloque para reconectar automaticamente caso caia a conexão utilizei em minha configuração até 1000 tentativas após salvar e testar sua VPN crie um arquivo com extensão tipo “bat” e inclua o texto abaixo:

—

@echo off
sleep 30

:Loop
ping www.google.com -n 1 || goto Loop

:Attempt
C:\windows\system32\rasdial.exe nome_conexão usuario senha && goto Connected || goto Failed

:Failed
echo Connection failed on %date% %time% > c:\vpnlog.txt
sleep 300
goto Attempt

:Connected
echo Connection completed on %date% %time% > c:\vpnlog.txt

:Finish
echo on
—

Após criar o arquivo configure o agendador de tarefas do Windows para executar a tarefa ao iniciar e desabilite a opção Executar somente se conectado. Reinicie a maquina e a conexão devera ocorrer no inicio do windows antes do logon.

Autor:

https://sqlshow.wordpress.com/2013/05/11/vpn-automatica-no-windows/ 

Path pelo Linux Debian Ubuntu Linux Mint $PATH

#vi /etc/profile

# You may uncomment the following lines if you want `ls' to be colorized:
export LS_OPTIONS='--color=auto'
eval `dircolors`
alias ls='ls $LS_OPTIONS'
alias la='ls $LS_OPTIONS -la'
alias l='ls $LS_OPTIONS -l'
alias ll='ls $LS_OPTIONS -l'
alias dir='dir $LS_OPTIONS'
#
# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias cds='cd /etc/init.d ; ls'
alias src-kernel='cd /usr/src/linux ; l'
alias limpa-memoria2='echo 3 > /proc/sys/vm/drop_caches'
alias limpa-memoria='sudo sysctl -w vm.drop_caches=3'
# alias mount-sdcard='mount -t vfat -o rw,uid=1000 ' + $dev_mmc + ' /mnt/sdcard'

#vi /root/.bachrc

#Exporta os novos path do SAMBA4 personalizado 
export PATH=$PATH:'/opt/samba/bin:/opt/samba/sbin'  


# You may uncomment the following lines if you want `ls' to be colorized:
export LS_OPTIONS='--color=auto'
eval `dircolors`
alias ls='ls $LS_OPTIONS'
alias la='ls $LS_OPTIONS -la'
alias l='ls $LS_OPTIONS -l'
alias ll='ls $LS_OPTIONS -l'
alias dir='dir $LS_OPTIONS'
#
# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias cds='cd /etc/init.d ; ls'
alias src-kernel='cd /usr/src/linux ; l'
alias limpa-memoria2='echo 3 > /proc/sys/vm/drop_caches'
alias limpa-memoria='sudo sysctl -w vm.drop_caches=3'
# alias mount-sdcard='mount -t vfat -o rw,uid=1000 ' + $dev_mmc + ' /mnt/sdcard'


#vi /home/meu_usuario/.bachrc

#Exporta os novos path do SAMBA4 personalizado 
export PATH=$PATH:'/opt/samba/bin:/opt/samba/sbin'  


# You may uncomment the following lines if you want `ls' to be colorized:
export LS_OPTIONS='--color=auto'
eval `dircolors`
alias ls='ls $LS_OPTIONS'
alias la='ls $LS_OPTIONS -la'
alias l='ls $LS_OPTIONS -l'
alias ll='ls $LS_OPTIONS -l'
alias dir='dir $LS_OPTIONS'
#
# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias cds='cd /etc/init.d ; ls'
alias src-kernel='cd /usr/src/linux ; l'
alias limpa-memoria2='echo 3 > /proc/sys/vm/drop_caches'
alias limpa-memoria='sudo sysctl -w vm.drop_caches=3'
# alias mount-sdcard='mount -t vfat -o rw,uid=1000 ' + $dev_mmc + ' /mnt/sdcard'

#vi /etc/sudoers

OBS: Adicionado path do SAMBA4 personalizado para sudo rodar. 

Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin:/opt/samba/bin:/opt/samba/sbin"