MIKROITK: How To stop TELNET Brute force

If there are many TELNET request is forwarding through your router and if it's from out side the network
randomly and if it's consuming more and more bandwidth then you can consider it as TELNET brute
force attack .

In such case if you will use the torch in your WAN interface or any other interface where the clients are connected in that case you can consider it as telnet attack.


Let start the configuration .


/ ip firewall filter
add chain=input protocol=tcp dst-port=23 src-address-list=telnet_blacklist action=drop comment="Drop Telnet Brute Forcers" disabled=no
add chain=input protocol=tcp dst-port=23 connection-state=new src-address-list=telnet_stage3 action=add-src-to-address-list address-list=telnet_blacklist address-list-timeout=1d comment="" disabled=no
add chain=input protocol=tcp dst-port=23 connection-state=new src-address-list=telnet_stage2 action=add-src-to-address-list address-list=telnet_stage3 address-list-timeout=1m comment="" disabled=no
add chain=input protocol=tcp dst-port=23 connection-state=new src-address-list=telnet_stage1 action=add-src-to-address-list address-list=telnet_stage2 address-list-timeout=1m comment="" disabled=no

add chain=input protocol=tcp dst-port=23 connection-state=new action=add-src-to-address-list address-list=telnet_stage1 address-list-timeout=1m comment="" disabled=no

NOTE:-Sometimes you have to modify the rules little bit .