How to set up Fail2ban on Mikrotik?

Question

System administration

I'm trying to set up conditional fail2ban on Mikrotik CCR-1016, based on the official documentation
https://wiki.mikrotik.com/wiki/Bruteforce_login_pr... :

1) add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \
address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

(помечаем любые попытки залогиниться в список ssh_stage1 на 1 минуту)

2) add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \
action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

(вторую попытку подключения c ip заносим со списка ssh_stage1 в список ssh_stage2 также на 1 минуту)

3) add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m comment="" disabled=no

(третью попытку подключения также заносим из ssh_stage2 в ssh_stage3 и также на 1 минуту)

4) add chain=input protocol=tcp dst-port=22 connection-state=new \
src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=10d comment="" disabled=no

(четвертая и последующие попытки должны отправляться в банлист на 10 дней)

5) add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \
comment="drop ssh brute forcers" disabled=no

(собственно, бан всех, кто в ssh_blacklist)

The problem is that even with an authorized connection via ssh, a picture emerges for me - an honest ip gets into all lists, incl. and to the ban list (yes, I don't have a standard port 22): I



even added a fifth crutch rule, an analogue of the delay, but it's useless.

It seems that here it is necessary to somehow track the fact of a civil connection and skip further processing of packets according to the address lists, but what do you order to do if even copy-paste from the official documentation does not work. Tried updating the firmware, doesn't help.

Answer 1

So, make another list. white list and just add to the rules, if src adress is not in the white list, then we follow the rules.
Either the first rule checks for SSH and white list, then jump to the rest of the rules

add action=add-src-to-address-list address-list=blocked_honeypot address-list-timeout=1w1s chain=input connection-state=new in-interface=ether1 protocol=tcp src-address-list=!admin src-port=3389,22,8291
add action=drop chain=input src-address-list=blocked_honeypot

Answer 2

Golden config for MikroTik
Presentation