??: ????? ?? ??? ??? ? ??? ??
??? ??? ????? ???, ???? ??? ? ?? ????? ??? ????. ???? ?? ????, DDoS ??, ??? ?? ? ??? ????? ???? ??? ??? ????. ??? ?? ????? ??? ?? ?? ???? ???? ??? ???? ?? ? ?? ???? ??? ???? ???, ?? ?????? ?????? ?? ?? ???? ?? ??????.
MikroTik RouterOS? ???? ?? ??? ??? ?????, ??? ??? ??? ??? ?? ??? ???? ???? ???? ??? ???? ?????. ? ???? ?? ???? MikroTik RouterOS ???? ?? ?? ??? ????? ????, ???? ???? ???? ?? ??????? ?? ???? ????? ??? ???.
1. MikroTik ??? ???? ?? ??
MikroTik RouterOS? ???? Linux ??? Netfilter ?????? ???? ???, ? ??? ? ????? ?? ???? ????. ? ????? ???? ?? ??? ? ??? ?? ?????.
1.1 ? ?? ?? ??(Chain)
MikroTik ???? ?? ??? “??(Chain)”??, ??? ???? ??? ? ?? ?? ??? ?? ?????.
- Input ??: ??? ??? ???? ?? ??? ?????. ??? ?? ??, SSH, API ?? ????? ?? ???? ? ??? ?????.
- Output ??: ??? ???? ??? ??? ?????. ???? ?? ??? ??(?: DNS ??, NTP ???)? ? ??? ?????.
- Forward ??: ???? ??? ???? ??? ?????. ?? ?????? ?? ??? ????, ???? ??? ??? ?? ??? ? ??? ????.
1.2 ?? ?? ????
MikroTik ???? ??? ?? ??(Connection Tracking) ????? ????, ??? ?? ?? ???? ???? ?????.
- new: ? ??? ? ?? ??
- established: ?? ??? ??? ?? ??
- related: ?? ??? ??? ??(?: FTP ??? ??, ICMP ?? ???)
- invalid: ??? ? ??? ??? ?? ???? ??? ?? ??
?? ??? ???? ?? ??????? ??? ??? ??? ???? ? ?? ?????. ?? ?? ??? ?? ???? ?? ?? ?? ??? ??? ???, ? ?? ???? ?? ???? ??? ??? ? ????.
2. ?? ?? ??: ? ?? ??? ??
2.1 ?? ?? ??
??? ? ?? ??? “?? ??(Default Deny)”, ? ????? ???? ?? ?? ?? ???? ????. MikroTik??? ? ??? ???? drop-all ??? ???? ???? ?????.
/ip firewall filter add chain=input action=drop comment="Drop all input" add chain=forward action=drop comment="Drop all forward"
?? ??: ?? ?? ??? ???? ?? ??? ??? ???? ?? ???? ???. ??? ??? ??? ??? ?? ????!
2.2 ??? ?? ?? ??(Input ??)
???? ????? ????? ? ??? ??? ?? ?? ?????. ??? Input ??? ?? ?????.
/ip firewall filter # ??? ?? ? ?? ?? ?? add chain=input action=accept connection-state=established,related comment="Accept established,related" # ???? ?? ?? ?? add chain=input action=drop connection-state=invalid comment="Drop invalid" # ICMP ??(?? ??) add chain=input action=accept protocol=icmp limit=5,10:packet comment="Accept ICMP with rate limit" # ?????? ??? ?? ??? ?? ?? add chain=input action=accept src-address=192.168.0.0/16 protocol=tcp dst-port=22,80,443,8291 comment="Accept management from LAN" # ??? DNS ?? ?? add chain=input action=accept src-address=192.168.0.0/16 protocol=udp dst-port=53 comment="Accept DNS from LAN" # ?? ?? add chain=input action=drop comment="Drop all other input"
? ??? ????? ?? ?? ??? ????, ????? ??? ?? ??? ?? ??? ? ??? ???. 8291? Winbox? ?? ????? ???? ?? ??? ???? ?? ?? ??????.
2.3 ??? ??? ??(Forward ??)
Forward ??? ???? ??? ??? ?? ??? ?????. Forward ??? ???? ???? ?? ??? ?? ? ?? ? ???, ???? ??? ?? ?? ??? ??? ? ????.
/ip firewall filter # ??? ?? ? ?? ?? ?? add chain=forward action=accept connection-state=established,related comment="Accept established,related" # ???? ?? ?? ?? add chain=forward action=drop connection-state=invalid comment="Drop invalid" # ??? ????? ??? ?? add chain=forward action=accept in-interface=bridge-lan out-interface=pppoe-wan comment="Accept LAN to WAN" # DNAT(?? ???) ?? ??? ?? add chain=forward action=accept connection-nat-state=dstnat comment="Accept DNAT" # ?? ?? add chain=forward action=drop comment="Drop all other forward"
3. ?? ?? ??: ??????? ?? ??
3.1 ?? ??(Address List) ?? ??
MikroTik? ?? ?? ??? ???? ? ????, ?????? ??????? ???? ??? ? ????. ?? ????? ???? ?? ????? ????? ???? ? ????.
/ip firewall address-list add address=10.0.0.0/8 list=BOGON comment="RFC1918" add address=172.16.0.0/12 list=BOGON comment="RFC1918" add address=192.168.0.0/16 list=BOGON comment="RFC1918" add address=0.0.0.0/8 list=BOGON comment="Invalid" /ip firewall filter add chain=forward action=drop src-address-list=BOGON in-interface=pppoe-wan comment="Drop bogon from WAN" add chain=forward action=drop dst-address-list=BOGON out-interface=pppoe-wan comment="Drop bogon to WAN"
? ??? ???? ???? ?? ??? ?? ??(IP Spoofing)? ????, ?? ?? DDoS ??? ?? ?????.
3.2 ?? ?? ??
???? ??? ???? ?? ?? ?? ??? ?? ??? ?? ? ??? ???? ?????. MikroTik? ?? ??? ??? ??? ??? ???? ??? ? ????.
/ip firewall filter # ?? ?? ?? ? ?? add chain=input action=add-src-to-address-list psd=21,3s,3,1 address-list=port-scanners address-list-timeout=2w comment="Detect port scanners" # ??? ??? ?? add chain=input action=drop src-address-list=port-scanners comment="Drop port scanners"
PSD(Port Scan Detection) ???? ??: 21=??? ???, 3s=?? ???, 3=?? ??? ?? ?, 1=?? ??? ?? ?. ??? ???? ?? ??? ?? ??? ??? ???? ?? ??? ???? ???? ?????? 2?? ?????.
3.3 SYN Flood ??
SYN Flood? ?? ?? DDoS ?? ?? ? ?????. ???? ??? SYN ??? ???? 3?? ?????? ???? ?? ??? ?? ??? ??????.
/ip firewall filter # ?? SYN ?? ?? ?? add chain=forward action=accept tcp-flags=syn connection-state=new limit=50,10:packet comment="Limit new TCP connections" # ??? ??? SYN ?? ?? add chain=forward action=drop tcp-flags=syn connection-state=new comment="Drop excess SYN"
3.4 Layer 7 ???? ???
MikroTik? Layer 7 ???? ??? ???? ?????? ?? ??? ???? ???? ???? ? ????. ?? ???? ??? ??? ??????? ???? ? ?? ?????.
/ip firewall layer7-protocol add name=facebook regexp="^.+(facebook.com).*\$" add name=youtube regexp="^.+(youtube.com).*\$" /ip firewall filter add chain=forward action=drop layer7-protocol=facebook comment="Block Facebook" add chain=forward action=drop layer7-protocol=youtube comment="Block YouTube"
??: Layer 7 ???? ??? CPU? ??? ???, ???? ?? ??????? ???? ????? ?? ???? ????? ?? ?????.
4. NAT ? ?? ??? ?? ??
4.1 ??? ?? ??? ??
?? ???(DNAT)? ????? ?? ?? ???? ?? ? ???, ?? ??? ?? ??? ???? ? ?????. ??? ???? ?? ??? ??? ?? ?? ???? ??? ???:
/ip firewall nat # ??? ?? ??? ??: ?? ?? IP? ?? ?? add chain=dstnat action=dst-nat to-addresses=192.168.1.100 to-ports=443 \ protocol=tcp dst-port=443 src-address-list=trusted-ips comment="Secure DNAT for web server"
?? ?? ???:
- RDP(3389), SSH(22) ? ?? ??? ?? ?? ???? ?? ???? ????
- ??? ?? ??? ?? ?? ??? ???? ??????
- src-address-list? ?? ???? ?? ??? ??????
- ? DNAT ??? ??? ???? ??? ??? ??????
4.2 NAT ???(Hairpin NAT)
?? ???? ?? IP? ?? ?? ???? ???? ? ?? Hairpin NAT? ???? ???:
/ip firewall nat add chain=srcnat action=masquerade src-address=192.168.1.0/24 \ dst-address=192.168.1.100 out-interface=bridge-lan comment="Hairpin NAT"
Hairpin NAT ?? ??? ???? ?????? ?? ?? ?? ? ????, ?? ?? ?? ???? ????? ?? IP? ?? ???? ???? ??? ???.
5. ??? ????: ?? ??? ??
5.1 ??? ?? ??
??? ?? ??? ??? ??????. ??? ?? ??? ?? ??? ?? ?? ???, ?? ??? ???? ?? ??? ???:
/ip firewall filter # ??? ?? ?? add chain=input action=log log-prefix="INPUT-DROP" action=drop comment="Log dropped input" add chain=forward action=log log-prefix="FORWARD-DROP" action=drop comment="Log dropped forward" # ????? ?? ?? add chain=input action=log log-prefix="PORT-SCAN" src-address-list=port-scanners comment="Log port scan activity"
5.2 ?? ?? ??
???? ??? ?? ??? ?? ??? ?? ?? ??? ???? ???, ??? ?? ??? ???? ?? ?? ?????:
/system logging action add name=remote target=remote remote=192.168.1.200 remote-port=514 /system logging add action=remote topics=firewall add action=remote topics=system,error add action=remote topics=system,warning
5.3 ??? ????? ??
MikroTik? Traffic Flow ??? ???? ??? ??? ?? ????? ???? ?? ??? ??? ? ????:
/ip traffic-flow set enabled=yes cache-entries=4k set active-flow-timeout=30m inactive-flow-timeout=15s /ip traffic-flow ipfix set src-address=0.0.0.0 dst-address=192.168.1.200 dst-port=2055
6. ??? ??: ?? ??? ?? ??
6.1 ??? ?? ?? ?? ??
SSH ??? ?? ??? ???? ??? ?? ?? ?? ? ?????. ?? ??? ??? ?? ??? ???? ???? ??? ? ????:
/ip firewall filter # 1??: ??? ?? ?? add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ src-address-list=ssh-stage1 address-list=ssh-stage2 address-list-timeout=30s \ connection-state=new comment="SSH brute force stage 2" add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ src-address-list=ssh-stage2 address-list=ssh-blacklist address-list-timeout=7d \ connection-state=new comment="SSH brute force blacklist" # 1?? ?? add chain=input action=add-src-to-address-list protocol=tcp dst-port=22 \ address-list=ssh-stage1 address-list-timeout=30s connection-state=new \ comment="SSH brute force stage 1" # ????? ?? add chain=input action=drop src-address-list=ssh-blacklist comment="Drop SSH brute forcers"
? 3?? ?? ????? ??? ??? ????. ? SSH ?? ?? ? stage1 ??? ????(30? ????), 30? ?? ? ?? ??? stage2? ????, ??? ????? ?????? ???? 7?? ?????. ?? ???? ?? ????? ?? ???? ?? ???? ???, ??? ?? ??? ?? ??? ???? ?????.
6.2 ?? ?? ????
Scheduler ??? ???? ???? ?? ??? ?? ????? ??? ? ????:
/system scheduler
add name=daily-security-check interval=24h on-event="/system script run security-check" \
start-time=03:00:00
/system script
add name=security-check source={
:log info "Running daily security check..."
/ip firewall address-list remove [find list=port-scanners timeout-active=no]
:log info "Cleaned expired address list entries"
}
7. Siwenlide: ??? IT ?? ??? ???
?????? ???? ??? ???? ?? IT ?? ?? ??? ???? ??? ????. ?? ???? ?? ????? ???? ??? ???, ??? ??? ?? ??? ? ???. Siwenlide(Beijing Siwen Lide Technology & Trade Co., Ltd.)? ??? ‘IT ???’ 3-in-1 ?? ?? ???? ?? ? ??? ???? ?? ??????.
??? ???? ? ?? ?? ??? ?????:
- ??? ??: ????? ??? ? ?? ??????? ???? ??? ???? ????? ?? ??? ?????. ??? ???? ?? ???, MikroTik?? ??? ??? ??? ?? ???? ??? ?? ??? ??? ????.
- ?? ???? ??: ?? ?? ???? ???? ??? ???? ???? ??? ???? ?? ??? ??? ??? ??? ????. ??? ???, ???, ??? ? ?? ???? ???? ?????.
- ??? ??: 7×24?? ????? ??, ?? ?? ?? ?????. ?? ??? ??? ?? ??, ?? ?? ???, ??? ???? ?? ???? ??? ? ????.
? ??? ?? ?? ???, ??? ?? ??? ??? ???? ?? ?? ???? ?? ?? ?? ?????? ?? ??? ???? ?????. Siwenlide? ?? ?? ??? ??? ???? ?? ?? ???, ? ????? ??? ?? ???? ??? ?? ?? ??? ?? ??? ?? ???? ??? ???? ??? ??? ??? ?? ???? ???.
???? ??? ??? ??? ??? ???? ??? ?????. Siwenlide? ???? ?? ?? ??? ??? ??? ??? ?????? ????. ? ??? ??? www.siwenlide.com? ?????? ??? ??? ????.
