4 ms·

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=accept chain=input dst-port=5000 protocol=udp add action=accept chain=input dst-port=6000 protocol=udp add action=accept chain=input dst-port=6001 protocol=udp add action=accept chain=input protocol=icmp add action=accept chain=input dst-port=22 protocol=tcp src-address-list=Mgmt add action=accept chain=input dst-port=179 in-interface-list=LAN protocol=tcp add action=drop chain=input in-interface=btopenreach add action=drop chain=input Clearly it's possible that an attacker could come in from the back door (desktop, XSS etc), I could lock down the BGP more, and tighen up Mgmt beyond it's current fairly wide subnets (a /16 owned by work and my wired range), but it becomes a hassle, which leads to more disabling of the "action=drop" while debugging. My backup script emails me when the configuration changes To check if your proxy is enabled (probably shouldn't be) /ip proxy print enabled: no

dboreham 8y ago
Also change the winbox port if you need it to be enabled.
- jessaustin 8y ago
  That's a way not to be the low-hanging fruit, but if someone wants this port they're going to find it.
  - dboreham 8y ago
    Of course. But the attack mentioned above looks to have simply targeted the default port. Ideally : use a non-default port, and source-IP-based firewalling, and keep firmware up to date.
24gttghh 8y ago
You could limit only certain ICMP types as well, and change your SSH port. And you can ask yourself: Do I really need access to my firewall from work?
- deleted 8y ago
  [deleted]
lucb1e 8y ago
What OS or software is that? Is that a Mikrotik router with default firmware that accepts such rules as you posted?
- isostatic 8y ago
  Yes, vanilla mikrotik (on the latest firmware -- interface-list is pretty new) The concept isn't hard -- block non-established incoming traffic from everywhere except where you want management to happen from. I have a few extra rules. Generally if you leave yourself wide open don't expect to be immune from zero-days.
  - lucb1e 8y ago
    Didn't know there were consumer routers that support command lines! I mean, fritzbox used to have a telnet interface that you could enable by dialing a dect number, but it wasn't meant to be used for anything or supported in any way (and later they removed it).

dboreham 8y ago

Also change the winbox port if you need it to be enabled.

jessaustin 8y ago
That's a way not to be the low-hanging fruit, but if someone wants this port they're going to find it.
- dboreham 8y ago
  Of course. But the attack mentioned above looks to have simply targeted the default port. Ideally : use a non-default port, and source-IP-based firewalling, and keep firmware up to date.

24gttghh 8y ago

You could limit only certain ICMP types as well, and change your SSH port. And you can ask yourself: Do I really need access to my firewall from work?

deleted 8y ago
[deleted]

lucb1e 8y ago

What OS or software is that? Is that a Mikrotik router with default firmware that accepts such rules as you posted?

isostatic 8y ago
Yes, vanilla mikrotik (on the latest firmware -- interface-list is pretty new) The concept isn't hard -- block non-established incoming traffic from everywhere except where you want management to happen from. I have a few extra rules. Generally if you leave yourself wide open don't expect to be immune from zero-days.
- lucb1e 8y ago
  Didn't know there were consumer routers that support command lines! I mean, fritzbox used to have a telnet interface that you could enable by dialing a dect number, but it wasn't meant to be used for anything or supported in any way (and later they removed it).