Protecting MikroTik Against Brute Force Attacks

Brute force attacks try thousands of login combinations against your management interfaces. This post shows you how to detect and block them automatically using RouterOS firewall rules.

How Brute Force Works

An attacker runs a tool like Hydra or Medusa:

BASH

hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ssh

Within minutes they can attempt tens of thousands of passwords. Without protection, RouterOS will try each one.

Step 1 — Rename or Disable the Default Admin

TEXT

/user set [find name=admin] name=netadmin

Or create a new admin and disable the default:

TEXT

/user add name=netadmin password=Str0ng!Pass group=full
/user disable admin

Step 2 — SSH Brute Force Protection with Address Lists

This technique uses address lists to temporarily ban IPs that fail SSH login too many times:

TEXT

/ip firewall filter

# Stage 1: If IP is already in the blocklist, drop immediately
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH blacklist"

# Stage 2: Third failure within 1 minute → blacklist for 10 days
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=10d comment="SSH stage3 → blacklist"

# Stage 3: Second failure → move to stage 3
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m

# Stage 4: First failure → move to stage 2
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_stage1 action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m

# Stage 5: New connection attempt → add to stage 1
add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m

Step 3 — Winbox Brute Force Protection

Apply the same logic to Winbox port 8291:

TEXT

/ip firewall filter
add chain=input protocol=tcp dst-port=8291 src-address-list=winbox_blacklist action=drop comment="Drop Winbox blacklist"
add chain=input protocol=tcp dst-port=8291 src-address-list=wb_stage3 action=add-src-to-address-list address-list=winbox_blacklist address-list-timeout=10d
add chain=input protocol=tcp dst-port=8291 src-address-list=wb_stage2 action=add-src-to-address-list address-list=wb_stage3 address-list-timeout=1m
add chain=input protocol=tcp dst-port=8291 src-address-list=wb_stage1 action=add-src-to-address-list address-list=wb_stage2 address-list-timeout=1m
add chain=input protocol=tcp dst-port=8291 connection-state=new action=add-src-to-address-list address-list=wb_stage1 address-list-timeout=1m

Step 4 — Rate Limit New Connections

An alternative (or complement) is to rate-limit new connections per source IP:

TEXT

/ip firewall filter
add chain=input protocol=tcp dst-port=22 connection-state=new action=jump jump-target=ssh-rate
/ip firewall filter
add chain=ssh-rate src-address-list=ssh-rl action=drop
add chain=ssh-rate action=add-src-to-address-list address-list=ssh-rl address-list-timeout=60s limit=3,5:packet
add chain=ssh-rate action=accept

Step 5 — Change Default Ports

Move SSH from 22 to a non-standard port:

TEXT

/ip service set ssh port=22222

This won't stop a determined attacker but eliminates most automated scanners.

Step 6 — Whitelist Your Management IP

The most effective protection: only allow your own IP to reach management services:

TEXT

/ip firewall filter
add chain=input src-address=203.0.113.10 action=accept comment="My management IP"
add chain=input protocol=tcp dst-port=22,8291,80,443 action=drop comment="Block all management from WAN"

Verify the Blacklist is Working

TEXT

/ip firewall address-list print where list=ssh_blacklist

You should see IPs accumulating if any brute force is hitting the router.

Summary Checklist

[ ] Renamed/disabled default admin
[ ] SSH brute force stages configured
[ ] Winbox brute force stages configured
[ ] Management restricted to whitelist IPs
[ ] Default service ports changed