Tu je velmi pekne fungujuce pravidlo na blokovanie skusacov hesiel pomocou ftp(zakaze pristup vsetkym ip adresam ktore sa skusia prihlasit viac ako 4 krat v priebehu minuty)
zaciatok
/ ip firewall filter
add chain=input in-interface=ether1 protocol=tcp dst-port=21 action=add-src-to-address-list \
address-list=ftp_stage1 address-list-timeout=1m comment="auto-firewall ftp - stage 1" disabled=no
prvy pokus o prihlasenie(v priebehu minuty)
/ ip firewall filter
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage1 action=add-dst-to-address-list \
address-list=ftp_stage2 address-list-timeout=1m comment="auto-firewall ftp - stage 2" disabled=no
Druhy pokus o prihlasenie(v priebehu minuty)
/ ip firewall filter
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage2 action=add-dst-to-address-list \
address-list=ftp_stage3 address-list-timeout=1m comment="auto-firewall ftp - stage 3" disabled=no
Treti pokus o prihlasenie(v prebehu minuty)
/ ip firewall filter
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage3 action=add-dst-to-address-list \
address-list=ftp_stage4 address-list-timeout=1m comment="auto-firewall ftp - stage 4" disabled=no
toto pravidlo da utocnikovu ip do blacklistu(utocnika ktory sa prihlasil 4 krat v priebehu minuty)
/ ip firewall filter
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage4 action=add-dst-to-address-list \
address-list=ftp_blacklist address-list-timeout=1w comment="auto-firewall ftp - stage 5" disabled=no
toto pravidlo zakaze pristup vsetkym ip ktore sa predchadzajucim mechanizmom zapisali do blacklistu
/ ip firewall filter
add chain=input in-interface=ether1 protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \
comment="drop ftp brute forcers" disabled=no
ssh pristup povolte v ip service len na urcitu ip adresu alebo na skupinu, tym zablokujete pokusy cez ssh
