Hardening Mikrotik

Mikrotik Router Hardening — Manito Networks

1 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

2 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/interface print

/interface set 3,4 disabled=yes

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

3 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

4 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/ip service disable 0,1,2,4,5,7 /tool bandwidth-server set enabled=no /ip dns set allow-remote-requests=no /ip socks set enabled=no

/ip ssh set strong-crypto=yes

tool mac-server set [find] disabled=yes

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

5 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

tool mac-server mac-winbox set [find] disabled=yes tool mac-server ping set enabled=no

/ip service print /tool mac-server print /tool mac-server mac-winbox print /tool mac-server ping print

/tool romon set enabled=no

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

6 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/ip firewall address-list

add address=192.168.0.0/16 list=Bogon add address=10.0.0.0/8 list=Bogon

add address=172.16.0.0/12 list=Bogon add address=127.0.0.0/8 list=Bogon add address=0.0.0.0/8 list=Bogon

add address=169.254.0.0/16 list=Bogon

/ip firewall filter

add chain=input comment="Accept Established / Related Input" connection-state=established,related

add chain=input comment="Allow Management Input" src-address=10.1.157.0/24

add action=drop chain=input comment="Drop Input" log=yes log-prefix="Input Drop"

add action=fasttrack-connection chain=forward comment="Fast Track Established / Related Forward" connectionstate=established,related

add chain=forward comment="Accept Established / Related Forward" connection-state=established,related

add chain=forward comment="Allow client LAN traffic out

WAN" out-interface=ether1-gateway src-address=192.168.0.0/24 add action=drop chain=forward comment="Drop Bogon Forward -> Ether1" in-interface=ether1-gateway log=yes

log-prefix="Bogon Forward Drop" src-address-list=Bogon

add action=drop chain=forward comment="Drop All Forward"

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

7 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/user set 0 password=mygreatpassword /user set 0 name=tikadmin

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

8 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/ip neighbor discovery settings set default=no default-

for-dynamic=no

/ipv6 nd set [find] disabled=yes

/ip neighbor discovery set [find] discover=no

/ip settings set rp-filter=strict

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

9 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

/system note set show-at-login=yes

/system note set note="Authorized administrators only. Access to this device is monitored."

/system ntp client set enabled=yes server-

dns-names=0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

10 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

export compact file=backup_config_router01

8/25/2016 10:20 PM

Mikrotik Router Hardening — Manito Networks

11 of 11

http://www.manitonetworks.com/mikrotik/2016/5/24/mikrotik-router-ha...

8/25/2016 10:20 PM