My Mikrotik Configuration (part 2)

Previous... My Mikrotik Configuration (part 1)

Step 2, Security.

Setup username and password

user set 0 name=ngeri password=ngeri group=full

user add name=user01 password=password group: read

Don’t use default user admin. Look at what I have done. I change the default user to be other user name. Don't forget to setup the password. It will make your mikrotik more secure.

Setup Firewall.

by grouping IP networks will make it easier to configure the firewall later.

• IP-LAN, IP addresses for Lan.
• Full-trust, IP Public can be fully trusted. Admin can remotely the Mikrotik.
• half-trust, IP public that are not fully trusted, Sometimes, This IP address can be used by admins to remotely the Mikrotik.
• Local-untrust, IP address that is not trusted.

/ip firewall address-list

add address=10.17.123.0/24 disabled=no list=IP-LAN

add address=10.254.128.0/22 disabled=no list=IP-LAN

add address=1xx.9x.xx.xx/27 disabled=no list=full-trust

add address=1xx.1xx.xx.xx disabled=no list=full-trust

add address=0.0.0.0/8 disabled=no list=local-untrust

add address=192.168.0.0/16 disabled=no list=local-untrust

add address=127.0.0.0/8 disabled=no list=local-untrust

add address=224.0.0.0/3 disabled=no list=local-untrust

add address=172.16.0.0/12 disabled=no list=local-untrust

add address=1xx.0.0.0/8 disabled=no list=half-trust

add address=2xx.0.0.0/8 disabled=no list=half-trust

add address=1xx.0.0.0/8 disabled=no list=half-trust

add address=3x.0.0.0/8 disabled=no list=half-trust

Drop IP address Local unused or untrusted

/ip firewall filter

add action=drop chain=forward comment="Drop Local Untrust" disabled=no \

    src-address-list=local-untrust

add action=drop chain=forward disabled=no dst-address-list=local-untrust

Drop Connection invalid.

add action=drop chain=forward comment="drop invalid connections" \

    connection-state=invalid disabled=no

add action=accept chain=forward connection-state=established disabled=no

add action=accept chain=forward comment="allow related connections" \

    connection-state=related disabled=no

For communication Mikrotik with other DNS Server

add action=accept chain=input disabled=no dst-port=53,5353 protocol=udp

add action=accept chain=input disabled=no dst-port=53,5353 protocol=tcp

10.17.123.10 is IP address for cacti. Cacti need port 22 (ssh) and port 161 (snmp). Trust everything from 10.17.123.10.

add action=accept chain=input disabled=no src-address=10.17.123.10

And this is it, rules for IP addresses, 10.17.123.6. Users not need to know about this IP. But if one day users know about this IP address, we can identify who is connected to the IP address. There is a rule to the make records every IP address that accesses to the IP 10.17.123.6. According this results, we can analize IP address that should be blocked.

add action=add-src-to-address-list address-list=IP_connect_to_graph \

    address-list-timeout=0s chain=input disabled=no dst-address=10.17.123.6 \

    dst-port=80 in-interface=LAN protocol=tcp src-address=10.254.128.0/22

add action=accept chain=input disabled=no dst-address=10.17.123.6 dst-port=80 \

    in-interface=LAN protocol=tcp src-address=10.254.128.0/22

add action=drop chain=input disabled=no dst-address=10.17.123.6

Now about the security of the interface WAN. First, we limit IP address that will be connected to the router mikrotik. We just allow IP addresses that exist in half-trust group.

add action=drop chain=input disabled=no in-interface=WAN protocol=tcp \

    src-address-list=!half-trust

Identify the IP address of scanner then do blacklist

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="Port scanners to list " \

    disabled=no protocol=tcp psd=21,3s,3,1

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \

    disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="SYN/FIN scan" disabled=no \

    protocol=tcp tcp-flags=fin,syn

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="SYN/RST scan" disabled=no \

    protocol=tcp tcp-flags=syn,rst

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" disabled=\

    no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="ALL/ALL scan" disabled=no \

    protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg

add action=add-src-to-address-list address-list="port scanners" \

    address-list-timeout=2w chain=input comment="NMAP NULL scan" disabled=no \

    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg

add action=drop chain=input comment="dropping port scanners" disabled=no \

    src-address-list="port scanners"

Limited Ping Flooding

add action=accept chain=icmp comment="Limited Ping Flood" disabled=no \

    icmp-options=0:0-255 limit=5,5 protocol=icmp

add action=accept chain=icmp disabled=no icmp-options=3:3 limit=5,5 protocol=\

    icmp

add action=accept chain=icmp disabled=no icmp-options=3:4 limit=5,5 protocol=\

    icmp

add action=accept chain=icmp disabled=no icmp-options=8:0-255 limit=5,5 \

    protocol=icmp

add action=accept chain=icmp disabled=no icmp-options=11:0-255 limit=5,5 \

    protocol=icmp

add action=drop chain=icmp disabled=no protocol=icmp

Identify the IP address who using ssh brute forces, then do blacklist.

add action=drop chain=input comment="drop ssh brute forcers" disabled=no \

    add action=accept chain=input disabled=no in-interface=WAN src-address-list=\

    full-trust

add action=drop chain=input comment="drop ssh brute forcers" disabled=no \

    dst-port=22,8291 protocol=tcp src-address-list=ssh_blacklist

add action=add-src-to-address-list address-list=ssh_blacklist \

    address-list-timeout=1w3d chain=input connection-state=new disabled=no \

    dst-port=22,8291 protocol=tcp src-address-list=ssh_stage3

add action=add-src-to-address-list address-list=ssh_stage3 \

    address-list-timeout=1m chain=input connection-state=new disabled=no \

    dst-port=22,8291 protocol=tcp src-address-list=ssh_stage2

add action=add-src-to-address-list address-list=ssh_stage2 \

    address-list-timeout=1m chain=input connection-state=new disabled=no \

    dst-port=22,8291 protocol=tcp src-address-list=ssh_stage1

add action=add-src-to-address-list address-list=ssh_stage1 \

    address-list-timeout=1m chain=input connection-state=new disabled=no \

    dst-port=22,8291 protocol=tcp src-address-list=!half-trust

add action=drop chain=forward comment="drop ssh brute downstream" disabled=no \

    src-address-list=ssh_blacklist

add action=drop chain=input disabled=no protocol=tcp in-interface=WAN \

    dst-port=!53,5353,22,8291

Just allow to access to ports 22 and 8291, from the interface LAN network.

add action=drop chain=input disabled=no dst-port=!22,8291 in-interface=LAN \

    protocol=tcp

Close the ports indicate viruses and malware. Be careful. Make sure the port services that you need and import is not blocked.

add action=jump chain=forward disabled=no jump-target=udp protocol=udp

add action=jump chain=forward comment="Separate Protocol into Chains" \

    disabled=no jump-target=tcp protocol=tcp

add action=jump chain=forward disabled=no jump-target=icmp protocol=icmp

add action=jump chain=forward comment="jump to the virus chain" disabled=no \

    jump-target=virus

add action=drop chain=udp comment="Bloking UDP Packet, deny TFTP" disabled=no \

    dst-port=69 protocol=udp

add action=drop chain=udp comment="deny PRC portmapper" disabled=no dst-port=\

    111 protocol=udp

add action=drop chain=udp comment="deny PRC portmapper" disabled=no dst-port=\

    135,445 protocol=udp

add action=drop chain=udp comment="deny NBT" disabled=no dst-port=137-139 \

    protocol=udp

add action=drop chain=udp comment="deny NFS" disabled=no dst-port=2049 \

    protocol=udp

add action=drop chain=udp comment="deny BackOriffice" disabled=no dst-port=\

    3133 protocol=udp

add action=drop chain=tcp comment="Bloking TCP Packet, deny TFTP" disabled=no \

    dst-port=67-69 protocol=tcp

add action=drop chain=tcp comment="deny RPC portmapper" disabled=no dst-port=\

    111 protocol=tcp

add action=drop chain=tcp disabled=yes dst-port=119 protocol=tcp

add action=drop chain=tcp comment="deny RPC portmapper" disabled=no dst-port=\

    135 protocol=tcp

add action=drop chain=tcp comment="deny NBT" disabled=no dst-port=137-139 \

    protocol=tcp

add action=drop chain=tcp comment="deny cifs" disabled=no dst-port=445 \

    protocol=tcp

add action=drop chain=tcp comment="deny NFS" disabled=no dst-port=2049 \

    protocol=tcp

add action=drop chain=tcp comment="deny  BackOriffice" disabled=no dst-port=\

    3133 protocol=tcp

add action=drop chain=tcp comment="deny NetBus" disabled=no dst-port=20034 \

    protocol=tcp

add action=drop chain=tcp comment="Drop NetBus" disabled=no dst-port=\

    12345-12346 protocol=tcp

add action=drop chain=virus comment=\

    "________ And there are port that indicate virus" disabled=no dst-port=\

    593 protocol=tcp

add action=drop chain=virus comment="________ & Remote Storm" disabled=no \

    dst-port=1024-1030 protocol=tcp

add action=drop chain=virus comment=________ disabled=no dst-port=1214 \

    protocol=tcp

add action=drop chain=virus comment="ndm requester & ndm server" disabled=no \

    dst-port=1363-1364 protocol=tcp

add action=drop chain=virus comment="screen cast" disabled=no dst-port=1368 \

    protocol=tcp

add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373 \

    protocol=tcp

add action=drop chain=virus comment=cichlid disabled=no dst-port=1377 \

    protocol=tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434 \

    protocol=tcp

add action=drop chain=virus comment="Bagle Virus" disabled=no dst-port=2745 \

    protocol=tcp

add action=drop chain=virus comment="Drop Beagle" disabled=no dst-port=2535 \

    protocol=tcp

add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=\

    3127-3128 protocol=tcp

add action=drop chain=virus comment="Drop Backdoor OptixPro" disabled=no \

    dst-port=3410 protocol=tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\

    tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\

    udp

add action=drop chain=virus comment="Drop Sasser" disabled=no dst-port=5554 \

    protocol=tcp

add action=drop chain=virus comment="Drop Beagle.B" disabled=no dst-port=8866 \

    protocol=tcp

add action=drop chain=virus comment="Drop Dabber.A-B" disabled=no dst-port=\

    9898 protocol=tcp

add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=\

    10000 protocol=tcp

add action=drop chain=virus comment="Drop MyDoom.B" disabled=no dst-port=\

    10080 protocol=tcp

add action=drop chain=virus comment="Drop Kuang2" disabled=no dst-port=17300 \

    protocol=tcp

add action=drop chain=virus comment="Drop SubSeven" disabled=no dst-port=\

    27374 protocol=tcp

add action=drop chain=virus comment="Drop PhatBot, Agobot, Gaobot" disabled=\

    no dst-port=65506 protocol=tcp

add action=drop chain=virus comment="Sockets des Troie" disabled=no dst-port=\

    1 protocol=udp

add action=drop chain=virus comment=Death disabled=no dst-port=2 protocol=tcp

add action=drop chain=virus comment="Senna Spy FTP server" disabled=no \

    dst-port=20 protocol=tcp

add action=drop chain=virus comment="Back Construction, Blade Runner, Cattivik\

    \_FTP Server, CC Invader, Dark FTP, Doly Trojan, Fore, Invisible FTP, Jugg\

    ernaut 42, Larva, MotIv FTP, Net Administrator, Ramen, Senna Spy FTP serve\

    r, The Flu, Traitor 21, WebEx, WinCrash" disabled=yes dst-port=21 \

    protocol=tcp

add action=drop chain=virus comment=\

    "Fire HacKer, Tiny Telnet Server TTS, Truva Atl" disabled=no dst-port=23 \

    protocol=tcp

add action=drop chain=virus comment="Ajan, Antigen, Barok, Email Password Send\

    er EPS, EPS II, Gip, Gris, Happy99, Hpteam mail, Hybris, I love you, Kuang\

    2, Magic Horse, MBT Mail Bombing Trojan, Moscow Email trojan, Naebi, NewAp\

    t worm, ProMail trojan, Shtirlitz, Stealth, Tapiras, Terminator, WinPC, Wi\

    nSpy" disabled=no dst-port=25 protocol=tcp

add action=drop chain=virus comment="Agent 40421" disabled=no dst-port=30 \

    protocol=tcp

add action=drop chain=virus comment=\

    "Agent 31, Hackers Paradise, Masters Paradise" disabled=no dst-port=31 \

    protocol=tcp

add action=drop chain=virus comment="Deep Throat, Foreplay" disabled=no \

    dst-port=41 protocol=tcp

add action=drop chain=virus comment=DRAT disabled=no dst-port=48 protocol=tcp

add action=drop chain=virus comment=DRAT disabled=no dst-port=50 protocol=tcp

add action=drop chain=virus comment=DMSetup disabled=no dst-port=58 protocol=\

    tcp

add action=drop chain=virus comment=DMSetup disabled=no dst-port=59 protocol=\

    tcp

add action=drop chain=virus comment="CDK, Firehotcker" disabled=no dst-port=\

    79 protocol=tcp

add action=drop chain=virus comment=RemoConChubo disabled=no dst-port=81 \

    protocol=tcp

add action=drop chain=virus comment="Hidden Port, NCX" disabled=no dst-port=\

    99 protocol=tcp

add action=drop chain=virus comment="ProMail trojan" disabled=yes dst-port=\

    110 protocol=tcp

add action=drop chain=virus comment="Invisible Identd Deamon, Kazimas" \

    disabled=no dst-port=113 protocol=tcp

add action=drop chain=virus comment="Attack Bot, God Message, JammerKillah" \

    disabled=no dst-port=121 protocol=tcp

add action=drop chain=virus comment="Net Controller" disabled=no dst-port=123 \

    protocol=tcp

add action=drop chain=virus comment=Farnaz disabled=no dst-port=133 protocol=\

    tcp

add action=drop chain=virus comment=NetTaxi disabled=no dst-port=142 \

    protocol=tcp

add action=drop chain=virus comment=Infector disabled=no dst-port=146 \

    protocol=tcp

add action=drop chain=virus comment=Infector disabled=no dst-port=146 \

    protocol=udp

add action=drop chain=virus comment=A-trojan disabled=no dst-port=170 \

    protocol=tcp

add action=drop chain=virus comment=Backage disabled=no dst-port=334 \

    protocol=tcp

add action=drop chain=virus comment=Backage disabled=no dst-port=411 \

    protocol=tcp

add action=drop chain=virus comment="Breach, Incognito" disabled=no dst-port=\

    420 protocol=tcp

add action=drop chain=virus comment="TCP Wrappers trojan" disabled=no \

    dst-port=421 protocol=tcp

add action=drop chain=virus comment="Hackers Paradise" disabled=no dst-port=\

    456 protocol=tcp

add action=drop chain=virus comment="Grlogin & RPC Backdoor" disabled=no \

    dst-port=513-514 protocol=tcp

add action=drop chain=virus comment="Net666, Rasmin" disabled=no dst-port=531 \

    protocol=tcp

add action=drop chain=virus comment="711 trojan, Seven Eleven, Ini-Killer, Net\

    \_Administrator, Phase Zero, Phase-0, Stealth Spy" disabled=no dst-port=\

    555 protocol=tcp

add action=drop chain=virus comment="Secret Service" disabled=no dst-port=605 \

    protocol=tcp

add action=drop chain=virus comment="Attack FTP, Back Construction, BLA trojan\

    , Cain & Abel, NokNok, Satans Back Door SBD, ServU, Shadow Phyre, th3r1pp3\

    rz Therippers SniperNet" disabled=no dst-port=666-667 protocol=tcp

add action=drop chain=virus comment="DP trojan" disabled=no dst-port=669 \

    protocol=tcp

add action=drop chain=virus comment=GayOL disabled=no dst-port=692 protocol=\

    tcp

add action=drop chain=virus comment="AimSpy, Undetected" disabled=no \

    dst-port=777 protocol=tcp

add action=drop chain=virus comment=WinHole disabled=no dst-port=808 \

    protocol=tcp

add action=drop chain=virus comment="Dark Shadow" disabled=no dst-port=911 \

    protocol=tcp

add action=drop chain=virus comment="Deep Throat, Foreplay, WinSatan & Der Spa\

    eher, Direct Connection & Der Spaeher, Le Guardien, Silencer, WebEx" \

    disabled=no dst-port=999 protocol=tcp

add action=drop chain=virus comment="Doly Trojan" disabled=no dst-port=\

    1010-1016 protocol=tcp

add action=drop chain=virus comment=Vampire disabled=no dst-port=1020 \

    protocol=tcp

add action=drop chain=virus comment="Remote Storm" disabled=no dst-port=1025 \

    protocol=udp

add action=drop chain=virus comment=Multidropper disabled=no dst-port=1035 \

    protocol=tcp

add action=drop chain=virus comment="BLA trojan" disabled=no dst-port=1042 \

    protocol=tcp

add action=drop chain=virus comment=Rasmin disabled=no dst-port=1045 \

    protocol=tcp

add action=drop chain=virus comment="sbin initd" disabled=no dst-port=1049 \

    protocol=tcp

add action=drop chain=virus comment=MiniCommand disabled=no dst-port=1050 \

    protocol=tcp

add action=drop chain=virus comment="The Thief & AckCmd" disabled=no \

    dst-port=1053-1054 protocol=tcp

add action=drop chain=virus comment=WinHole disabled=no dst-port=1080-1083 \

    protocol=tcp

add action=drop chain=virus comment=Xtreme disabled=no dst-port=1090 \

    protocol=tcp

add action=drop chain=virus comment="Remote Administration Tool RAT, Blood Fes\

    t Evolution, Remote Administration Tool RAT" disabled=no dst-port=\

    1095-1099 protocol=tcp

add action=drop chain=virus comment=Orion disabled=no dst-port=1150-1151 \

    protocol=tcp

add action=drop chain=virus comment=\

    "Psyber Stream Server PSS, Streaming Audio Server, Voice" disabled=no \

    dst-port=1170 protocol=tcp

add action=drop chain=virus comment=NoBackO disabled=no dst-port=1200-1201 \

    protocol=udp

add action=drop chain=virus comment="SoftWAR & Infector" disabled=no \

    dst-port=1207-1208 protocol=tcp

add action=drop chain=virus comment=Kaos disabled=no dst-port=1212 protocol=\

    tcp

add action=drop chain=virus comment="SubSeven Java client, Ultors Trojan" \

    disabled=no dst-port=1234 protocol=tcp

add action=drop chain=virus comment=\

    "BackDoor-G, SubSeven, SubSeven Apocalypse, Tiles" disabled=no dst-port=\

    1243 protocol=tcp

add action=drop chain=virus comment="VooDoo Doll" disabled=no dst-port=1245 \

    protocol=tcp

add action=drop chain=virus comment="Scarab & Project nEXT" disabled=no \

    dst-port=1255-1256 protocol=tcp

add action=drop chain=virus comment=Matrix disabled=no dst-port=1269 \

    protocol=tcp

add action=drop chain=virus comment="The Matrix" disabled=no dst-port=1272 \

    protocol=tcp

add action=drop chain=virus comment=NETrojan disabled=no dst-port=1313 \

    protocol=tcp

add action=drop chain=virus comment="Millenium Worm" disabled=no dst-port=\

    1338 protocol=tcp

add action=drop chain=virus comment="Bo dll" disabled=no dst-port=1349 \

    protocol=tcp

add action=drop chain=virus comment="GoFriller, Backdoor G-1" disabled=no \

    dst-port=1394 protocol=tcp

add action=drop chain=virus comment="Remote Storm" disabled=no dst-port=1441 \

    protocol=tcp

add action=drop chain=virus comment=FTP99CMP disabled=no dst-port=1492 \

    protocol=tcp

add action=drop chain=virus comment=Trinoo disabled=no dst-port=1524 \

    protocol=tcp

add action=drop chain=virus comment="Remote Hack" disabled=no dst-port=1568 \

    protocol=tcp

add action=drop chain=virus comment="Direct Connection, Shivka-Burka" \

    disabled=no dst-port=1600 protocol=tcp

add action=drop chain=virus comment=Exploiter disabled=no dst-port=1703 \

    protocol=tcp

add action=drop chain=virus comment=Scarab disabled=no dst-port=1777 \

    protocol=tcp

add action=drop chain=virus comment=SpySender disabled=no dst-port=1807 \

    protocol=tcp

add action=drop chain=virus comment="Fake FTP & WM FTP Server" disabled=no \

    dst-port=1966-1967 protocol=tcp

add action=drop chain=virus comment="OpC BO" disabled=no dst-port=1969 \

    protocol=tcp

add action=drop chain=virus comment="Bowl, Shockrave" disabled=no dst-port=\

    1981 protocol=tcp

add action=drop chain=virus comment="Back Door, SubSeven, TransScout, Der Spae\

    her, Insane Network, Last 2000, Remote Explorer 2000, Senna Spy Trojan Gen\

    erator, Der Spaeher, Trojan Cow" disabled=no dst-port=1999-2001 protocol=\

    tcp

add action=drop chain=virus comment="Ripper Pro" disabled=no dst-port=2023 \

    protocol=tcp

add action=drop chain=virus comment=WinHole disabled=no dst-port=2080 \

    protocol=tcp

add action=drop chain=virus comment=Bugs disabled=no dst-port=2115 protocol=\

    tcp

add action=drop chain=virus comment="Mini Backlash" disabled=no dst-port=2130 \

    protocol=udp

add action=drop chain=virus comment="The Invasor" disabled=no dst-port=2140 \

    protocol=tcp

add action=drop chain=virus comment="Deep Throat, Foreplay" disabled=no \

    dst-port=2140 protocol=udp

add action=drop chain=virus comment="Illusion Mailer" disabled=no dst-port=\

    2155 protocol=tcp

add action=drop chain=virus comment=Nirvana disabled=no dst-port=2255 \

    protocol=tcp

add action=drop chain=virus comment="Hvl RAT" disabled=no dst-port=2283 \

    protocol=tcp

add action=drop chain=virus comment=Xplorer disabled=no dst-port=2300 \

    protocol=tcp

add action=drop chain=virus comment="Studio 54" disabled=no dst-port=2311 \

    protocol=tcp

add action=drop chain=virus comment=Contact disabled=no dst-port=2330-2339 \

    protocol=tcp

add action=drop chain=virus comment="Voice Spy" disabled=no dst-port=2339 \

    protocol=udp

add action=drop chain=virus comment="Doly Trojan" disabled=no dst-port=2345 \

    protocol=tcp

add action=drop chain=virus comment="Striker trojan" disabled=no dst-port=\

    2565 protocol=tcp

add action=drop chain=virus comment=WinCrash disabled=no dst-port=2583 \

    protocol=tcp

add action=drop chain=virus comment="Digital RootBeer" disabled=no dst-port=\

    2600 protocol=tcp

add action=drop chain=virus comment="The Prayer" disabled=no dst-port=2716 \

    protocol=tcp

add action=drop chain=virus comment="SubSeven, SubSeven 2.1 Gold" disabled=no \

    dst-port=2773-2774 protocol=tcp

add action=drop chain=virus comment="Phineas Phucker" disabled=no dst-port=\

    2801 protocol=tcp

add action=drop chain=virus comment="Remote Administration Tool RAT" \

    disabled=no dst-port=2989 protocol=udp

add action=drop chain=virus comment="Remote Shut" disabled=no dst-port=3000 \

    protocol=tcp

add action=drop chain=virus comment=WinCrash disabled=no dst-port=3024 \

    protocol=tcp

add action=drop chain=virus comment=Microspy disabled=no dst-port=3031 \

    protocol=tcp

add action=drop chain=virus comment="The Invasor" disabled=no dst-port=3150 \

    protocol=tcp

add action=drop chain=virus comment="Deep Throat, Foreplay, Mini Backlash" \

    disabled=no dst-port=3150 protocol=udp

add action=drop chain=virus comment="Terror trojan" disabled=no dst-port=3456 \

    protocol=tcp

add action=drop chain=virus comment="Eclipse 2000, Sanctuary" disabled=no \

    dst-port=3459 protocol=tcp

add action=drop chain=virus comment="Portal of Doom" disabled=no dst-port=\

    3700 protocol=tcp

add action=drop chain=virus comment=PsychWard disabled=no dst-port=3777 \

    protocol=tcp

add action=drop chain=virus comment="Total Solar Eclypse" disabled=no \

    dst-port=3791-3801 protocol=tcp

add action=drop chain=virus comment=SkyDance disabled=no dst-port=4000 \

    protocol=tcp

add action=drop chain=virus comment=WinCrash disabled=no dst-port=4092 \

    protocol=tcp

add action=drop chain=virus comment="Virtual Hacking Machine VHM" disabled=no \

    dst-port=4242 protocol=tcp

add action=drop chain=virus comment=BoBo disabled=no dst-port=4321 protocol=\

    tcp

add action=drop chain=virus comment="File Nail" disabled=no dst-port=4567 \

    protocol=tcp

add action=drop chain=virus comment="ICQ Trojan" disabled=no dst-port=4590 \

    protocol=tcp

add action=drop chain=virus comment="ICQ Trogen Lm" disabled=no dst-port=4950 \

    protocol=tcp

add action=drop chain=virus comment="Back Door Setup, Blazer5, Bubbel, ICKille\

    r, Ra1d, Sockets des Troie, Back Door Setup, Sockets des Troie, cd00r, Sha\

    ft" disabled=no dst-port=5000-5002 protocol=tcp

add action=drop chain=virus comment="Solo & One of the Last Trojans OOTLT, One\

    \_of the Last Trojans OOTLT, modified" disabled=no dst-port=5010-5011 \

    protocol=tcp

add action=drop chain=virus comment="WM Remote KeyLogger" disabled=no \

    dst-port=5025 protocol=tcp

add action=drop chain=virus comment="Net Metropolitan" disabled=no dst-port=\

    5031-5032 protocol=tcp

add action=drop chain=virus comment=Firehotcker disabled=no dst-port=5321 \

    protocol=tcp

add action=drop chain=virus comment="Backage, NetDemon" disabled=no dst-port=\

    5333 protocol=tcp

add action=drop chain=virus comment="wCrat WC Remote Administration Tool" \

    disabled=no dst-port=5343 protocol=tcp

add action=drop chain=virus comment="Back Construction, Blade Runner" \

    disabled=no dst-port=5400-5402 protocol=tcp

add action=drop chain=virus comment="Illusion Mailer" disabled=no dst-port=\

    5512 protocol=tcp

add action=drop chain=virus comment="The Flu" disabled=no dst-port=5534 \

    protocol=tcp

add action=drop chain=virus comment=Xtcp disabled=no dst-port=5550 protocol=\

    tcp

add action=drop chain=virus comment=ServeMe disabled=no dst-port=5555-5557 \

    protocol=tcp

add action=drop chain=virus comment=Robo-Hack disabled=no dst-port=5569 \

    protocol=tcp

add action=drop chain=virus comment="PC Crasher" disabled=no dst-port=\

    5637-5638 protocol=tcp

add action=drop chain=virus comment=WinCrash disabled=no dst-port=5742 \

    protocol=tcp

add action=drop chain=virus comment="Portmap Remote Root Linux Exploit" \

    disabled=no dst-port=5760 protocol=tcp

add action=drop chain=virus comment="Y3K RAT" disabled=no dst-port=5880-5889 \

    protocol=tcp

add action=drop chain=virus comment="The Thing" disabled=no dst-port=6000 \

    protocol=tcp

add action=drop chain=virus comment="Bad Blood" disabled=no dst-port=6006 \

    protocol=tcp

add action=drop chain=virus comment="Secret Service" disabled=no dst-port=\

    6272 protocol=tcp

Block Torrents

add action=drop chain=forward disabled=no p2p=all-p2p

add action=drop chain=forward comment="torrent-DHT-Out-Magnet d1:ad2:id20:" \

    content=d1:ad2:id20: disabled=no dst-port=1025-65535 packet-size=95-190 \

    protocol=udp

add action=drop chain=forward comment="torrent-DHT-Out-Magnet d1:ad2:id20:" \

    disabled=no dst-port=30000-65535 protocol=udp

add action=drop chain=forward comment="torrent /announce..." content=\

    "info_hash=" disabled=no dst-port=2710,80 protocol=tcp

Disable unnecessary services in Mikrotik or port services that you have never use.

/ip firewall service-port

set ftp disabled=yes ports=21

set tftp disabled=yes ports=69

set irc disabled=yes ports=6667

set h323 disabled=no

set sip disabled=yes ports=5060,5061 sip-direct-media=yes

set pptp disabled=yes

/ip service

set telnet address="" disabled=no port=23

set ftp address="" disabled=yes port=21

set www address="" disabled=no port=80

set ssh address="" disabled=no port=22

set www-ssl address="" certificate=none disabled=yes port=443

set api address="" disabled=yes port=8728

set winbox address="" disabled=no port=8291

Disable unneccessary tools or that you have never use.

/tool bandwidth-server

set authenticate=no enabled=no

/tool mac-server

set [ find default=yes ] disabled=yes

/tool mac-server mac-winbox

set [ find default=yes ] disabled=yes

/tool mac-server ping

set enabled=no

/routing bgp instance

set default as=65530 disabled=yes

/routing ospf instance

set [ find default=yes ] disabled=yes

/routing ospf area

set [ find default=yes ] area-id=0.0.0.0 disabled=yes

Next... My Mikrotik Configuration (part 3)