Advanced MikroTik Security

ADVANCED MIKROTIK ROUTER-OS PROTECTIONS

DISCLAIMER: We are not responsible for any error, failure, damage or your router being locked due to intentional or accidental factors. Our Tool works independently, not under the auspices of the MikroTik Company, all problems that occur on your router are your own responsibility and you must be prepared to accept all the risks. If you "Agree", please continue.

Mikrotik Port Service	Description & Script
API (8728)	Application Programmable Interface (API), a service that allows users to create custom software or applications that communicate with the router... `# API Port Enable /ip service set api port=8728 address=0.0.0.0/0 disabled=no # API Port Disable /ip service set api port=8728 address=0.0.0.0/0 disabled=yes`
FTP (21)	Mikrotik provides a standard FTP service that uses ports 20 and 21. FTP is usually used to upload or download router data... `# FTP Port Enable /ip service set ftp port=21 address=0.0.0.0/0 disabled=no # FTP Port Disable /ip service set ftp port=21 address=0.0.0.0/0 disabled=yes`
SSH (22)	Is one way to remote router in a console with secure. Data transmitted by SSH is encrypted... `# SSH Port Enable /ip service set ssh port=22 address=0.0.0.0/0 disabled=no # SSH Port Disable /ip service set ssh port=22 address=0.0.0.0/0 disabled=yes`
WINBOX (8291)	The service that allows the Winbox application to connect to the router. You can change the Port for more Secure! `# WINBOX Port Enable /ip service set winbox port=8291 address=0.0.0.0/0 disabled=no # WINBOX Port Disable /ip service set winbox port=8291 address=0.0.0.0/0 disabled=yes`
Advanced Router Security
Protect Mac Server	If you want the router to be unable to be remotely using MAC-address either through Winbox or via telnet, turn off the MAC-Server feature. `# Protect login from Mac Address /tool mac-server mac-winbox set allowed-interface-list=none /tool mac-server ping set enabled=no`
Anti NETCUT	Anti Netcut, Netcut broadcasts ARP and attacks on Layer2. Use the script below to block naughty users. `# ANTI NETCUT /ip firewall address-list add list=netcut address=www.arcai.com /ip firewall mangle add action=add-src-to-address-list address-list=NetcutUser ... /ip firewall filter add action=drop chain=forward src-address-list=NetcutUser`
Anti DDoS Attacks	Anticipate DDoS attacks, namely by limiting the number of connections in firewall rules. `# Anti DDoS Attacks /ip firewall filter add chain=forward connection-state=new action=jump jump-target=block-ddos add chain=forward connection-state=new src-address-list=ddoser action=drop`