Mikrotik SYN flood 공격 방어 설정

Mikrotik Router SYN flood Protection

New Terminal

[Mikrotik]# 아래 내용 적용.

ip firewall filter add chain=input protocol=tcp connection-limit=0,32  action=add-src-to-address-list  address-list=blocked-addr address-list-timeout=1d

      

ip firewall filter add chain=input protocol=tcp src-address-list=blocked-addr connection-limit=3,32 action=tarpit  

ip firewall filter add chain=forward protocol=tcp tcp-flags=syn connection-state=new action=jump jump-target=SYN-Protect comment="SYN Flood protect" disabled=yes  

ip firewall filter add chain=SYN-Protect protocol=tcp tcp-flags=syn limit=400,5 connection-state=new action=accept comment="" disabled=no 

ip firewall filter add chain=SYN-Protect protocol=tcp tcp-flags=syn connection-state=new  action=drop comment="" disabled=no 

For v6.x (version 6.X 이상에 적용)

ip settings set tcp-syncookies=yes

For older version. (6.X 이하에 적용)

ip firewall connection tracking set tcp-syncookie=yes

참고url : https://wiki.mikrotik.com/wiki/DoS_attack_protection