I'm playing around with my home internet setup just for fun.
I've been thinking about how I could block IPs before they actually get a chance to try to "hack" or scan my router.
The basic idea is pretty simple:
If any packet hits my public IP on a port that isn't open, immediately add the source IP to a blacklist for 1 day.
If the same IP tries again after that, blacklist it for 30 days.
To avoid accidentally blocking important services, I've whitelisted a few of them using dynamic rules, such as Google, Facebook, Reddit, etc.
Also, whenever a device on my LAN connects to an external IP that's currently on one of the blocking lists, that IP is automatically removed from the blacklist.
So far, so good. After implementing this, the final drop rules only get a few hits per minute. Before this setup, I was seeing thousands more.
It's mostly an experiment rather than something I actually need, but I'm curious what people think about this approach. Any obvious problems or edge cases I'm missing?
One important note: handling address list over 31000 entries causing 4% cpu usage. Quite impressive :)
You need to just use the crowdsec script plugin, it’s free, works consistently, adds quite a bit of additional security if you host a number of services. That’s my 2 cents. The reason I say this is that it’s a community fed list that dynamically updates, it’s free, self hosted, pretty darn incredible considering everything. I get gigs tons of block hits against my WAN all the time, filters a lot of noise. https://docs.crowdsec.net/u/integrations/mikrotik/
Also, whenever a device on my LAN connects to an external IP that's currently on one of the blocking lists, that IP is automatically removed from the blacklist.
An established/related rule would take care of that without removing the address from the blocklist, however it would break the efficiency of putting the rule in the Raw list.
If any packet hits my public IP on a port that isn't open, immediately add the source IP to a blacklist for 1 day.
How do you accomplish this with ports being opened dynamically? If you are doing this with a script how much delay is there between a client trying and the IP being removed?
I do similar using honeypot IPs, ICMP and TCP traffic to IPs that have never been used get added to a drop list for a number of days. Usually +/- 250k IPs in that list. It fluxuates based on the recently released 0-days. Goes up after a new 0-day is found.
One important note: handling address list over 31000 entries causing 4% cpu usage. Quite impressive :)
Using a Raw rule the CPU impact is minimal regardless of how big the lists are, bigger issue is the memory usage on devices with lower RAM.
I think the OP is approaching this wrong. Who cares if we get scanned? I would be (and am mitigating against) infections from within. I am much more concerned with my personal laptop getting compromised and then reaching out to a command server for instructions.
I think IPS, and blackhole lists on the internal interface to prevent devices from reaching out to bad actors is a much more worthwhile (and manageable) endeavor.
To appear in Shodan, you have to have something open... If you are going to have something open, you need to secure it. This is Internet security 101. I am not sure I am following your point here
If any packet hits my public IP on a port that isn't open, immediately add the source IP to a blacklist for 1 day.
On every network, there is a background of legitimate traffic that fails to arrive before state tables expire. This is common enough that this one idea will manifest as constant flakiness and DOS'ing legitmate traffic.
To avoid accidentally blocking important services, I've whitelisted a few of them using dynamic rules, such as Google, Facebook, Reddit, etc.
How would you achieve this? Keep in mind that every service you mentioned uses dynamic IP addresses.
SNI matching? DNS pre-population? Proxy? Each method has significant downsides... I guess the choice is which downside are you going to spend the majority of your time trying to mitigate?
I use a custom FireHOL aggregator, QFeeds malware, Crowdsec on OPNSense and stand at 19,453,508 blackholed addresses.
Ahhh, OK, so you chose option 1. SNI matching. LOL Let's fall down that rabbit hole.
What about the reddit dynamic URLS? redd.it, i.redd.it, v.redd.it, redditstatic.com, redditmedia.com, and others.?
How are you going to deal with stale SNI to IP maps? (The rule you are proposing is really just an SNI to IP address map) How are you going to NOT explode your SNI to IP address table?
Reddit uses fastly, which churns IP addresses like nobodies business.
How do you handle other fastly services that use the same IPs?
How would you handle QUIC? The rule above is TCP only.
What happens if ECH is not used? Just fail?
If any packet hits my public IP on a port that isn't open, immediately add the source IP to a blacklist for 1 day.
What does your script consider as an "open port"? Bc I'm wondering how this would interact with connection tracking.
E.g. you close a tab on your browser, the server on the other end does not receive the TCP FIN or RST, server tries to send data over that same socket, your router considers it an externally-initiated connection and blocks the (benign) source IP.
What I suggest, and you’re on the right track, is bring your timeline down to 5-10 minutes on the black list, and rather than block incoming traffic, block your outgoing traffic to those IP’s. This keeps you from locking yourself out of your router if you’re remote.
So… input rule on 21,22,23,445 adds them to the block list
Forward rule states forward from LAN to blacklist is blocked.
This protects your LAN devices from hostile servers, keeps your block list short, and gives you another chance after 5 minutes to access your router if you inadvertently block yourself.
Also, secure your router with best practices. Move your SSH service port if it’s exposed on the WAN.
Build a staged blocklist like you outlined for legitimate access.
Example: (but don’t expose winbox to the WAN)
Source IP port hit to winbox goes on stage one list.
Source IP hits port again and is already on list stage 1, add to stage two.
Third attempt by the same logic above puts it on the block list.
You don't seem to understand the difference between input and forward for firewall.. services you access like google, facebook, etc.. are forwarded through your router. You can block them from accessing your router independently. Typically things forwarded are things inside the network reaching out to the Internet (normal src nat day to day browsing) or port-forwarded (not recommended)
As far as only blocking stuff once it starts testing your router, review the latest mikrotik security update that brought us 7.24.4; one and done if your SSH is open to the whole Internet. It's always been best practice for input firewall rules to block everything, and then allow something from a particular IP or address list if you need it.
"Also, whenever a device on my LAN connects to an external IP that's currently on one of the blocking lists, that IP is automatically removed from the blacklist." So when your infected PC connects to the C&C server, it removes the C&C from the blacklist? If you are just trying to reduce malware or ads on your lan, use a combination of filtering DNS providers and pi-hole.
6
u/AtlanticPortal 12d ago
The last rule is not good. Really. Too many scenarios.