Lab 2: Login Brute-Force Defense (Auto-Blacklist)

🎯 Sasaran Praktikum

Mendeteksi percobaan login berulang dan memblokir IP penyerang secara otomatis selama 24 jam.

• Tingkat Kesulitan: ADVANCED
• Estimasi Waktu: 30 Menit
• Target RouterOS: RouterOS v7 (v7.12+ recommended)

🗺️ Topologi Jaringan

[Attacker] ---> (Brute Force SSH) ---> [R1-Hardened]

Daftar Perangkat dalam Topologi:

• Brute-Force-Attacker (internet) - Interfaces: wan1, wan2, wan3, wan4
• Legitimate-Admin (pc) - Interfaces: eth1
• R1-Protected-Gateway (mikrotik) - Interfaces: ether1 (mgmt), ether2, ether3, ether4

🛠️ Langkah Konfigurasi Lengkap (RouterOS v7)

Langkah 1: R1-Hardened - Buat 3 tahapan deteksi brute-force SSH

# Node: R1-Hardened
/ip firewall filter add chain=input protocol=tcp dst-port=2222 connection-state=new src-address-list=ssh_stg2 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1d comment="Blacklist 24h"
/ip firewall filter add chain=input protocol=tcp dst-port=2222 connection-state=new src-address-list=ssh_stg1 action=add-src-to-address-list address-list=ssh_stg2 address-list-timeout=1m
/ip firewall filter add chain=input protocol=tcp dst-port=2222 connection-state=new action=add-src-to-address-list address-list=ssh_stg1 address-list-timeout=1m
/ip firewall filter add chain=input src-address-list=ssh_blacklist action=drop comment="Drop SSH Attacker"

📥 Panduan Lengkap & Resource

Gunakan panduan lengkap seluruh lab MikroTik certification di Panduan Lengkap Skenario Lab MikroTik atau ikuti kelas resmi tatap muka kami di Daftar Pelatihan MikroTik.