Mikrotik Malicious Spam IP Blacklist – Firewall Auto Update Script

We have published a malicious ip blacklist for free! Combined dshield and spamhaus malicious blacklists formatted for Mikrotik RouterOS .rsc import script to firewall address list, updated daily and formatted by our servers for easy import and download into your Mikrotik Router.


It can be downloaded directly here. Or follow the instructions below to setup firewall rules and schedule automatic daily updates on any Mikrotik Router.



To automatically download, update, and apply the combind Dshield, Spamhaus ip blacklists on your Mikrotik Router:
First: Log into Winbox.


Open a terminal and add the following firewall rules

ip firewall raw add chain=prerouting dst-address-list="sbl malc0de" action=drop comment="sbl malc0de"
ip firewall raw add chain=prerouting dst-address-list="sbl dshield" action=drop comment="sbl dshield"
ip firewall raw add chain=prerouting dst-address-list="sbl spamhaus" action=drop comment="sbl spamhaus"
ip firewall raw add chain=prerouting dst-address-list="sbl blocklist.de" action=drop comment="sbl blocklist.de"

Now we need to schedule the automated update: Go to system scheduler and create a new task.

/tool fetch address=www.squidblacklist.org host=www.squidblacklist.org mode=http src-path=/downloads/drop.malicious.rsc

Now we schedule the import task: Go to system scheduler and create a new task.

:log warning "Disabling system Logging";
import drop.malicious.rsc
/system logging enable 0

Mikrotik squid tproxy forward rules

/ip route
add disabled=yes distance=1 gateway=115.117.79.130 routing-mark=tproxied

/ip firewall mangle
add chain=prerouting disabled=yes port=80 protocol=tcp src-mac-address=00:22:4D:A7:BC:60
add action=mark-routing chain=prerouting disabled=yes dst-address-list=cache-addr dst-port=80 new-routing-mark=tproxied protocol=tcp src-address=!115.117.81.2 src-address-list=redirect-addr
add action=mark-routing chain=prerouting disabled=yes dst-address=!115.117.81.2 dst-address-list=redirect-addr new-routing-mark=tproxied protocol=tcp src-address-list=cache-addr src-port=80
add action=mark-routing chain=prerouting disabled=yes dst-address-list=cache-addr dst-port=80 new-routing-mark=tproxied protocol=tcp src-address=172.16.0.0/23
add action=mark-routing chain=prerouting disabled=yes dst-address-list=!non-cache new-routing-mark=tproxied protocol=tcp src-address-list=cache-addr src-mac-address=!00:22:4D:A7:BC:60 src-port=80

Block torrents with mikrotik

Block torrents with mikrotik

/ip firewall layer7-protocol
add comment="Block Bit Torrent" name=layer7-bittorrent-exp regexp="^(\\x13bitt\
    orrent protocol|azver\\x01\$|get /scrape\\\?info_hash=get /announce\\\?inf\
    o_hash=|get /client/bitcomet/|GET /data\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[\
    RP]"
 
/ip firewall filter
add action=add-src-to-address-list address-list=Torrent-Conn \
    address-list-timeout=2m chain=forward layer7-protocol=\
    layer7-bittorrent-exp src-address=192.168.10.0/24 src-address-list=\
    !allow-bit
add action=add-src-to-address-list address-list=Torrent-Conn \
    address-list-timeout=2m chain=forward p2p=all-p2p src-address=\
    192.168.10.0/24 src-address-list=!allow-bit
 
/ip firewall filter
add action=drop chain=forward dst-port=!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=tcp \
    src-address-list=Torrent-Conn
add action=drop chain=forward dst-port=!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=udp \
    src-address-list=Torrent-Conn

Prioritize SpeedTest.Net Results via Mikrotik Queue

# Mark speedtest in Layer7 firewall
/ip firewall layer7-protocol
add name=speedtest regexp="^.+(speedtest).*\\\$"
 
# Marking SPEEDTEST.NET in mangle section using L7
/ip firewall mangle
add action=mark-connection chain=forward comment=SPEEDTEST layer7-protocol=speedtest new-connection-mark=speedtest_conn
add action=mark-connection chain=prerouting new-connection-mark=speedtest_conn protocol=tcp src-port=8080
add action=mark-packet chain=prerouting connection-mark=speedtest_conn new-packet-mark=speedtest_pkt passthrough=no
add action=mark-connection chain=postrouting dst-port=8080 new-connection-mark=speedtest_conn protocol=tcp
add action=mark-packet chain=postrouting connection-mark=speedtest_conn new-packet-mark=speedtest_pkt passthrough=no
 
# ADD PCQ so that i can be applied on per ip bases later in simple queue / zaib
/queue type
add kind=pcq name=download-2mb pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=dst-address pcq-dst-address-mask=32 pcq-dst-address6-mask=64 pcq-limit=50 pcq-rate=2048k \
    pcq-src-address-mask=32 pcq-src-address6-mask=64 pcq-total-limit=2000
add kind=pcq name=upload-2mb pcq-burst-rate=0 pcq-burst-threshold=0 pcq-burst-time=10s pcq-classifier=src-address pcq-dst-address-mask=32 pcq-dst-address6-mask=64 pcq-limit=50 pcq-rate=2048k \
    pcq-src-address-mask=32 pcq-src-address6-mask=64 pcq-total-limit=2000
 
# Add simple QUEUE to limit speedtest.net 2mb PER USER
/queue simple
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s comment="Limit every Users at 2mb using PCQ. for speedtest only marked by mangle / zaib" direction=both disabled=no interface=all limit-at=0/0 max-limit=0/0 name=\
    "SpeedTest.Net 2Mb per use via g PCQ / zaib" packet-marks=speedtest_pkt parent=none priority=8 queue=upload-2mb/download-2mb target-addresses=192.168.5.0/24 total-queue=default-small
 
# Add simple QUEUE to limit user PC individually for rest of traffic, static or dynamic up to your network.
add burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s direction=both disabled=no interface=all limit-at=512k/512k max-limit=512k/512k name="Zaib Desktop 512k A llowed - 192.168.5.2" packet-marks="" \
    parent=none priority=8 queue=default-small/default-small target-addresses=192.168.5.2/32 total-queue=default-small

Ubuntu DNS Primary Master with Caching Nameserver

DNS Auto Install Script

#!/bin/bash
#title           :install-dns-on-ubuntu1404.sh
#description     :This script will install dns on ubuntu 14.04
#author          :Henry den Hengst
#date            :25 November 2014
#version         :0.1    
#usage           :bash install-dns-on-ubuntu1404.sh
#URL             :-
#user_password   :-
#notes           :-
#bash_version    :- 
#credits_source  :https://help.ubuntu.com/
#
sudo apt-get update && sudo apt-get upgrade -y
sudo apt-get install bind9 dnsutils openssh-server ntp -y
# Edit /etc/network/interfaces to meet your requirements.
#
sudo sed -i 's!dhcp!static!g' /etc/network/interfaces
sudo sed -i '$ a\address 192.168.1.10' /etc/network/interfaces
sudo sed -i '$ a\netmask 255.255.255.0' /etc/network/interfaces
sudo sed -i '$ a\network 192.168.1.0' /etc/network/interfaces
sudo sed -i '$ a\broadcast 192.168.1.255' /etc/network/interfaces
sudo sed -i '$ a\gateway 192.168.1.1' /etc/network/interfaces
#
sudo sed -i '$ a\dns-nameservers 192.168.1.10 192.168.1.11 8.8.8.8 8.8.4.4' /etc/network/interfaces
sudo sed -i '$ a\dns-search cloudconsult.local' /etc/network/interfaces
sudo sed -i '$ a\dns-domain cloudconsult.local' /etc/network/interfaces
#
# restart network
sudo service networking restart
#
cd /etc/bind/
# sudo rm named.conf.options
# sudo wget -c https://dl.dropboxusercontent.com/u/36257811/bind9/named.conf.options
sudo rm named.conf.local
sudo wget -c https://dl.dropboxusercontent.com/u/36257811/bind9/named.conf.local
sudo wget -c https://dl.dropboxusercontent.com/u/36257811/bind9/db.cloudconsult.local
sudo wget -c https://dl.dropboxusercontent.com/u/36257811/bind9/db.192
sudo service bind9 restart
sudo ufw enable
sudo ufw allow OpenSSH
sudo ufw allow Bind9

Auto DNS Install and configure on Ubuntu

DNS Auto Install Script

#!/bin/bash
#
# Before
echo Before > quertytime.txt
dig distrowatch.com | grep 'Query time' >> quertytime.txt
#
sudo apt-get install bind9 dnsutils bind9-doc -y
#
sudo xxx /etc/bind/named.conf.options
  forwarders {
       8.8.8.8;
       8.8.4.4;
  };
#
sudo xxx /etc/bind/named.conf.local
zone "linux.rocks" {
             type master;
             file "/etc/bind/db.linux.rocks";
        };
 
zone "96.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/db.192";
};
#
sudo cp /etc/bind/db.local /etc/bind/db.linux.rocks
sudo xxx /etc/bind/db.linux.rocks
zie 192.168.1.4
#
sudo cp /etc/bind/db.127 /etc/bind/db.192
sudo xxx /etc/bind/db.192
#
sudo /etc/init.d/bind9 start
#
ping a-host-in-netwerk -c 4 > test.txt
#
#
# After
echo After >> quertytime.txt
dig distrowatch.com | grep 'Query time' >> quertytime.txt

How to make Mikrotik transparent web proxy

By default, the web-proxy is listening on port 8080. Therefore we first need to redirect all traffic on port 80 to port 8080 with a DST-NAT firewall rule and ensure that the web-proxy service is enabled and listening to port 8080.


To enable a transparent web proxy on Mikrotik, perform the following:

ip firewall nat add in-interface=ether1 dst-port=80 protocol=tcp action=redirect to-ports=8080 chain=dstnat 
ip proxy set enabled=yes port=8080

Customizing error pages To customize the page web proxy shows on error:

[admin@MikroTik] > /ip proxy reset-html
Current html pages will be lost! Reset anyway? [y/N]

Mikrotik port forwarding example | How to redirect http traffic

This article showing up how to forwarding http traffic into the internal web server.
Let our WEB server IP address 192.168.10.100 and using port 80.

/ip firewall nat
add  chain=dstnat disabled=no dst-port=80 protocol=tcp action=dst-nat to-addresses=192.168.10.100 to-ports=80

As a result all internal http traffic forwarding internal web servers.

Securing your Mikrotik Router

Basic Security for mikrotik routers.

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www port=82
set ssh disabled=yes

/ip firewall address-list
add address=192.168.155.0/24 list=local-addr
add address=192.168.154.0/30 list=safe-addr

/ip firewall filter
add action=accept chain=input comment="accept established connection packets" connection-state=established
add action=accept chain=input comment="accept related connection packets" connection-state=related
add action=drop chain=input comment="drop invalid packets" connection-state=invalid
add action=drop chain=input comment="Drop blocked traffic" connection-state=new src-address-list=blocked-addr
add action=tarpit chain=input comment="suppress DoS attack" connection-limit=3,32 protocol=tcp
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=1h chain=input comment="Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=blocked-addr address-list-timeout=1d chain=input comment="detect DoS attack" connection-limit=20,32 protocol=tcp
add action=accept chain=input comment="Allow access to router from local network" connection-state=new src-address-list=local-addr
add action=accept chain=input comment="Allow access to router from safe network" connection-state=new src-address-list=safe-addr
add action=jump chain=input comment="jump to chain ICMP" jump-target=ICMP protocol=icmp
add action=jump chain=input comment="jump to chain services" jump-target=services
add action=accept chain=input comment="Allow Broadcast Traffic" dst-address-type=broadcast
add action=log chain=input disabled=yes log-prefix=Filter:
add action=drop chain=input comment="drop everything else"
add action=accept chain=ICMP comment="0:0 and limit for 5pac/s" icmp-options=0:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:3 and limit for 5pac/s" icmp-options=3:3 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:4 and limit for 5pac/s" icmp-options=3:4 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="8:0 and limit for 5pac/s" icmp-options=8:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="11:0 and limit for 5pac/s" icmp-options=11:0-255 limit=5,5 protocol=icmp
add action=drop chain=ICMP comment="Drop everything else" protocol=icmp
add action=accept chain=services comment="accept localhost" src-address=127.0.0.1
add action=accept chain=services comment="allow MACwinbox " dst-port=20561 protocol=udp
add action=accept chain=services comment="Bandwidth server" dst-port=2000 protocol=tcp
add action=accept chain=services comment=" MT Discovery Protocol" dst-port=5678 protocol=udp
add action=accept chain=services comment="allow SNMP" dst-port=161 protocol=tcp
add action=accept chain=services comment="Allow BGP" dst-port=179 protocol=tcp
add action=accept chain=services comment="allow BGP" dst-port=5000-5100 protocol=udp
add action=accept chain=services comment="Allow NTP" dst-port=123 protocol=udp
add action=accept chain=services comment="Allow PPTP" dst-port=1723 protocol=tcp
add action=accept chain=services comment="allow PPTP and EoIP" protocol=gre
add action=accept chain=services comment="allow DNS request" dst-port=53 protocol=tcp
add action=accept chain=services comment="Allow DNS request" dst-port=53 protocol=udp
add action=accept chain=services comment=UPnP dst-port=1900 protocol=udp
add action=accept chain=services comment="allow DHCP" dst-port=67-68 protocol=udp
add action=accept chain=services comment=UPnP dst-port=2828 protocol=tcp
add action=accept chain=services comment="allow Web Proxy" dst-port=8080 protocol=tcp
add action=accept chain=services comment="allow IPIP" protocol=ipencap
add action=accept chain=services comment="allow https for Hotspot" dst-port=443 protocol=tcp
add action=accept chain=services comment="allow Socks for Hotspot" dst-port=1080 protocol=tcp
add action=accept chain=services comment="allow IPSec connections" dst-port=500 protocol=udp
add action=accept chain=services comment="allow IPSec" protocol=ipsec-esp
add action=accept chain=services comment="allow IPSec" protocol=ipsec-ah
add action=accept chain=services comment="allow RIP" dst-port=520-521 protocol=udp
add action=accept chain=services comment="allow OSPF" protocol=ospf
add action=return chain=services