Yesterday I noticed a strange activity of my humble web server: it was moderately warm, was twitching by HDD heads and LAN activity was unusually high.

When I looked to logs, found that some host is scanning my web server for documents using file names brute force.

Is there any protection against such a brute force attack that I could implement in RouterOS?


Yes, there is a protection. Basically, you will have to add a firewall rule to detect such hosts (criteria: several tcp/port 80 connections from same host), and when you have one, add that source IP to an address-list.

/ip firewall filter add chain=input protocol=tcp dst-port=80 connection-limit=200,32  \
action=add-src-to-address-list  address-list=blocked-addr address-list-timeout=1d 

Then, block incoming connections from that address-list.

/ip firewall filter add chain=input src-address-list=blocked-addr action=drop

You have to tune the limit (here, 200). And also the chain (input if the Web server is the mikrotik device, forward if it's another web server)

This is adapted from the wiki: http://wiki.mikrotik.com/wiki/DoS_attack_protection


The answer from Benoit allows for blocking hosts making simultaneous requests. But if they are closing the connections as fast as they are opening them you might not get much of them to filter by. Another logic is to use dst-limit which have rate limit.

  • We add a rate-limit list:
/ip firewall address-list
add list=rate-limit
  • We then set the filtering rules:
    • Jump to rate-limit chain for all new connection on the WAN;
    • Check if there have been 10 connections for the last 1 minute with bursts of 5 based on the dst-address and resetting after 2 minutes of inactivity
    • If the dst-limit is reached, the return action is skipped and the next action in the rate-limit chain is executed - add-src-to-address-list to the rate-limit list with 10 minutes timeout.
/ip firewall filter
add chain=forward action=jump jump-target=rate-limit connection-state=new in-interface-list=WAN
chain=rate-limit action=return dst-limit=10/1m,5,dst-address/2m
chain=rate-limit action=add-src-to-address-list address-list=rate-limit address-list-timeout=10m
  • Finally, we add the drop in the raw, so we save on resources:
/ip firewall raw
add action=drop chain=prerouting src-address-list=rate-limit

You can play with the connection count and the timings to fine tune based on specific needs. You can monitor in the Firewall/Conncetions tab with filter for your public IP to see

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.