This is a good way to block Brute Force attackers on prot 3389 MS-RDP.
- The new RDP connection is added to rdp_stage1 address list for 5 mins
- The second time it connects adds it to rdp_stage2 address list for 5 mins
- The thrird time adds it to rdp_stage3 address list for 5 mins
- The fourth time the attacker ends up to Blocked address list for 10 Days.
/ip firewall filter
add action=reject chain=forward log-prefix=”Blocked – ” reject-with=icmp-network-unreachable src-address-list=Blocked
add action=add-src-to-address-list address-list=Blocked address-list-timeout=1w3d chain=forward connection-state=new dst-port=3389 log=yes log-prefix=”RDP BRUTEFORCE – ” protocol=tcp src-address-list=rdp_stage3
add action=add-src-to-address-list address-list=rdp_stage3 address-list-timeout=5m chain=forward connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage2
add action=add-src-to-address-list address-list=rdp_stage2 address-list-timeout=5m chain=forward connection-state=new dst-port=3389 protocol=tcp src-address-list=rdp_stage1
add action=add-src-to-address-list address-list=rdp_stage1 address-list-timeout=5m chain=forward connection-state=new dst-port=3389 protocol=tcp
Hope you liked it.
One reply on “Block Brute Force on Microsoft RDP using Mikrotik Router”
Hi, for port forwarding we use next rules:
/ip firewall nat
add action=add-src-to-address-list address-list=ZBlocked address-list-timeout=1w3d chain=dstnat dst-port=your_external_ports log=yes log-prefix=”RDP BRUTEFORCE – ” protocol=tcp src-address-list=Zrdp_stage3
add action=add-src-to-address-list address-list=Zrdp_stage3 address-list-timeout=5m chain=dstnat dst-port=your_external_ports protocol=tcp to-ports=3389 src-address-list=Zrdp_stage2
add action=add-src-to-address-list address-list=Zrdp_stage2 address-list-timeout=5m chain=dstnat dst-port=your_external_ports protocol=tcp to-ports=3389 src-address-list=Zrdp_stage1
add action=add-src-to-address-list address-list=Zrdp_stage1 address-list-timeout=5m chain=dstnat dst-port=your_external_ports protocol=tcp to-ports=3389
And add WiteListing rule for ip addresses our party.
Maybe that help someone. )