Настройка fail2ban на MikroTik

Настроим бан с первой неверной попытки входа — встроенными средствами и без шедулера в MikroTik.

1. Белый список. Исключаем свои адреса из проверки:

/ip firewall address-list add list=TRUSTED address=1.2.3.4
/ip firewall address-list add list=TRUSTED address=5.6.7.8

2. Сам скрипт:

/system script
add dont-require-permissions=yes name=loginfail2ban owner=example policy=read,write,test source="\
    \n:local ListName \"BlackList\";\
    \n:local WhiteList \"TRUSTED\";\
    \n:local BanTime 30d;\
    \n:local at [:find \$message \" from \"];\
    \n:if ([:typeof \$at] != \"nil\") do={\
    \n  :local r1 [:pick \$message (\$at + 6) [:find \$message \" via \" \$at]];\
    \n  :local addr [:toip \$r1];\
    \n  :if ([:typeof \$addr] = \"ip\") do={\
    \n    :if ([:len [/ip firewall address-list find list=\$WhiteList address=\$r1]] = 0) do={\
    \n      :do {\
    \n        /ip firewall address-list add list=\$ListName address=\$addr timeout=\$BanTime;\
    \n        :log warning (\"fail2ban: banned \" . \$r1 . \" in \" . \$ListName);\
    \n      } on-error={ :log warning (\"fail2ban: \" . \$r1 . \" already in \" . \$ListName) };\
    \n    };\
    \n  } else={\
    \n    :local addr6 [:toip6 \$r1];\
    \n    :if ([:typeof \$addr6] = \"ip6\") do={\
    \n      :do {\
    \n        /ipv6 firewall address-list add list=\$ListName address=\$addr6 timeout=\$BanTime;\
    \n        :log warning (\"fail2ban: banned \" . \$r1 . \" in \" . \$ListName);\
    \n      } on-error={ :log warning (\"fail2ban: \" . \$r1 . \" already in \" . \$ListName) };\
    \n    };\
    \n  };\
    \n};\
    \n"

3. Триггер на неудачный вход:

/system logging action
add name=fail2ban script=loginfail2ban target=script
/system logging
add action=fail2ban regex="^login failure" topics=system,error,critical

4. Блокировка

/ip firewall filter
add action=drop chain=input comment=fail2ban src-address-list=BlackList place-before=0