Mikrotik – Port Knocking

Knocking Client

Powershell

(Test-NetConnection -ComputerName pabx.totalsolutionsit.com -Port 59283) -and (Test-NetConnection -ComputerName pabx.totalsolutionsit.com -Port 59234)

Windows GUI Client

Download Windows Client

Install KnockD Client

sudo apt-get install knockd

Open Services

sudo knock phone. 1029 3847

Open Winbox

sudo knock phone. 59283 59234

Winbox Port Knock

Mikrotik Port Knocking

Complete Script

/ip firewall address-list

add address=dude.tsit.com.au list=Dude

/ip firewall filter

add action=accept chain=input comment=\

    "Winbox - Rule 1 of 7 - Port Knocking - Allow if on the Address List" \

    dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\

    knock-step2-winbox

add action=accept chain=input comment=\

    "Winbox - Rule 2 of 7 - Access from Dude Address List" dst-port=8291 \

    in-interface-list=WAN protocol=tcp src-address-list=Dude

add action=add-src-to-address-list address-list=knock-step1-winbox \

    address-list-timeout=1m chain=input comment=\

    "Winbox - Rule 3 of 7 - Port Knocking - Step 1" dst-port=59283 \

    in-interface-list=WAN protocol=tcp

add action=add-src-to-address-list address-list=knock-step2-winbox \

    address-list-timeout=30m chain=input comment=\

    "Winbox - Rule 4 of 7 - Port Knocking - Step 2" dst-port=59234 \

    in-interface-list=WAN protocol=tcp src-address-list=knock-step1-winbox

add action=drop chain=input comment=\

    "Winbox - Rule 5 of 7 - Port Knocking - Block if not on the address list" \

    dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\

    !knock-step2-winbox

add action=accept chain=input comment=\

    "Winbox - Rule 6 of 7 - Internal Access" dst-port=8291 in-interface-list=\

    LAN protocol=tcp

add action=drop chain=input comment="Winbox - Rule 7 of 7 - Drop All" \

    dst-port=8291 protocol=tcp

Step 1 - Add Address List

/ip firewall address-list
add address=dude.tsit.com.au list=Dude

Step 2 - Rule 1 - Allow remote access from Address list knock-step2-winbox

Allow remote access from Address list knock-step2-winbox

/ip firewall filter
add action=accept chain=input comment=\
    "Winbox - Rule 1 of 7 - Port Knocking - Allow if on the Address List" \
    dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\
    knock-step2-winbox

Step 3 - Rule 2 - Allow winbox access from dude.tsit.com.au address list

 /ip firewall filter
/ip firewall filter add action=accept chain=input comment=\
"Winbox - Rule 2 of 7 - Access from Dude Address List" dst-port=8291 \
in-interface-list=WAN protocol=tcp src-address-list=Dude

Step 4 - Rule 3 - Add source address to Address list "Winbox - Rule 3 - Port Knocking - Step 1"

/ip firewall filter 
add action=add-src-to-address-list address-list=knock-step1-winbox \
    address-list-timeout=1m chain=input comment=\
    "Winbox - Rule 3 of 7 - Port Knocking - Step 1" dst-port=59283 \
    in-interface-list=WAN protocol=tcp

Step 5 - Rule 4 - If TCP connection is received on port 59234, the source access will be added to Address List "knock-step1-winbox"

/ip firewall filter
add action=add-src-to-address-list address-list=knock-step2-winbox \
    address-list-timeout=30m chain=input comment=\
    "Winbox - Rule 4 of 7 - Port Knocking - Step 2" dst-port=59234 in-interface-list=\
    WAN protocol=tcp src-address-list=knock-step1-winbox

Step 6 - Rule 5 - Block winbox access to IP Address’s not on the Address List

/ip firewall filter
add action=drop chain=input comment=\
    "Winbox - Rule 5 of 7 - Port Knocking - Block if not on the address list" \
    dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\
    !knock-step2-winbox

Step 7 - Rule 6 - Allow for internal winbox access

/ip firewall filter
add action=accept chain=input comment="Winbox - Rule 6 of 7 - Internal Access" \
    dst-port=8291 in-interface-list=LAN protocol=tcp

Step 8 - Rule 7 - Block all other winbox access

/ip firewall filter
add action=drop chain=input comment="Winbox - Rule 7 of 7 - Drop All" dst-port=\
    8291 protocol=tcp

Services Port Knock

Mikrotik Port Knocking

Complete Script

/ip firewall filter

add action=add-src-to-address-list address-list=knock-step1-services address-list-timeout=1m chain=input comment="Port Knocking - Rule 1 of 2 - Services" dst-port=1029 in-interface-list=WAN protocol=tcp

add action=add-src-to-address-list address-list=knock-step2-services address-list-timeout=30m chain=input comment="Port Knocking - Rule 2 of 2 - Services" dst-port=3847 in-interface-list=WAN protocol=tcp src-address-list=knock-step1-services

Step 1 - Add address of inbound TCP port 1024 to Address-List

/ip firewall filter
add action=add-src-to-address-list address-list=knock-step1-services address-list-timeout=1m chain=input comment="Port Knocking - Rule 1 of 2 - Services" dst-port=1029 in-interface-list=WAN protocol=tcp

Step 2 - Add address of inbound TCP port 3847 to Address-List

/ip filewall filter
add action=add-src-to-address-list address-list=knock-step2-services address-list-timeout=30m chain=input comment="Port Knocking - Rule 2 of 2 - Services" dst-port=3847 in-interface-list=WAN protocol=tcp src-address-list=knock-step1-services

SSH Access

Complete Script

/ip firewall filter

add action=accept chain=input comment="Port Knocking - Rule 1 of 4 - SSH" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=knock-step2-services

/ip firewall filter

add action=drop chain=input comment="Port Knocking - Rule 2 of 4 - SSH" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=!knock-step2-services

/ip firewall filter

add action=accept chain=input comment="Port Knocking - Rule 3 of 4 - SSH" dst-port=22 in-interface=bridge protocol=tcp

/ip firewall filter

add action=drop chain=input comment="Port Knocking - Rule 4 of 4 - SSH" dst-port=22 protocol=tcp

Step 1 - Once both Address lists have the source address list added, the user will be able to connect the router via SSH over TCP port 22.

/ip firewall filter
add action=accept chain=input comment="Port Knocking - Rule 1 of 4 - SSH" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=knock-step2-services

Step 2 - Drop all inbound tcp 22 connections if they are not on the address list

/ip firewall filter
add action=drop chain=input comment="Port Knocking - Rule 2 of 4 - SSH" dst-port=22 in-interface-list=WAN protocol=tcp src-address-list=!knock-step2-services

Step 3 - Allow LAN Access to Router via SSH

/ip firewall filter

add action=accept chain=input comment="Port Knocking - Rule 3 of 4 - SSH" dst-port=22 in-interface=bridge protocol=tcp

Step 4 - Drop All other inbound SSH connections

/ip firewall filter

add action=drop chain=input comment="Port Knocking - Rule 4 of 4 - SSH" dst-port=22 protocol=tcp

Services Port Knock

Enable Port 8089

Complete Script

/ip firewall filter

add action=accept chain=forward comment="Port 8089 - Rule 1 of 2" dst-port=8089 in-interface-list=WAN protocol=tcp src-address-list=knock-step2-services

/ip firewall filter

add action=drop chain=forward comment="Port 8089 - Rule 2 of 2" dst-port=8089 in-interface-list=WAN protocol=tcp src-address-list=!knock-step2-services

Step 1 - Allow Port TCP 8089 via WAN

/ip firewall filter
add action=accept chain=forward comment="Port 8089 - Rule 1 of 2" dst-port=8089 in-interface-list=WAN protocol=tcp src-address-list=knock-step2-services

Step 2 - Drop All other Port 8089 connections

/ip firewall filter
add action=drop chain=forward comment="Port 8089 - Rule 2 of 2" dst-port=8089 in-interface-list=WAN protocol=tcp src-address-list=!knock-step2-services

Services Port Knock

Enable Port 443

Step 1 - Allow Port TCP 443 via WAN

/ip firewall filter
add action=accept chain=forward comment="Port 443 - Rule 1 of 2" dst-port=443 in-interface-list=WAN protocol=tcp src-address-list=knock-step2-services

Step 2 - Drop All other Port 443 connections

/ip firewall filter
add action=drop chain=forward comment="Port 443 - Rule 2 of 2" dst-port=443 in-interface-list=WAN protocol=tcp src-address-list=!knock-step2-services