MikroTik Anti-DDoS & Advanced Firewall Studio

# ==================================================================
# ISP SECTOR - MikroTik RouterOS v7 Anti-DDoS & Security Firewall
# WAN: ether1-WAN | LAN: ether2-LAN
# Generated at: 2026-09-12 03:33:13
# ==================================================================

# 1. Address List Definitions
/ip firewall address-list
add list=SAFE_MANAGEMENT address=192.168.0.0/16 comment="Allowed Admin Subnet"
add list=SAFE_MANAGEMENT address=10.0.0.0/8 comment="Allowed Admin Subnet"
add list=BOGONS address=0.0.0.0/8 comment="Bogon Network"
add list=BOGONS address=127.0.0.0/8 comment="Bogon Loopback"
add list=BOGONS address=224.0.0.0/4 comment="Bogon Multicast"
add list=BOGONS address=240.0.0.0/4 comment="Bogon Reserved"

# 2. Core Filter Protection Rules
/ip firewall filter

# --- A. FastTrack Hardware Acceleration for Established Connections ---
add chain=forward action=fasttrack-connection connection-state=established,related hw-offload=yes comment="FastTrack Established Traffic"
add chain=forward action=accept connection-state=established,related comment="Accept Established / Related"
add chain=input action=accept connection-state=established,related comment="Accept Established / Related Input"

# --- B. Drop Invalid Connections ---
add chain=input action=drop connection-state=invalid comment="Drop Invalid Input"
add chain=forward action=drop connection-state=invalid comment="Drop Invalid Forward"

# --- C. Drop Bogon / Martian IPs from WAN ---
add chain=input action=drop in-interface=ether1-WAN src-address-list=BOGONS comment="Drop Bogons on WAN"
add chain=forward action=drop in-interface=ether1-WAN src-address-list=BOGONS comment="Drop Bogons on Forward"

# --- D. Port Scanner Detection & 24hr Auto-Drop ---
add chain=input action=add-src-to-address-list address-list=PORT_SCANNERS address-list-timeout=1d protocol=tcp psd=21,3s,3,1 in-interface=ether1-WAN comment="Detect TCP Port Scan"
add chain=input action=drop src-address-list=PORT_SCANNERS in-interface=ether1-WAN comment="Drop Port Scanners"

# --- E. ICMP / Ping Flood Rate Limiter ---
add chain=input action=accept protocol=icmp limit=50/5s,5:packet in-interface=ether1-WAN comment="Accept Safe Ping (Limit 50/5s)"
add chain=input action=drop protocol=icmp in-interface=ether1-WAN comment="Drop ICMP Floods"

# --- F. Block External DNS Amplification & Open Resolver Exploits ---
add chain=input action=drop protocol=udp dst-port=53 in-interface=ether1-WAN comment="Drop External WAN DNS Queries"
add chain=input action=drop protocol=tcp dst-port=53 in-interface=ether1-WAN comment="Drop External WAN TCP DNS Queries"

# --- G. SYN Flood Attack Blocker ---
add chain=input action=drop protocol=tcp tcp-flags=syn in-interface=ether1-WAN connection-limit=30,32 comment="Drop TCP SYN Flood (>30 conn/IP)"

# --- H. Brute-Force Login Blacklist Automation (WinBox & SSH) ---
add chain=input action=drop src-address-list=BRUTE_FORCE_BLACKLIST in-interface=ether1-WAN comment="Drop Blacklisted Attackers"
add chain=input action=add-src-to-address-list address-list=BRUTE_FORCE_BLACKLIST address-list-timeout=7d connection-state=new dst-port=8291 in-interface=ether1-WAN protocol=tcp src-address-list=WINBOX_STAGE3 comment="Winbox Ban (Stage 3)"
add chain=input action=add-src-to-address-list address-list=WINBOX_STAGE3 address-list-timeout=1m connection-state=new dst-port=8291 in-interface=ether1-WAN protocol=tcp src-address-list=WINBOX_STAGE2 comment="Winbox Ban (Stage 2)"
add chain=input action=add-src-to-address-list address-list=WINBOX_STAGE2 address-list-timeout=1m connection-state=new dst-port=8291 in-interface=ether1-WAN protocol=tcp src-address-list=WINBOX_STAGE1 comment="Winbox Ban (Stage 1)"
add chain=input action=add-src-to-address-list address-list=WINBOX_STAGE1 address-list-timeout=1m connection-state=new dst-port=8291 in-interface=ether1-WAN protocol=tcp comment="Winbox Initial Attempt"
add chain=input action=add-src-to-address-list address-list=BRUTE_FORCE_BLACKLIST address-list-timeout=7d connection-state=new dst-port=22 in-interface=ether1-WAN protocol=tcp src-address-list=SSH_STAGE3 comment="SSH Ban (Stage 3)"
add chain=input action=add-src-to-address-list address-list=SSH_STAGE3 address-list-timeout=1m connection-state=new dst-port=22 in-interface=ether1-WAN protocol=tcp src-address-list=SSH_STAGE2 comment="SSH Ban (Stage 2)"
add chain=input action=add-src-to-address-list address-list=SSH_STAGE2 address-list-timeout=1m connection-state=new dst-port=22 in-interface=ether1-WAN protocol=tcp src-address-list=SSH_STAGE1 comment="SSH Ban (Stage 1)"
add chain=input action=add-src-to-address-list address-list=SSH_STAGE1 address-list-timeout=1m connection-state=new dst-port=22 in-interface=ether1-WAN protocol=tcp comment="SSH Initial Attempt"

# --- I. Default WAN Policy: Allow Admin, Drop All Other WAN Input ---
add chain=input action=accept src-address-list=SAFE_MANAGEMENT comment="Accept Admin LAN Access"
add chain=input action=accept in-interface=ether2-LAN comment="Accept All Internal LAN Input"
add chain=input action=drop in-interface=ether1-WAN comment="Drop All Other WAN Input"

# ==================================================================
# Direct paste ready for WinBox New Terminal
# ==================================================================