CloudLabBox
Try the free demo

MikroTik MTCSE lab 4 of 10

Brute force, port scans and port knocking with address lists

Fernvale's on-call engineer needs SSH to the Harbourside router from anywhere, and the Internet has noticed. Use dynamic address lists to blacklist sources that open connection after connection to SSH, catch port scanners with PSD and a Telnet honeypot and drop them in RAW, then hide SSH completely behind a port-knocking sequence that only the engineer knows.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 1,536 MB in total. That fits the free demo too.

In your workspace: Shared, then MikroTik MTCSE RouterOS v7 guided labs, then 04 - Brute force port scans and port knocking with address lists

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
4 vCPU, 1,536 MB
Smallest plan
Lite

The scenario

Harbourside's router GW lets SSH in from anywhere, because the on-call engineer may need it at 3 a.m. from a hotel. Every scanner on the Internet has found it too. You'll fight back in three layers: blacklist sources that keep opening SSH connections, catch port scanners and drop them before they cost anything, and finally hide SSH behind a port-knocking sequence so that, to everyone except the engineer, port 22 is simply closed.

DeviceAddressRole
GW203.0.113.2/29 (WAN), 192.168.40.1/24 (LAN)Fernvale's router
WESTLINK203.0.113.1/29the ISP
ONCALL (Linux)203.0.113.5/29the on-call engineer's laptop
ATT (Linux)203.0.113.6/29a scanner and password guesser

What you’ll practise

  • Build staged address-list rules that blacklist SSH brute-force sources
  • Detect port scans with psd and a honeypot port, and drop scanners before connection tracking
  • Hide a service behind a port-knocking sequence with timed address lists
  • Read address lists, their timeouts and the counters that filled them

The tasks

  1. Address the Linux hosts
  2. Blacklist SSH brute force
  3. Catch port scanners
  4. Hide SSH behind port knocking
  5. Watch the scanner give up

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Brute force port scans and port knocking with address lists4 nodes and 1 network, 4 links. Every link is listed as text below the diagram.GWWESTLINKONCALLATTInternetether1ether1eth0eth0
4 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • GW ether1 to Internet (network)
  • WESTLINK ether1 to Internet (network)
  • ONCALL eth0 to Internet (network)
  • ATT eth0 to Internet (network)
Nodes in Brute force, port scans and port knocking with address lists, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
GWMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
WESTLINKMikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB
ONCALLAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
ATTAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MikroTik MTCSE RouterOS v7 guided labs.

  3. Open 04 - Brute force port scans and port knocking with address lists and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MikroTik MTCSE labs

All MikroTik MTCSE labs

Related labs in other courses

CloudLabBox is independent of MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.