Takto to bylo pred napadenim.
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
address-list-timeout=30m chain=input comment=\
"Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \
tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" \
src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
address-list-timeout=1w chain=input comment="Port Scanner Detect" \
protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop to port scan list" \
src-address-list=Port_Scanner
add action=add-src-to-address-list address-list=blocked address-list-timeout=\
1h chain=input comment=DDoS connection-limit=100,32 protocol=tcp
add action=tarpit chain=input connection-limit=3,32 protocol=tcp \
src-address-list=blocked
add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
ICMP protocol=icmp
add action=accept chain=ICMP comment="Echo request - Avoiding Ping Flood" \
icmp-options=8:0 limit=1,5 protocol=icmp
add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=ICMP comment="Destination unreachable" icmp-options=\
3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
protocol=icmp
add action=accept chain=input comment="Povoleni INPUT established, related" \
connection-state=established,related
add action=accept chain=input comment="Allow IKEv2" in-interface=WAN \
protocol=ipsec-esp
add action=accept chain=input dst-port=500 in-interface=WAN protocol=udp
add action=accept chain=input dst-port=4500 in-interface=WAN protocol=udp
add action=accept chain=input comment="Allow OpenVPN" dst-port=1195 \
in-interface=WAN protocol=tcp
add action=drop chain=input comment="DROP Input LAN" in-interface=LAN \
src-address-list=!localnet
add action=drop chain=input comment="DROP input" in-interface=WAN
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=add-src-to-address-list address-list=spammers \
address-list-timeout=3h chain=forward comment=\
"Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
protocol=tcp src-address-list=spammers
add action=accept chain=forward comment="Established, related FORWARD" \
connection-state=established,related
add action=accept chain=forward comment="Posta forward WAN" dst-port=\
25,587,465 out-interface=WAN protocol=tcp src-address=192.168.56.1
add action=drop chain=forward dst-port=25,587,465 out-interface=WAN protocol=\
tcp src-address=192.168.56.0/24
add action=accept chain=forward comment=Localnet src-address=192.168.1.0/24
add action=accept chain=forward src-address=192.168.56.0/24
add action=accept chain=forward comment=VPN src-address=172.16.16.0/24
add action=drop chain=forward comment=Invalid connection-state=invalid
add action=drop chain=forward comment="DROP Forward" connection-nat-state=\
!dstnat connection-state=new in-interface=WAN
add action=accept chain=SYN-Protect connection-state=new limit=400,5 \
protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp \
tcp-flags=syn
/ip service
set telnet address=192.168.56.0/24 disabled=yes
set ftp address=192.168.56.0/24 disabled=yes
set www address=192.168.56.0/24
set ssh address=192.168.56.0/24
Po napadeni a vycisteni jsem v /ip service zablokoval obe API a nastavil LAN rozsah na Winbox port ...
