Mikrotik limit Socks server access from LAN

mikrotiksocks

I have a Mikrotik RB750 router that Socks server is configured on it. It has a interface in my LAN and another one in WAN with public IP address. I want to limit access to it from LAN. It seems that some people has found it and using it form WAN!!!

Best Answer

Open WinBox . Go to IP > Socks > Access . The Socks Access window is similar to filter rule window. Default action in Socks Access is accept. This means that if no rule get matched, socks server accept that connection.

Now add a rule with accept action your LAN IP addresses range as its Src Address. Then add a rule with deny action. Left other field unchanged. This rule guaranty denying of any socks request other than your LAN IP addresses.

Related Solutions

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

Have you tried clearing the ARP cache from all devices? If multiple devices shared the same IP address, that is recorded in the ARP cache of neighboring network devices. Til that is cleared, the devices will keep thinking there are duplicate addresses on the network

Firewall – MikroTik – can’t access webfig from external / can’t SSH into router from external ip

Disable rule #2 + #3 and test again. Or you can make an exception for your ssh+www ports

You are dropping all in traffic from ether1-gateway.

Rules #2 + #3 are practically the same. I recommend you to remove #2

UPDATED REPLY

For making a secure Router isn't a best practice to change ports, creating a false sense of security. However is an easy implemantation.

How to secure open/redirect ports

/ip firewall filter add chain=input dst-port=22,80,443 in-interface=ether1-gateway protocol=tcp
/ip firewall filter add action=drop chain=input in-interface=ether1-gateway

PD: ether1-gateway is WAN port, dst-port are the ports that you would like leave opened. Move these filters relpacing number #2 ad #3 of your Mikrotik, and preserve this order!

And then , securize your passwords + connections and make a active analisy-control of you fail/bruteforce attemt connections:

Using fail-to-ban in linux systems, or anti-bruteforce attack scripts -> Bruteforce login prevention
Use long passwords, upper+lowercases mixed with numbers
Use secure connections like https ssh nor telnet or http

Best Answer

Related Solutions

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

Firewall – MikroTik – can’t access webfig from external / can’t SSH into router from external ip

Related Topic