Attempting Login By A unauthorized ip

[muhammad]

Hey
Team Zima I am Having A issue My Mikrotik Router Is getting Unauthorized Access By a Unknown ip address Can you help me About this issue i am also attached the picture

[support.zima]

hello @muhammad
thanks for attaching a screenshot! Hope everyone does that, always attach screenshots because they help a lot.

Concerning the unauthorized attempts, they look automated since the interval between each attempt is small.
Here is how you protect your mikrotik:

FAQ: How to protect my router from API attacks?

As a general rule, to protect your router from attacks, you simply need to block all the services that you are are not currently using. Here are the steps: 1. Go to IP > Services: [image] 2. Disable any services that you are not using: [image] 3. API service config For the API section, you can block all access except for the local Zima VPN range so that Zima can still access the API safely. Here’s how: Edit API service field Available From: 10.214.0.0/16 as shown in the screenshot below: […

simple steps, mainly disabling the unneeded services ports, and restricting access to specific ip local ranges.

Those should be enough, let us know how it goes.

[saint_patrick]

Good morning.

I had the same issue with this. First i just setup a firewall to block an entire IP rage. BV 141.98.7.0/24

So that helped for some time. But i was advised to do a drop connection firewall. Will supply my script if it is needed. Only alow connections you are aware of.

[saint_patrick]

here is my script i am using

Drop any additional incoming traffic add this to your terminal of the mikrotik.

add action=drop chain=input connection-state=new in-interface=[/interface pppoe-client find] comment=“DROPALL”;