Mikrotik Router Protection

Misalnya saja jaringan local kita memiliki kelas ip 192.168.0.0/24, dan interface WAN disebut ether1, kita membuat firewall yang membolehkan koneksi yang menuju server dan mendrop /blocking sisanya. Kita juga akan memperbolehkan protokol ICMP yang dengan itu orang bisa melakukan ping ke jaringan kita lewat internet (meskipun ada baiknya di tutup dari jaringan lain / di allow hanya untuk beberapa ip yang kita percayai)

/ip firewall filter
add chain=input connection-state=invalid action=drop comment="Drop Invalid connections"

add chain=input connection-state=established action=accept comment="Allow Established connections"

add chain=input protocol=icmp action=accept comment="Allow ICMP"
add chain=input src-address=192.168.0.0/24 action=accept in-interface=!ether1
add chain=input action=drop comment="Drop everything else"

Memproteksi Kustomer

Untuk memproteksi jaringan customer /client kita harus melakukan chek pada semua trafik yang melewati router dan memblok yang tidak di inginkan, untuk icmp, tcp, dan udp trafik kita akan membuat chains, yang mana chain itu akan men-drop semua paket yang tidak di inginkan.

/ip firewall filter
add chain=forward protocol=tcp connection-state=invalid action=drop comment="drop invalid connections"

add chain=forward connection-state=established action=accept comment="allow already established connections"

add chain=forward connection-state=related action=accept comment="allow related connections"

Block Bogon IP ADDRESS pada Mikrotik

/ip firewall filter
add chain=forward src-address=0.0.0.0/8 action=drop 
add chain=forward dst-address=0.0.0.0/8 action=drop 
add chain=forward src-address=127.0.0.0/8 action=drop
add chain=forward dst-address=127.0.0.0/8 action=drop
add chain=forward src-address=224.0.0.0/3 action=drop
add chain=forward dst-address=224.0.0.0/3 action=drop

Buat JUMP ke chain yang baru Mikrotik

/ip firewall filter 
add chain=forward protocol=tcp action=jump jump-target=tcp 
add chain=forward protocol=udp action=jump jump-target=udp 
add chain=forward protocol=icmp action=jump jump-target=icmp

Buat TCP CHAIN untuk men- DENY tcp port yang tidak perlu pada Mikrotik

/ip firewall filter 
add chain=tcp protocol=tcp dst-port=69 action=drop comment="deny TFTP"
add chain=tcp protocol=tcp dst-port=111 action=drop comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=135 action=drop comment="deny RPC portmapper"
add chain=tcp protocol=tcp dst-port=137-139 action=drop comment="deny NBT"
add chain=tcp protocol=tcp dst-port=445 action=drop comment="deny cifs"
add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"
add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny BackOriffice"
add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"

Deny UDP PORT di dalam UDP CHAIN

add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"
add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC portmapper"
add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"
add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"
add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice"

Allow ICMP yang dibutuhkan didalam chain ICMP

add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="echo reply"
add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="net unreachable"
add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="host unreachable"
add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="allow source quench"
add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="allow echo request"
add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="allow time exceed"
add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="allow parameter bad"
add chain=icmp action=drop comment="deny all other types" 

#http://www.jasasettingmikrotik.web.id/2011/02/mikrotik-router-protection.html