Mikrotik RouterOS Firewall Filter

##################################
 Mikrotik RouterOS Firewall Filter
##################################

o Block Invalid Connection
o Block Open Proxy User
o Block Bogus IP Address
o Block Torrent
o Bruteforce login prevention (FTP)
o Drop SSH brute forcers
o Port Scanners to list
o Filter FTP to Box
o Separate Protocol into Chains
  - UDP  :: Blocking UDP Packet
  - TCP  :: Bloking TCP Packet
  - ICMP :: Limited Ping Flood
o Allow Broadcast Traffic
o Add Game Traffic to Address-list
o Add Facebook Traffic to Address-list
o Add Youtube Traffic to Address-list
o Connection State


Basic Rules

/ip firewall address-list
add address=192.168.2.0/24 disabled=no list=Local-Address
add address=192.168.3.2/32 disabled=no list=Proxy-Address

/interface ethernet
set 0 name=Public
set 1 name=Local
set 2 name=Proxy

/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 comment=\
    "PPPoE Speedy" dial-on-demand=no disabled=no interface=Public max-mru=\
    1480 max-mtu=1480 mrru=disabled name=Speedy password=ABCDEF12GH profile=\
    default service-name="" use-peer-dns=no [email protected]

o Block Invalid Connection
/ip firewall filter
add action=drop chain=input comment="Drop Invalid connections" \
    connection-state=invalid disabled=no

o Block Open Proxy User
/ip firewall filter
add action=drop chain=input comment="Blok Open Proxy User" disabled=no \
    dst-port=3128,8080,3229 in-interface=Speedy protocol=tcp src-address=\
    0.0.0.0/0

o Block Bogus IP Address
/ip firewall filter
add action=drop chain=forward comment="Block Bogus IP Address" disabled=no \
    src-address=0.0.0.0/8
add action=drop chain=forward disabled=no dst-address=0.0.0.0/8
add action=drop chain=forward disabled=no src-address=127.0.0.0/8
add action=drop chain=forward disabled=no dst-address=127.0.0.0/8
add action=drop chain=forward disabled=no src-address=224.0.0.0/3
add action=drop chain=forward disabled=no dst-address=224.0.0.0/3

o Block Torrent
/ip firewall layer7-protocol
add name=p2p_sites regexp="^.*(get|GET).+(torrent|thepiratebay|isohunt|entertane|demonoid|btjunkie|mininova|flixflux|torrentz|vertor|h33t|btscene|bitunity|bittoxic|thunderbytes|entertane|zoozle|vcdq|bitnova|bitsoup|meganova|fulldls|btbot|flixflux|seedpeer|fenopy|gpirate|commonbits).*\$"
add comment="" name=p2p_dns regexp="^.+(torrent|thepiratebay|isohunt|entertane|demonoid|btjunkie|mininova|flixflux|vertor|h33t|zoozle|bitnova|bitsoup|meganova|fulldls|btbot|fenopy|gpirate|commonbits).*\$"

/ip firewall filter
add action=drop chain=forward comment="block p2p_sites" disabled=no layer7-protocol=p2p_sites
add action=drop chain=forward comment="block p2p_dns" disabled=no dst-port=53 layer7-protocol=p2p_dns protocol=udp


/ip firewall filter
add action=drop chain=input comment="Drop FTP brute forcers" disabled=no \
    dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output content="530 Login incorrect" disabled=no \
    dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist \
    address-list-timeout=3h chain=output content="530 Login incorrect" \
    disabled=no protocol=tcp

add action=drop chain=input comment="Drop SSH brute forcers" disabled=no \
    dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=1w3d chain=input connection-state=new disabled=no \
    dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
    address-list-timeout=1m chain=input connection-state=new disabled=no \
    dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
    address-list-timeout=1m chain=input connection-state=new disabled=no \
    dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
    address-list-timeout=1m chain=input connection-state=new disabled=no \
    dst-port=22 protocol=tcp
add action=drop chain=forward comment="Drop SSH brute downstream" disabled=no \
    dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input comment="SYN filter" connection-state=new \
    disabled=no protocol=tcp tcp-flags=!syn
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="Port scanners to list " \
    disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
    disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="SYN/FIN scan" disabled=no \
    protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="SYN/RST scan" disabled=no \
    protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" disabled=\
    no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="ALL/ALL scan" disabled=no \
    protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w chain=input comment="NMAP NULL scan" disabled=no \
    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=1d chain=input comment="NMAP UDP scan" disabled=no \
    packet-size=0-28 protocol=udp
add action=drop chain=input comment="dropping port scanners" disabled=no \
    src-address-list="port scanners"
add action=drop chain=forward comment="dropping port scanners" disabled=no \
    src-address-list="port scanners"

o Part of Block Invalid Connection
/ip firewall filter
add action=accept chain=input comment="Allow established connections" \
    connection-state=established disabled=no
add action=accept chain=input comment="Allow related connections" \
    connection-state=related disabled=no
add action=accept chain=input comment="Allow local traffic" disabled=no \
    dst-address-type=local src-address-type=local
add action=accept chain=input comment="Allow ICMP from LOCAL network" \
    disabled=no protocol=icmp src-address-list=Local-Address
add action=accept chain=input comment="Allow ICMP from PROXY" disabled=no \
    protocol=icmp src-address-list=Proxy-Address
add action=accept chain=input comment="Allow input from LOCAL network" \
    disabled=no src-address-list=Local-Address
add action=accept chain=input comment="Allow input from PROXY" disabled=no \
    src-address-list=Proxy-Address
add action=accept chain=input comment=\
    "Allow Winbox Access ---------- CHECK BEFORE ENABLED" disabled=no \
    dst-port=8291 in-interface=Speedy protocol=tcp
add action=accept chain=forward comment=\
    "Allow SSH Access ----- CHECK BEFORE ENABLED" disabled=yes dst-port=22 \
    in-interface=Speedy protocol=tcp
add action=drop chain=input comment="Drop everything else" disabled=no


add action=jump chain=forward comment="Packet filtering" disabled=no \
    jump-target=tcp protocol=tcp
add action=jump chain=forward disabled=no jump-target=udp protocol=udp
add action=jump chain=forward disabled=no jump-target=icmp protocol=icmp
add action=drop chain=tcp comment="Drop BLACKLIST silakan bikin" disabled=no \
    dst-address-list=Blacklist protocol=tcp
add action=drop chain=tcp comment="Drop Telnet" disabled=no dst-port=23 \
    protocol=tcp
add action=drop chain=tcp comment="Drop SMTP" disabled=no dst-port=25 \
    protocol=tcp
add action=drop chain=tcp comment="Drop DHCP" disabled=no dst-port=67-68 \
    protocol=tcp
add action=drop chain=tcp comment="Drop TFTP" disabled=no dst-port=69 \
    protocol=tcp
add action=drop chain=tcp comment="Drop Finger" disabled=no dst-port=79 \
    protocol=tcp
add action=drop chain=tcp comment="Drop POP3" disabled=no dst-port=110 \
    protocol=tcp
add action=reject chain=tcp comment="Reject ident probes" disabled=no \
    dst-port=113 protocol=tcp reject-with=tcp-reset
add action=drop chain=tcp comment="Drop NNTP" disabled=no dst-port=119 \
    protocol=tcp
add action=drop chain=tcp comment="Drop RPC portmapper, NFS" disabled=no \
    dst-port=111,645,2049,32769 protocol=tcp
add action=drop chain=tcp comment="Drop NetBIOS" disabled=no dst-port=135-139 \
    protocol=tcp
add action=drop chain=tcp comment="Drop IMAP" disabled=no dst-port=143 \
    protocol=tcp
add action=drop chain=tcp comment="Drop LDAP" disabled=no dst-port=389 \
    protocol=tcp
add action=drop chain=tcp comment="Drop cifs" disabled=no dst-port=\
    445,1433,1434 protocol=tcp
add action=drop chain=tcp comment="Drop ms-ils" disabled=no dst-port=1002 \
    protocol=tcp
add action=drop chain=tcp comment="Drop DCOM" disabled=no dst-port=1024-1030 \
    protocol=tcp
add action=drop chain=tcp comment="Drop UPnP" disabled=no dst-port=5000 \
    protocol=tcp
add action=drop chain=tcp comment="Drop Bla, Attack FTP" disabled=no \
    dst-port=666,1042 protocol=tcp
add action=drop chain=tcp comment="Drop Ultors Trojan" disabled=no dst-port=\
    1243 protocol=tcp
add action=drop chain=tcp comment="Drop Remote Explorer 2000" disabled=no \
    dst-port=2000 protocol=tcp
add action=drop chain=tcp comment="Drop P2P Edonkey2000" disabled=no \
    dst-port=4661,4671 protocol=tcp
add action=drop chain=tcp comment="Drop SubSeven" disabled=no dst-port=\
    1243,6711,6712,6713,6776,27374 protocol=tcp
add action=drop chain=tcp comment="Drop Dark FTP, IRC, Backdoor, DeepThroat" \
    disabled=no dst-port=6667,6670,6711,6969,7000 protocol=tcp
add action=drop chain=tcp comment="Drop NetBus, Exploiter, Donald Dick" \
    disabled=no dst-port=12345,12346,21554,22222 protocol=tcp
add action=drop chain=tcp comment="Drop DuckToy" disabled=no dst-port=29559 \
    protocol=tcp
add action=drop chain=tcp comment="Drop Back Orifice" disabled=no dst-port=\
    31337,31338 protocol=tcp
add action=drop chain=udp comment="Drop BLACKLIST udp bikin sendiri" \
    disabled=no dst-address-list=Blacklist protocol=udp
add action=drop chain=udp comment="Drop RPC portmapper, NFS" disabled=no \
    dst-port=111,644,2049,32770 protocol=udp
add action=drop chain=udp comment="Drop NetBIOS" disabled=no dst-port=135-139 \
    protocol=udp
add action=drop chain=udp comment="Drop cifs" disabled=no dst-port=445 \
    protocol=udp
add action=drop chain=udp comment="Drop Dynamic RPC" disabled=no dst-port=\
    1025-1035 protocol=udp
add action=drop chain=udp comment="Drop BackOriffice" disabled=no dst-port=\
    31337,31338 protocol=udp
add action=add-dst-to-address-list address-list=facebook \
    address-list-timeout=10m chain=tcp comment=FACEBOOK content=.facebook.com \
    disabled=no dst-address=!192.168.3.2 dst-address-list=!Local-Address \
    dst-port=80,433 protocol=tcp
add action=add-dst-to-address-list address-list=facebook \
    address-list-timeout=10m chain=tcp content=.akamaihd.net disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=80,443 \
    protocol=tcp
add action=add-dst-to-address-list address-list=facebook \
    address-list-timeout=10m chain=tcp content=.fbcdn.net disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=80,443 \
    protocol=tcp
add action=add-dst-to-address-list address-list=game-facebook \
    address-list-timeout=10m chain=tcp content=.zynga.com disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=80,443 \
    protocol=tcp
add action=add-dst-to-address-list address-list=game-facebook \
    address-list-timeout=10m chain=tcp comment="Zynga Poker" disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=\
    843,9339 protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp comment=GAMES content=.gemscool.com \
    disabled=no dst-address=!192.168.3.2 dst-address-list=!Local-Address \
    dst-port=80,443 protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp content=.megaxus.com disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=80,443 \
    protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp comment="GAMES TCP" disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=\
    1818,2001,3010,4300,5105,5121,5126,5171,5340-5352,6000-6152,7777 \
    protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port=\
    7341-7350,7451,8085,9600,9601-9602,9300,9376-9377,9400,9700,10001-10011 \
    protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port="10402,11011-11041,12011,12110,13\
    008,13413,15000-15002,16402-16502,16666,18901-18909,19000" protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port=\
    19101,22100,27780,28012,29000,29200,39100,39110,39220,39190,40000,49100 \
    protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port=14009-14010 protocol=tcp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp comment="GAME UDP" disabled=no \
    dst-address=!192.168.3.2 dst-address-list=!Local-Address dst-port=\
    14009-14010 protocol=udp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port="1293,1479,6100-6152,7777-7977,80\
    01,9401,9600-9602,12020-12080,30000,40000-40010" protocol=udp
add action=add-dst-to-address-list address-list=games_iix \
    address-list-timeout=10m chain=tcp disabled=no dst-address=!192.168.3.2 \
    dst-address-list=!Local-Address dst-port=\
    42051-42052,11100-11125,11440-11460 protocol=udp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=0:0-255 limit=5,5 protocol=icmp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=3:0 protocol=icmp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=3:3 limit=5,5 protocol=icmp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=3:4 limit=5,5 protocol=icmp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=8:0-255 limit=5,5 protocol=icmp
add action=accept chain=icmp comment="Limit packets 5/secs" disabled=no \
    icmp-options=11:0-255 limit=5,5 protocol=icmp
add action=drop chain=icmp comment="Drop other icmp packets" disabled=no
add action=drop chain=forward comment="Drop invalid connections" \
    connection-state=invalid disabled=no
add action=accept chain=forward comment="Allow established connections" \
    connection-state=established disabled=no
add action=accept chain=forward comment="Allow related connections" \
    connection-state=related disabled=no
add action=accept chain=forward comment="Allow forward from Local network" \
    disabled=no src-address-list=Local-Address
add action=accept chain=forward comment="Allow forward from PROXY" disabled=\
    no src-address-list=Proxy-Address