Securing MikroTik Router Against Proxy Attacks

As more and more routers are connected to the internet, it's becoming increasingly important to secure them from unwanted access. One technique for doing this is called port knocking, and in this post, we'll explore how to use port knocking to secure your MikroTik router.

What is port knocking?

Port knocking is a security technique that involves sending a sequence of packets to a series of closed ports in a specific order. When the correct sequence is entered, the ports are opened, allowing access to a specific service or application.

The idea behind port knocking is that it allows you to keep your ports closed by default, but still grant access to authorized users when needed. In essence, it's like a secret handshake that unlocks a door.

How does port knocking work?

The basic idea behind port knocking is fairly simple. When someone wants to access a service on your network, they send a sequence of packets that match a predefined sequence. When the correct sequence is received, the router opens the desired port, allowing the user to access the service.

Here are the basic steps for setting up port knocking:

Define a sequence of closed ports that must be "knocked" in a specific order to gain access to a service.
Configure a firewall rule to drop any traffic that doesn't fit the predefined sequence of port "knocks."
Configure a script that listens for the correct sequence of port "knocks" and opens the desired port or service when the correct sequence is received.

By using port knocking, you can keep your ports closed by default, but still grant access to authorized users when needed.

How to configure port knocking on your MikroTik router

If you're using a MikroTik router, setting up port knocking is relatively straightforward. Here are the basic steps:

Step 1: Configure the firewall to drop traffic that doesn't fit the predefined sequence

The first step in configuring port knocking on your MikroTik router is to create a firewall rule that will drop any traffic that doesn't match the predefined sequence of port "knocks." Here's how to do it:

Log into your MikroTik router and open the "Firewall" tab.
Click on the "Layer7 Protocols" tab.
Click on the "Add New" button to create a new Layer7 protocol.
Give your new Layer7 protocol a name (e.g. "knock").
In the "Regexp" field, enter the pattern for your predefined sequence of port "knocks." (For example, you might use something like this: (^\x01\x02\x03\x04$))
Click on the "OK" button to save your new Layer7 protocol.
Go back to the "Firewall" tab and click on the "Filter Rules" tab.
Click on the "Add New" button to create a new filter rule.
Configure the new filter rule as follows:

Chain: input
Action: drop
Protocol: TCP
Layer7 Protocol: knock (the name you gave to your Layer7 protocol in step 4)

Click on the "OK" button to save your new filter rule.

That's it! Your MikroTik router is now configured to drop any traffic that doesn't match your predefined sequence of port "knocks."

Step 2: Create a script that listens for the correct sequence of port "knocks"

The next step in configuring port knocking on your MikroTik router is to create a script that will listen for the correct sequence of port "knocks" and open the desired port or service when the correct sequence is received. Here's how to do it:

Log into your MikroTik router and open the "Terminal" tab.
Type the following command to create a new script:

/system script add name=knock_on policy=\"ftp,reboot,read,write,policy,test,winbox,password,sniff" source=\":local knock_seq \\\n    :global ports \\\n    /tool fetch url='http://yourserver.com/knock.knock' mode=http out=knock.txt\\n    :if ([/file get knock.txt contents]\\n        ~ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\']) do=\\n   :log info \"Incorrect knock sequence!\"; \\n   :delay 5s;\\n    else=\\n    # knock sequence is correct, so execute command to open desired port/service\\n   \\n    /file remove [find name=knock.txt];

In the above command, replace "http://yourserver.com/knock.knock" with the URL of your predefined sequence of port "knocks."
Next, replace "[global ports]" with the appropriate command(s) to open the desired port or service when the correct sequence is received.
Click on the "OK" button to save your new script.

Your MikroTik router is now configured to listen for the correct sequence of port "knocks" and open the desired port or service when the correct sequence is received.

Conclusion

Port knocking is a simple but effective technique for securing your MikroTik router from unwanted access. By using port knocking, you can keep your ports closed by default, but still grant access to authorized users when needed. With the steps outlined in this post, you should be able to configure port knocking on your MikroTik router quickly and easily.

As always, it's important to keep your MikroTik router up-to-date with the latest security patches and to follow best practices for network security. By doing so, you can help ensure that your network is always protected from unauthorized access.