middelink/mikrotik-fwban: Use your Mikrotik firewall to do fail2ban like blocking of unwanted IPs. Written in Go
Posted by jpluimers on 2017/06/26
Edit 20260501: be careful, as this damaged the NAND memory of my router because of too many write cycles. Root cause: too high update frequency.
Interesting: middelink/mikrotik-fwban: Use your Mikrotik firewall to do fail2ban like blocking of unwanted IPs. Written in Go.
It might beat these (that just count SSH connections, not failed connection attempts)
- Prevent RDP logon brute force in mikrotik router via winbox – Server Fault
- Bruteforce login prevention – MikroTik Wiki (though FTP check does ban on failed login, but SSH doesn’t)
- Matthew Siemens: Blocking SSH Brute Force Attacks in MikroTik RouterOS
- The Mikrotik RouterOS config, tips and tricks thread – boards.ie
Another alternative is to parse one of the logs:
Of course you should have this installed by default as part of your hardening process:
--jeroen
The Wiert Corner - irregular stream of stuff 
Leave a comment