Заметки по роутеру MikroTik

Настройка сетевого фильтра Firewall

telnet

/ip firewall filter

add chain=input protocol=tcp dst-port=23 src-address-list=telnet_blacklist action=drop \
comment="drop telnet brute forcers" disabled=no
 
add chain=input protocol=tcp dst-port=23 connection-state=new \
src-address-list=telnet_stage3 action=add-src-to-address-list address-list=telnet_blacklist \
address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=23 connection-state=new \
src-address-list=telnet_stage2 action=add-src-to-address-list address-list=telnet_stage3 \
address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=23 connection-state=new src-address-list=telnet_stage1 \
action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=23 connection-state=new action=add-src-to-address-list \
address-list=telnet_stage1 address-list-timeout=1m comment="" disabled=no

ssh

/ip firewall filter

add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

ftp

/ip firewall filter

add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop

add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \
address-list=ftp_blacklist address-list-timeout=3h

Скрипты

Dinamic DNS

No-ip.com

Создаём в System/Scripts новый скрипт no-ip_ddns_update и внутрь записываем следующее содержимое не забываем указать имя пользователя, пароль, домен, и имя ppp-интерфейса

##############Script Settings##################

:local NOIPUser "пользователь noip"
:local NOIPPass "*******"
:local WANInter "интернет интерфейс ppp"

###############################################

:local NOIPDomain "домен no-ip"
:local IpCurrent [/ip address get [find interface=$WANInter] address];
:for i from=( [:len $IpCurrent] - 1) to=0 do={ 
  :if ( [:pick $IpCurrent $i] = "/") do={ 
    :local NewIP [:pick $IpCurrent 0 $i];
    :if ([:resolve $NOIPDomain] != $NewIP) do={
      /tool fetch mode=http user=$NOIPUser password=$NOIPPass url="http://dynupdate.no-ip.com/nic/update\3Fhostname=$NOIPDomain&myip=$NewIP" keep-result=no
      :log info "NO-IP Update: $NOIPDomain - $NewIP"
     }
   } 
}

Альтернативный скрипт No-ip.com

Этот скрипт я пробовал использовать, но не понравился тем, что он постоянно в логи скидывает статус

# No-IP automatic Dynamic DNS update

#--------------- Change Values in this section to match your setup ------------------

# No-IP User account info
:local noipuser "пользователь noip"
:local noippass "*******"

# Set the hostname or label of network to be updated.
# Hostnames with spaces are unsupported. Replace the value in the quotations below with your host names.
# To specify multiple hosts, separate them with commas.
:local noiphost "домен no-ip"

# Change to the name of interface that gets the dynamic IP address
:local inetinterface "внешний интерфейс в интернет ppp"

#------------------------------------------------------------------------------------
# No more changes need

:global previousIP

:if ([/interface get $inetinterface value-name=running]) do={
# Get the current IP on the interface
   :local currentIP [/ip address get [find interface="$inetinterface" disabled=no] address]

# Strip the net mask off the IP address
   :for i from=( [:len $currentIP] - 1) to=0 do={
       :if ( [:pick $currentIP $i] = "/") do={ 
           :set currentIP [:pick $currentIP 0 $i]
       } 
   }

   :if ($currentIP != $previousIP) do={
       :log info "No-IP: Current IP $currentIP is not equal to previous IP, update needed"
       :set previousIP $currentIP

# The update URL. Note the "\3F" is hex for question mark (?). Required since ? is a special character in commands.
       :local url "http://dynupdate.no-ip.com/nic/update\3Fmyip=$currentIP"
       :local noiphostarray
       :set noiphostarray [:toarray $noiphost]
       :foreach host in=$noiphostarray do={
           :log info "No-IP: Sending update for $host"
           /tool fetch url=($url . "&hostname=$host") user=$noipuser password=$noippass mode=http dst-path=("no-ip_ddns_update-" . $host . ".txt")
           :log info "No-IP: Host $host updated on No-IP with IP $currentIP"
       }
   }  else={
       :log info "No-IP: Previous IP $previousIP is equal to current IP, no update needed"
   }
} else={
   :log info "No-IP: $inetinterface is not currently running, so therefore will not update."
}

Далее надо создать задание в планировщике

/system scheduler add comment="Update No-IP DDNS" disabled=no interval=5m \
name=no-ip_ddns_update on-event=no-ip_ddns_update policy=read,write,test

P.S. если через графический интерфейс то в поле "On Event" надо писать: /system script run no-ip_ddns_update права read,write,test

Планировщик будет проверять необходимость обновления ip каждые 5 минут, если поменялся, то отправит новый ip на сервер no-ip/

No-ip.org

##############Script Settings##################

:local NOIPUser "пользователь"
:local NOIPPass "пароль"
:local WANInter "интернет интерфейс ppp"

############################################### 

:local NOIPDomain "домен .org"
:local IpCurrent [/ip address get [find interface=$WANInter] address];
:for i from=( [:len $IpCurrent] - 1) to=0 do={ 
  :if ( [:pick $IpCurrent $i] = "/") do={ 
    :local NewIP [:pick $IpCurrent 0 $i];
    :if ([:resolve $NOIPDomain] != $NewIP) do={
      /tool fetch mode=http user=$NOIPUser password=$NOIPPass url="http://dynupdate.no-ip.com/nic/update\3Fhostname=$NOIPDomain&myip=$NewIP" keep-result=no
      :log info "NO-IP Update: $NOIPDomain - $NewIP"
     }
   } 
}

PPPoe Reconect

Иногда возникает необходимость менять ip адрес, поскольку доменные службы описанные выше, ругаются на то что адрес не менялся очень давно и грозятся заблокировать аккаунт.

для этого