# Script Keamanan Jaringan & Firewall Filter MikroTik
# Oleh: Rusmawan Abdullah Sani (infokoding.com)
# =======================================================
# PERHATIAN: Skrip ini akan mengunci akses router Anda. 
# Pastikan Anda telah melakukan backup dan mengevaluasi port yang dibuka.

/ip service
disable telnet,ftp,api,ssh
set winbox port=18291

/ip firewall filter
add chain=input connection-state=invalid action=drop comment="Drop Invalid Input"

# Skenario Pencegahan Brute Force (SSH/Winbox)
add chain=input protocol=tcp dst-port=22,18291 src-address-list=IP_BLACKLIST action=drop comment="Drop Blacklisted IP"
add chain=input protocol=tcp dst-port=22,18291 connection-state=new src-address-list=SSH_STAGE_3 action=add-src-to-address-list address-list=IP_BLACKLIST address-list-timeout=10d comment="Stage 3 to Blacklist"
add chain=input protocol=tcp dst-port=22,18291 connection-state=new src-address-list=SSH_STAGE_2 action=add-src-to-address-list address-list=SSH_STAGE_3 address-list-timeout=1m comment="Stage 2 to Stage 3"
add chain=input protocol=tcp dst-port=22,18291 connection-state=new src-address-list=SSH_STAGE_1 action=add-src-to-address-list address-list=SSH_STAGE_2 address-list-timeout=1m comment="Stage 1 to Stage 2"
add chain=input protocol=tcp dst-port=22,18291 connection-state=new action=add-src-to-address-list address-list=SSH_STAGE_1 address-list-timeout=1m comment="New Conn to Stage 1"

# Catatan: Letakkan semua rule di atas rule Fasttrack Connection di WinBox!