Port Knocking Step by Step - Mikrotik RouterOS v6 & 7

#mikrotik #routeros7 #mikrotikSecurity
Port knocking is a mechanism to secure a network device by closing all the ports-even those you know will be used. Those ports will be opened on demand if-and only if-the connection request provides the secret knock (prearranged pattern). Port Knocking is one layer of security, it MUST NOT be our only form of defense
**************************SAMPLE CONFIG********************
*****Intended for lab purposes********************************
/ip firewall filter
add action=accept chain=input comment="Established and Related" connection-state=established,related
add action=drop chain=input comment=Invalid connection-state=invalid
add action=accept chain=input comment="Allow Winbox & SSH to Trusted IPs" dst-port=8291,22 in-interface=ether1 protocol=tcp src-address-list=trusted-ips
add action=add-src-to-address-list address-list=phase1-knocking address-list-timeout=1m chain=input comment="Phase 1 knocking" dst-port=8000 in-interface=ether1 protocol=tcp
add action=add-src-to-address-list address-list=phase2-knocking address-list-timeout=1m chain=input comment="Phase 2 Knocking" dst-port=7000 in-interface=ether1 protocol=tcp src-address-list=\
phase1-knocking
add action=add-src-to-address-list address-list=trusted-ips address-list-timeout=1d chain=input comment="Phase 3 Knocking" dst-port=7440 in-interface=ether1 protocol=tcp src-address-list=\
phase2-knocking
add action=drop chain=input comment="Drop Connections From Internet" in-interface=ether1
*********************END SAMPLE CONFIG************
Check more videos on my channel
/ @thenetworktrip
Connect with Wilmer Almazan
LinkedIN: / wilmeralmazan
Facebook: / nsswilmeralmazan
Twitter: / wilmer_almazan
Instagram: / wilmer_almazan
Personal Blog: thenetworktrip...
mikrotik
routeros 7
ospf
mtcna
mtcre
cybersecurity
routing
cloud computing
virtualization
switching
network automation

[@ZX-8Bits]

Great! Thanks for sharing. Very well explained! Cheers from Mesi's City - Rosario - Argentina!

[@TheNetworkTrip]

Glad you enjoyed it!

[@laurenttaieb65]

perfectly explained. Thanks

[@PabloMateoDrappo]

Excellent Tutorial!

[@TheNetworkTrip]

Glad you liked it!

[@ABAMSYTEL]

GREAT VIDEO!!! tks

[@OstJoker]

Thank you for the video. Unfortunately there is no option to set port knocking "action" as "run script". IMHO, it will be extremely useful in many use cases. Maybe you know some workaround how can I force mikrotik to run script after successful port knocking?

[@SiBex_ovh]

I use that PK but have additonal rule who detect any knocking into range 6000-9000 (without my 3 ports) and I block that IP at 1h. This is used when I cannot connect from trusted constance public ip. This prevent me from that knocking automatics.

[@jeytis72]

Very good. Could we have the Eve-ng project file? Thanks

[@EstebanAbisaiTrinidadGomez]

porque en la 7.15.3 no aparecen la src address list en advance

[@WilmerAlmazan]

Hola!
Fue movido al tab general