Mikrotik Winbox DOS Exploit Protection

May 10, 2012

I was just alerted to a winbox exploit that is affecting all MTK versions(Thanks Mike). Here are a few tips to protect yourself.

Add firewall rules to allow access to winbox only from management network.

You really should have your router locked down so management can only come from certain subnets anyway.

/ip firewall filter
add action=drop chain=input comment=\
    "Block access to winbox from anyone not on coming from management." \
    disabled=no dst-port=8291 protocol=tcp src-address=!1.1.1.0/24

Add Portknock to access winbox

Portknock app and link here.

Allow access only via VPN

Link to my VPN videos here.

Change default winbox port

Go to IP Services and change the port from default. This isn’t a complete fix, but should help prevent port scanners from exploiting winbox.

IP Services

When you want to winbox just add a colon and the new port number.

Comments

7 responses to “Mikrotik Winbox DOS Exploit Protection”

May 10, 2012

O!

Do you know if ROS 5.16 released yesterday also is affected?
May 10, 2012

Greg

@O
From the description of the exploit I would say yes.
May 10, 2012

iam8up

Just allow a certain number of new connections to 8291 per a /32
May 11, 2012

Greg

@8up
Great tip!

I was thinking of adding that, but I wanted people to use something more proactive rather than reactive. Don’t even allow the opportunity for connection.
May 11, 2012

Justin Wilson

The port knock thing can be a PITA.
May 20, 2012

Boban Acimovic

Isn’t it Winbox client exploit? So, servers (routerboards) are not affected. I am not saying we should not protect them, on the contrary, but this exploit can’t hurt them, it can hurt just your Windows PC.
May 21, 2012

Greg

@Boban
There was an exploit for both. I’m less concerned with the client exploit and more concerned with the DoS attack you can perform against the MTK.