Regras prontas para o RouterOS Firewal part 1

Não é muito sensato investir em uma RB e deixar ela com as pernas abertas para o mundo, por isto vou começa hoje a deixar aqui algumas regras que tenho prontas para prevenir alguns problemas que podem ocorrer.

1º a porta UTP 53 é responsável pelo serviço DNS já a TCP constantemente é atacada
/ip firewall filter add action=drop chain=input comment="Bloqueio Porta 53" dst-port=53 protocol=tcp
/ip firewall filter add action=drop chain=input comment="Bloqueio Porta 53 Externo" dst-port=53 in-interface=pppoe-out1 protocol=udp
2º ataques DDos podem tirar suas noites de sono já tenho de antemão preparado esta sequencia de regras em caso de emergência ativo a 3 regra e deixo a RB trabalhar
/ip firewall filter
add action=add-src-to-address-list address-list=DDos_blacklist address-list-timeout=1d chain=input comment="Prote\E7\E3o DDos 1/5" connection-limit=32,32 protocol=tcp
add action=tarpit chain=input comment="Prote\E7\E3o DDos 2/5" connection-limit=3,32 protocol=tcp src-address-list=DDos_blacklist
add action=jump chain=forward comment="Prote\E7\E3o DDos 3/5 (ativar somente em caso de DDos Flood)" connection-state=new disabled=yes jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=accept chain=SYN-Protect comment="Prote\E7\E3o DDos 4/5 prote\E7\E3o SYN Flood" connection-state=new limit=400,5 protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect comment="Prote\E7\E3o DDos 5/5 prote\E7\E3o SYN Flood" connection-state=new protocol=tcp tcp-flags=syn
3º um controle simples de ping para não gerar processamento desnecessario
/ip firewall filter
add action=accept chain=input comment="Controle de pings limitados 1/2" limit=50/5s,2 protocol=icmp
add action=drop chain=input comment="Controle de pings bloqueia excesso 2/2" protocol=icmp
4º proteção contra scaners de portas externas
/ip firewall filter
add action=drop chain=input comment="Scanners de portas bloqueio 8/8" src-address-list="port scanners"
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas Listar 1/8" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas NMAP FIN Stealth 2/8" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas SYN/FIN 3/8" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas SYN/RST 4/8" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas FIN/PSH/URG 5/8" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas ALL/ALL 6/8" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w chain=input comment="Scanners de portas NMAP NULL 7/8" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
5º Proteção para ataque tipo BruteForce no FTP da RB
/ip firewall filter
add action=drop chain=input comment="Prote\E7\E3o ftp BruteForce 3/3" dst-port=20-21 protocol=tcp src-address-list=ftp_blacklist
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=1w chain=output comment="Prote\E7\E3o ftp BruteForce 1/3" content="530 Login incorrect" protocol=tcp
add action=accept chain=output comment="Prote\E7\E3o ftp BruteForce 2/3" content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
6º e no ssh
/ip firewall filter
add action=drop chain=input comment="Prote\E7\E3o ssh BruteForce 5/6" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=forward comment="Prote\E7\E3o ssh BruteForce 6/6" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w chain=input comment="Prote\E7\E3o ssh BruteForce 4/6" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=30m chain=input comment="Prote\E7\E3o ssh BruteForce 3/6" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=30m chain=input comment="Prote\E7\E3o ssh BruteForce 2/6" connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=30m chain=input comment="Prote\E7\E3o ssh BruteForce 1/6" connection-state=new dst-port=22 protocol=tcp
7º também o WinBox
/ip firewall filter
add action=drop chain=input comment="Prote\E7\E3o winbox BruteForce 5/6" dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
add action=drop chain=forward comment="Prote\E7\E3o winbox BruteForce 6/6" dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
add action=add-src-to-address-list address-list=winbox_blacklist address-list-timeout=1w chain=input comment="Prote\E7\E3o winbox BruteForce 4/6" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage3
add action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=30m chain=input comment="Prote\E7\E3o winbox BruteForce 3/6" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=30m chain=input comment="Prote\E7\E3o winbox BruteForce 2/6" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=30m chain=input comment="Prote\E7\E3o winbox BruteForce 1/6" connection-state=new dst-port=8291 protocol=tcp
8º um rápido filtro para acelerar a navegação
/ip firewall filter
add action=accept chain=input comment="Permitir conex\F5es estabelecidas" connection-state=established
add action=accept chain=forward comment="Permitir conex\F5es relacionada" connection-state=related
add action=drop chain=forward comment="Bloqueia  conex\F5es inv\E1lidas" connection-state=invalid
9º agora estou criando uma nova chain tipo forward chamada virus e bloqueando varias portas comumente atacadas
/ip firewall filter
add action=jump chain=forward comment="Saltar para a cadeia criada v\EDrus" jump-target=virus
add action=drop chain=virus comment="Drop Blaster Worm" dst-port=135-139 protocol=tcp
add action=drop chain=virus comment="Drop Messenger Worm" dst-port=135-139 protocol=udp
add action=drop chain=virus comment="Drop Blaster Worm" dst-port=445 protocol=tcp
add action=drop chain=virus comment="Drop Blaster Worm" dst-port=445 protocol=udp
add action=drop chain=virus comment=________ dst-port=593 protocol=tcp
add action=drop chain=virus comment=________ dst-port=593 protocol=udp
add action=drop chain=virus comment=________ dst-port=1024-1030 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" dst-port=1080 protocol=tcp
add action=drop chain=virus comment=________ dst-port=1214 protocol=tcp
add action=drop chain=virus comment="ndm requester" dst-port=1363 protocol=tcp
add action=drop chain=virus comment="ndm server" dst-port=1364 protocol=tcp
add action=drop chain=virus comment="screen cast" dst-port=1368 protocol=tcp
add action=drop chain=virus comment=hromgrafx dst-port=1373 protocol=tcp
add action=drop chain=virus comment=cichlid dst-port=1377 protocol=tcp
add action=drop chain=virus comment=Worm dst-port=1433-1434 protocol=tcp
add action=drop chain=virus comment=Worm dst-port=1433-1434 protocol=udp
add action=drop chain=virus comment="Drop Dumaru.Y" dst-port=2283 protocol=tcp
add action=drop chain=virus comment="Drop Beagle" dst-port=2535 protocol=tcp
add action=drop chain=virus comment="Bagle Virus" dst-port=2745 protocol=tcp
add action=drop chain=virus comment="Drop Beagle.C-K" dst-port=2745 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" dst-port=3127-3128 protocol=tcp
add action=drop chain=virus comment="Drop Backdoor OptixPro" dst-port=3410 protocol=tcp
add action=drop chain=virus comment=Worm dst-port=4444 protocol=tcp
add action=drop chain=virus comment=Worm dst-port=4444 protocol=udp
add action=drop chain=virus comment="Drop Sasser" dst-port=5554 protocol=tcp
add action=drop chain=virus comment="Drop Beagle.B" dst-port=8866 protocol=tcp
add action=drop chain=virus comment="Drop Dabber.A-B" dst-port=9898 protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" dst-port=10000 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom.B" dst-port=10080 protocol=tcp
add action=drop chain=virus comment="Drop NetBus" dst-port=12345 protocol=tcp
add action=drop chain=virus comment="Drop Kuang2" dst-port=17300 protocol=tcp
add action=drop chain=virus comment="Drop SubSeven" dst-port=27374 protocol=tcp
add action=drop chain=virus comment="Drop PhatBot, Agobot, Gaobot" dst-port=65506 protocol=tcp
10º bloqueando tudo que for destinado a mais de um cliente  reduzindo processamento (talvez tenha que desabilitar)
/ip firewall filter
add action=drop chain=forward comment="Bloqueia tudo o que n\E3o \E9 de unicast" src-address-type=!unicast
Por hoje é chega, todas as regras foram testadas, esse material foi garimpado na net em sua maioria dentro do wiki da MikroTik

Principal fonte de pesquisa: https://wiki.mikrotik.com/wiki/Main_Page