Server-side list modificationIn place of any of the particular lists below, you can merge lists as well as modify other commands such as address list name, timeout etc. To use this copy and paste the following to a browser, play with the attributes to get the lists you want then include your customized URL as the fetch URL.
Example Script using genlistModify the text in the box below to meet your needs and copy it then paste in your router's terminal.
MikroTik Automatically Updated Address List
When you offer public access to a service it can be rather difficult to separate the bad connections from the good.
MikroTik to the rescue with address lists… simply put the bad addresses in a list and block anything in the list. Sounds like fun right… or maybe not so much? Of course you can (and should) manually create rules to detect abuse and dynamically create the lists… However there is more that you can do, you can subscribe to lists that are maintained by others like Spamhaus, dshield,
Example of a parsed list
# Generated by Joshaven Potter on Mon Nov 16 06:25:01 EST 2015 /ip firewall address-list add list=blacklist address=22.214.171.124/17 comment=SpamHaus add list=blacklist address=126.96.36.199/20 comment=SpamHaus add list=blacklist address=188.8.131.52/14 comment=SpamHaus ...
The implementation is simple... paste the following code into the terminal of any MikroTik and your router will grab the newest copy of my script file and run it regular basis.The following will not block anything, it only adds IP’s to your address list. You will still have to create a firewall rule which will match src-address-list=blacklist and drop the traffic in your input and/or forward chains.
In order to use any of the following lists you will want to add a rule to your input or forward chains like the following:
add chain=input action=drop comment="Drop new connections from blacklisted IP's to this router" \
connection-state=new src-address-list=blacklist in-interface=ether1-Internet
“Spamhaus Don’t Route Or Peer List (DROP)""
The DROP list will not include any IP address space under the control of any legitimate network – even if being used by “the spammers from hell”. DROP will only include netblocks allocated directly by an established Regional Internet Registry (RIR) or National Internet Registry (NIR) such as ARIN, RIPE, AFRINIC, APNIC, LACNIC or KRNIC or direct RIR allocations.”
“This list summarizes the top 20 attacking class C (/24) subnets over the last three days. The number of ‘attacks’ indicates the number of targets reporting scans from this subnet.”
"Protect your business and PBX's against VoIP Fraud Minimize the risks of attacks on your Telephony Server Save bandwidth by using Geolocation filtering."
Data Source: VoIP Blacklist by ScopServ International Inc.
WARNING: Use carefully! This is a huge list which can quickly cause performance issues.
BruteForceBlocker is a perl script, that works along with pf - OpenBSD's firewall (which is also available on FreeBSD and NetBSD) and its main purpose is to block SSH bruteforce attacks via firewall.
When this script is running, it checks sshd logs from syslog and looks for failed login attempts - mostly some annoying script attacks, and counts number of such attempts.
When given IP reaches configured limit of fails, script puts this IP to the pf's table and blocks any further traffic from the given IP.
Furthermore, the blocked IP is reported to the project site which enables users to share a list of abusive IPs. The list is publicly available at http://danger.rulez.sk/projects/bruteforceblocker/blist.php
If you are bored of those automated auth tries, you will be happy with this script. BruteForceBlocker is easy to use, simple, and effective.
For installation instructions see INSTALL file.
CINS Army List
The CINS Army list is a subset of the CINS Active Threat Intelligence ruleset, and consists
of IP addresses that meet one of two basic criteria: 1) The IP's recent Rogue Packet score
factor is very poor, or 2) The IP has tripped a designated number of 'trusted' alerts across
a given number of our Sentinels deployed around the world.
Read more on CINSscore.com
WARNING: use carefully, this is a large set of IP's.