{"id":5863,"date":"2018-08-27T12:34:15","date_gmt":"2018-08-27T18:34:15","guid":{"rendered":"http:\/\/gregsowell.com\/?p=5863"},"modified":"2018-08-27T12:53:02","modified_gmt":"2018-08-27T18:53:02","slug":"protect-your-network-from-mikrotik-exploits","status":"publish","type":"post","link":"https:\/\/gregsowell.com\/?p=5863","title":{"rendered":"Protect Your Network From Mikrotik Exploits"},"content":{"rendered":"<p>Attacks on older versions of Mikrotik have stepped up recently.  You can easily protect your network from such attacks in a couple of simple steps.<\/p>\n<p>1. Update your Mikrotik to a new version that isn&#8217;t affected <\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">system package upgrade<\/code><\/pre>\n<p><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/system-package.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/system-package.png\" alt=\"\" width=\"622\" height=\"196\" class=\"aligncenter size-full wp-image-5865\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/system-package.png 622w, https:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/system-package-300x95.png 300w\" sizes=\"auto, (max-width: 622px) 100vw, 622px\" \/><\/a><\/p>\n<p>2. Disable any unneeded Mikrotik services<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">ip services\r\ndis 0,1,2,3,4,7<\/code><\/pre>\n<p><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/ip-services.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/ip-services.png\" alt=\"\" width=\"449\" height=\"205\" class=\"aligncenter size-full wp-image-5864\" srcset=\"https:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/ip-services.png 449w, https:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/ip-services-300x137.png 300w\" sizes=\"auto, (max-width: 449px) 100vw, 449px\" \/><\/a><\/p>\n<p>3. Add firewall rules to protect those services &#8211; be sure to drag it to the top of the list<\/p>\n<pre class=\"gs-code\"><code class=\"language-plaintext\">\/ip firewall address-list\r\n# create an address-list where management traffic will be sourced from\r\nadd address=192.168.5.0\/24 list=management\r\n\r\n\/ip firewall filter\r\n# create a firewall drop rule that will block access to the allowed ip services if it&#039;s not from the management subnet\r\nadd action=drop chain=input dst-port=80,8291 protocol=tcp src-address-list=!management<\/code><\/pre>\n<p><figure id=\"attachment_5866\" aria-describedby=\"caption-attachment-5866\" style=\"width: 236px\" class=\"wp-caption aligncenter\"><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/al1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/al1.png\" alt=\"\" width=\"236\" height=\"132\" class=\"size-full wp-image-5866\" \/><\/a><figcaption id=\"caption-attachment-5866\" class=\"wp-caption-text\">Create entries in an address list that will specify what your management subnets are.<\/figcaption><\/figure><br \/>\n<a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw1.png\" alt=\"\" width=\"281\" height=\"227\" class=\"aligncenter size-full wp-image-5867\" \/><\/a><\/p>\n<p><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw2.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw2.png\" alt=\"\" width=\"271\" height=\"85\" class=\"aligncenter size-full wp-image-5868\" \/><\/a><\/p>\n<p><a href=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw3.png\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/gregsowell.com\/wp-content\/uploads\/2018\/08\/fw3.png\" alt=\"\" width=\"272\" height=\"77\" class=\"aligncenter size-full wp-image-5869\" \/><\/a><\/p>\n<p>If you would like to <strong>protect Mikrotiks inside <\/strong>of your network, you should <strong>apply similar rules to the forward chain<\/strong> of your <strong>border routers<\/strong>.<\/p>\n<p>This obviously isn&#8217;t a complete security policy, or all of the firewall rules you should have in place, but it will at a minimum stop attacks.<\/p>\n<p>If you have been comprimised, you really should update, then verify no new users, firewall rules, socks, or web proxies are in place.  <\/p>\n<h2>You then need to change all of your user\/password combos as part of the exploits is extraction of the user database!<\/h2>\n<p>You should update ASAP.  A best strategy would be to reset the configuration, update, and rebuild.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attacks on older versions of Mikrotik have stepped up recently. You can easily protect your network from such attacks in a couple of simple\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-5863","post","type-post","status-publish","format-standard","hentry","category-mikrotik"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5863"}],"version-history":[{"count":4,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5863\/revisions"}],"predecessor-version":[{"id":5905,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5863\/revisions\/5905"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}