alexnov66
Advanced Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Sashaiv
Всё работает, ищите ошибку в правилах, при знании логина и пароля более 5 попыток не стоит делать, даже 3-х.
Немного по другому.
Код: /ip firewall filter
add action=drop chain=input comment=input_drop_tcp_brute dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=list_drop_tcp_brute
add action=add-src-to-address-list address-list=list_drop_tcp_brute address-list-timeout=1w chain=input connection-state=new dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=list_auth4_tcp_brute
add action=add-src-to-address-list address-list=list_auth4_tcp_brute address-list-timeout=1m chain=input connection-state=new dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=list_auth3_tcp_brute
add action=add-src-to-address-list address-list=list_auth3_tcp_brute address-list-timeout=1m chain=input connection-state=new dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=list_auth2_tcp_brute
add action=add-src-to-address-list address-list=list_auth2_tcp_brute address-list-timeout=1m chain=input connection-state=new dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=list_auth1_tcp_brute
add action=add-src-to-address-list address-list=list_auth1_tcp_brute address-list-timeout=1m chain=input connection-state=new dst-port=3389 in-interface-list=wan protocol=tcp src-address-list=!list_allow_ip_all
|
В лист list_allow_ip_all заносим все разрешенные ip адреса, в том числе и внутренние, если вы не указываете внешний интерфейс и правило работает для всех интерфейсов.
Правило на инпут надо делать, вы же подключаетесь к микротику на ip адрес и порт, и время сократить до 30 секунд, за 30 секунд сколько можно успеть сделать попыток в ручную не считая программой.
Код: /ip firewall filter
add action=jump chain=input comment=Add_bruteforcers_tcp_port connection-state=new dst-port=80,443,8080,8443 in-interface-list=wan jump-target=check_bruteforce protocol=tcp
add action=jump chain=input comment=Add_bruteforcers_udp_port connection-state=new dst-port=80,443,8080,8443 in-interface-list=wan jump-target=check_bruteforce protocol=udp
add action=jump chain=input comment=Add_bruteforcers_tcp_port connection-state=new dst-port=20,21,22,23,53,990,3389,1723 in-interface-list=wan jump-target=check_bruteforce protocol=tcp
add action=jump chain=input comment=Add_bruteforcers_udp_port connection-state=new dst-port=20,21,22,23,53,990,3389,1723 in-interface-list=wan jump-target=check_bruteforce protocol=udp
add action=drop chain=input comment=Drop_bruteforcers_port in-interface-list=wan src-address-list=bruteforcer
add action=add-src-to-address-list address-list=bruteforcer address-list-timeout=15m chain=check_bruteforce comment=Add_bruteforcer_to_blacklist_15m src-address-list=bruteforce_stage_6
add action=add-src-to-address-list address-list=bruteforce_stage_6 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_6_1m src-address-list=bruteforce_stage_5
add action=add-src-to-address-list address-list=bruteforce_stage_5 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_5_1m src-address-list=bruteforce_stage_4
add action=add-src-to-address-list address-list=bruteforce_stage_4 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_4_1m src-address-list=bruteforce_stage_3
add action=add-src-to-address-list address-list=bruteforce_stage_3 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_3_1m src-address-list=bruteforce_stage_2
add action=add-src-to-address-list address-list=bruteforce_stage_2 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_2_1m src-address-list=bruteforce_stage_1
add action=add-src-to-address-list address-list=bruteforce_stage_1 address-list-timeout=1m chain=check_bruteforce comment=Add_to_bruteforce_stage_1_1m |
В первом снизу правиле можно добавить лист исключения ip адресов. |
Всего записей: 1460 | Зарегистр. 29-08-2005 | Отправлено: 17:37 18-04-2019 | Исправлено: alexnov66, 18:46 18-04-2019 |
|
