3 ;;; Drop SSH connection from IP addresses in ssh_blacklist address list
chain=input action=drop protocol=tcp src-address-list=ssh_blacklist dst-port=10022
4 ;;; Blocked IP address that attempted multiple SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_3 address-list=ssh_blacklist address-list-timeout=1d dst-port=10022 log=no
5 ;;; IP address that attempted to create 3 SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_2 address-list=ssh_attempt_3 address-list-timeout=30s dst-port=10022 log=no
6 ;;; IP address that attempted to create 2 SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_1 address-list=ssh_attempt_2 address-list-timeout=30s dst-port=10022 log=no
7 ;;; IP address that attempted to create an SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp address-list=ssh_attempt_1 address-list-timeout=30s dst-port=10022 log=no
하기와 같이 filter를 적용하였습니다.
30초 동안에 동일 IP로 4회 이상 접속(성공 또는 실패)시, 1일간 해당 IP로 추가 접속(성공 및 실패)가 차단되는 내역 입니다.
하기 URL 참조 하였습니다.
https://matthewsiemens.com/blocking-ssh-brute-force-attacks-in-mikrotik-routeros/
3 ;;; Drop SSH connection from IP addresses in ssh_blacklist address list
chain=input action=drop protocol=tcp src-address-list=ssh_blacklist dst-port=10022
4 ;;; Blocked IP address that attempted multiple SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_3 address-list=ssh_blacklist address-list-timeout=1d dst-port=10022 log=no
5 ;;; IP address that attempted to create 3 SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_2 address-list=ssh_attempt_3 address-list-timeout=30s dst-port=10022 log=no
6 ;;; IP address that attempted to create 2 SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp src-address-list=ssh_attempt_1 address-list=ssh_attempt_2 address-list-timeout=30s dst-port=10022 log=no
7 ;;; IP address that attempted to create an SSH connections
chain=input action=add-src-to-address-list connection-state=new protocol=tcp address-list=ssh_attempt_1 address-list-timeout=30s dst-port=10022 log=no