Building Effective Firewalls With MikroTik - MUM PDF

www.iparchitechs.
com
1-855-MIKRO-TIK
Building Effective
Firewalls with
MikroTik
P R E S E N T E D B Y:
RICK FREY, NETWORK ENGINEER
I P A R C H I T E C H S O P E R AT I O N S
1-855-MIKRO-TIK
www.iparchitechs.com
Background
Rick Frey
20+ years in IT & Communication Industries
Designed and implemented a wide array of networks all of the world
Introduced to the MikroTik product line in 2008
Areas of Focus:
Wireless services integration
ISP Solutions
Certifications
Certified MTCNA, MTCRE, MTCTCE, MTCWE
24/7/365 MikroTik TAC
Nationwide Private 4G LTE MPLS
Proactive Network Monitoring
Design / Engineering / Operations
1-855-MIKRO-TIK
IP ArchiTechs Managed Services

The first Carrier-Grade 24/7/365 MikroTik TAC (Technical Assistance Center)
Three tiers of engineering support
Monthly and on-demand pricing available
1-855-MIKRO-TIK or support.iparchitechs.com
Private Nationwide 4G LTE MPLS backbone

Partnership with Verizon Wireless - available anywhere in the Verizon service area
Not Internet facing privately routed over our MPLS infrastructure
Point-to-Point or Point-to-MultiPoint
Proactive Monitoring / Ticketing / Change Control / IPAM

Carrier-Grade Network Engineering / Design in large (10,000+ nodes) environments
1-855-MIKRO-TIK
Objectives
Provide answers to the most commonly asked questions about using the
MikroTik firewall
Tips & Tricks that are best practice for all firewalling scenarios
How can I implement Whitelists/ Blacklists?

How do I block one host from another? How about one subnet from another?
How do I block a host by their MAC address?
How do I block Facebook & other websites?
What is the Layer 7 section & does it do anything?
1-855-MIKRO-TIK
Downloads Available
SSID = FW Presentation
Browse to \\172.16.250.1\pub
Downloads:
APNIC Reserved IP Addresses.rsc
Block by Country Worksheet.xlsx
Block_Country_By_Subnet_Example.rsc
L7_Pattern_Matcher_from_MikroTik.rsc
RWF_Firewall_3.0.rsc
1-855-MIKRO-TIK
Objectives
Tips & Tricks to Make the Firewall More Useful
Blocking countries by IP address
Useful ports to be aware of
Open DNS
1-855-MIKRO-TIK
Best Practice Firewalling Tips & Tricks
1-855-MIKRO-TIK
Best Practice Firewalling Tips & Tricks

Keep all related firewall rules grouped together
Add comments to every single rule

Use user defined chains & ghosted accept rules to organize
Always make sure you have a way into your router
Test all rules before you start dropping traffic
Use Safe Mode every time!
1-855-MIKRO-TIK
Firewalling Basics With RouterOS
1-855-MIKRO-TIK
Whitelists/ Blacklists
Start by creating an allowed access list on open ports
[example: ssh (port 22) and winbox (port 8291) are open]
/ip firewall filter
add chain=input dst-address=172.16.250.1 dst-port=22,8291 protocol=tcp \
src-address-list="Router Admins"
1-855-MIKRO-TIK
Now we create the Router
Admins list
By having this processed 1st we help
ensure that we stay connected to
the router
This simple rule is useful for all
firewalling scenarios
1-855-MIKRO-TIK
Now even if we create a drop that says, Drop Everything we are still
able to connect to the router
/ip firewall filter
add action=drop chain=input
1-855-MIKRO-TIK
How to Block Hosts/ Subnets
1-855-MIKRO-TIK

/ip firewall filter
add action=drop chain=forward dst-address=172.16.1.0/24 src-address=\
192.168.1.0/24
add action=drop chain=input dst-address=172.16.1.0/24 src-address=\

192.168.1.0/24
add action=drop chain=input dst-address=192.168.1.0/24 src-address=\

172.16.1.0/24
1st Rule blocks the hosts talking to the hosts
2nd & 3rd prevent the hosts from communicating on the opposite gateway addresses
1-855-MIKRO-TIK
1-855-MIKRO-TIK
How to Block Host by MAC
1-855-MIKRO-TIK
1-855-MIKRO-TIK

This rule does not block 100% of the traffic
Traffic from this MAC to other hosts and out to the WAN should be
blocked
Traffic from the host to the gateway may not be blocked
Take the additional step of blocking the IP address.
Additional steps may be required
1-855-MIKRO-TIK
How do we block websites?

Websites can be blocked by IP address using Address List, but if we
want to block the site by the URL we will need to use the Web Proxy
Step 1 Turn on the Web Proxy
Step 2 Create Web Proxy Access List Rules
Step 3 Create a NAT redirect rule
Step 4 - Test
1-855-MIKRO-TIK
Blocking Websites
1-855-MIKRO-TIK
Blocking Websites
1-855-MIKRO-TIK
Blocking Websites
1-855-MIKRO-TIK
Blocking Websites
The Redirect rule belongs above the masquerade rule
1-855-MIKRO-TIK
Blocking Websites
1-855-MIKRO-TIK
Layer 7 matching
Only works for ICMP, TCP, & UDP streams
Only looks at the first 10 packets or 2kB of each connection,
whichever is smaller
For most applications, Layer 7 rules only work properly in the forward
chain (The rules need to see incoming & outgoing traffic) or by using
both the input/ prerouting & output/ postrouting chains
1-855-MIKRO-TIK
Layer 7 matching
106 Pre-configured L7 Patterns are available at
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/L7
Note that they have varying levels of reliability
Many more examples are available throughout the Wiki and the
Forums
http://l7-filter.sourceforge.net/protocols
1-855-MIKRO-TIK
Layer 7 Example
1-855-MIKRO-TIK
BlockCountries By IP Address
Spreadsheet has subnets for 238 localities
1-855-MIKRO-TIK
BlockCountries By IP Address
How it is used
By adding the Address list to the forward chain we can prevent our
LAN hosts from access anything on those subnets at all
Adding the list the Input chain will result in excess use of resources for
what is ultimately very little benefit
Dont try to add all countries! Only use the ones you need. Some
countries have thousands of subnets
Adding all of the approximately million subnets will shut down
most routers
1-855-MIKRO-TIK
Managing Ports in the Firewall

A list of 406 common TCP/ UDP firewall ports have been include in
the Firewall scripts.
All port numbers were taken from
http://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
Port rules default to on, so delete port rules that dont apply to you
1-855-MIKRO-TIK
Managing Ports in the Firewall
1-855-MIKRO-TIK
Open DNS
1-855-MIKRO-TIK
Open DNS
Provides filtering for:

Adware, Alcohol, Chat, Classifieds, Dating, Drugs,
Gambling, Games, Hate/Discrimination, Instant
Messaging, P2P/File sharing, Social Networking,
Video Sharing, Visual Search Engines, Weapons,
Webmail, Photo Sharing, Adult Themes,
TastelessLingerie/Bikini, Proxy/Anonymizer,
Sexuality, Nudity, Pornography
1-855-MIKRO-TIK
Open DNS
Simple Configuration!
Step 1 Change the DNS addresses
in RouterOS to point to OpenDNS
Step 2 Add the routers IP or URL

into the OpenDNS Dashboard
Step 3 Use dashboard to set
permissions levels
1-855-MIKRO-TIK
Questions?

Building Effective Firewalls With MikroTik - MUM PDF

Uploaded by

Copyright:

Available Formats

Building Effective Firewalls With MikroTik - MUM PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Building Effective Firewalls With MikroTik - MUM PDF

Uploaded by

Copyright:

Available Formats

www.iparchitechs.

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

IP ArchiTechs Managed Services

Private Nationwide 4G LTE MPLS backbone

Proactive Monitoring / Ticketing / Change Control / IPAM

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

How can I implement Whitelists/ Blacklists?

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

Best Practice Firewalling Tips & Tricks

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

Best Practice Firewalling Tips & Tricks

Add comments to every single rule

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

Firewalling Basics With RouterOS

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

How to Block Hosts/ Subnets

24/7/365 MikroTik TAC

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations

How to Block Hosts/ Subnets

add action=drop chain=input dst-address=172.16.1.0/24 src-address=\

add action=drop chain=input dst-address=192.168.1.0/24 src-address=\

1st Rule blocks the hosts talking to the hosts

Nationwide Private 4G LTE MPLS

Proactive Network Monitoring

Design / Engineering / Operations