PREVENT Bruteforce ATTACK IN MIKROTIK

z

Friday, December 16, 2016

Broadly speaking, this brute force attack is a technique of trying to break into someone else's device (ex: Mikrotik) by way of trying random possibilities and user passwords on such devices. And this is very often the case if there is a proxy "Public IP"
Everyone must have their own security to keep the device so that other people can not get in, and certainly with a password that only he and those around him who would know. But indirectly brute force attack is very disturbing.
Let not happen like this again, in Mikrotik can add multiple filters.

• Filter first, drop FTP. Equate just like this picture

Filter above, if there are IP that tries to enter but failed (503 Login Incorrect) will be included in the address list with the names ftp_blacklist, and if there is a sign in using the IP in the address list (ftp_blacklist) via port 21 / FTP action be in drop

• Second, Drop SSH

The function is similar to the above drop FTP

• similar to filter FTP but uses the stage. If there is a sign in using an existing IP Address in the list (ssh_blacklist) via port 22 / ssh the action will be dropped And in the results of the second filter

To see how many IP are used brute force attacker.  can be seen in the Address list.

This is an example that happened in my own router, when only a day using this filter but already there are 13 incoming IP address list

Labels: JARINGAN KOMPUTER, MIKROTIK

Thanks for reading PREVENT Bruteforce ATTACK IN MIKROTIK. Please share...!