I tried, but the traffic gets blocked after the first login attempt.

/ ip firewall filter
add chain=input in-interface=ether1 protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop

# accept 10 incorrect logins per minute
/ ip firewall filter
add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

#add to blacklist
add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" address-list=blacklist address-list-timeout=3h

hi, i'm asking a permission to use your script to be included in tutorial that i'm about to make...

Here is a few firewall rules to stop/slow down brute forcers from cracking passwords to your FTP server. In this example, the FTP server is the MikroTik router. To protect a FTP server behind MikroTik, you have to use the forward chain instead of the input & output chains.

The initial stage (stage 1) adds the IP address to the temporary address list ftp_stage1 (timeouts after 1 minute). And thereafter every login attempt within one minute trigger the next stages (stage2 - stage4) until it reaches the last stage (stage 5) that adds the IP address to the ftp_blacklist (timeouts after 1 week).

You have to change in-interface to something else if ether1 is not the network interface card (NIC) connected to the Internet.


This rule drops all listed brute forcers

Code: Select all

/ ip firewall filter 
add chain=input in-interface=ether1 protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \
    comment="drop ftp brute forcers" disabled=no

This rule adds brute forcers to the blacklist (fourth login attempt within a minute)

Code: Select all

/ ip firewall filter 
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage4 action=add-dst-to-address-list \
    address-list=ftp_blacklist address-list-timeout=1w comment="auto-firewall ftp - stage 5" disabled=no

Third login attempt (within a minute)

Code: Select all

/ ip firewall filter 
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage3 action=add-dst-to-address-list \
    address-list=ftp_stage4 address-list-timeout=1m comment="auto-firewall ftp - stage 4" disabled=no

Second login attempt (within a minute)

Code: Select all

/ ip firewall filter 
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage2 action=add-dst-to-address-list \
    address-list=ftp_stage3 address-list-timeout=1m comment="auto-firewall ftp - stage 3" disabled=no

First login attempt (within a minute)

Code: Select all

/ ip firewall filter 
add chain=output content="530 Login incorrect" dst-address-list=ftp_stage1 action=add-dst-to-address-list \
    address-list=ftp_stage2 address-list-timeout=1m comment="auto-firewall ftp - stage 2" disabled=no

Initial stage

Code: Select all

/ ip firewall filter 
add chain=input in-interface=ether1 protocol=tcp dst-port=21 action=add-src-to-address-list \
    address-list=ftp_stage1 address-list-timeout=1m comment="auto-firewall ftp - stage 1" disabled=no