16 lines
793 B
Text
16 lines
793 B
Text
# Block incoming winbox from non-trusted IPs
|
|
# Run: ./mikrotik-tool script edge edge-block-winbox.rsc
|
|
|
|
# Add missing RFC 1918 private ranges to trusted list
|
|
/ip firewall address-list
|
|
add address=172.16.0.0/12 list=trusted comment="RFC 1918 private"
|
|
add address=192.168.0.0/16 list=trusted comment="RFC 1918 private"
|
|
|
|
# Restrict winbox service to trusted networks only
|
|
/ip service
|
|
set winbox address=204.110.188.0/22,10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16
|
|
|
|
# Firewall drop for winbox from non-trusted sources (belt and suspenders)
|
|
# Place before "Established Input" to catch new connection attempts early
|
|
/ip firewall filter
|
|
add chain=input action=drop dst-port=8291 protocol=tcp src-address-list=!trusted comment="block winbox from non-trusted" place-before="Established Input"
|