MikroTik Ninja: Hide Router & Anti Brute-Force

1. Konsep MikroTik Ninja Mode (Hide Routerboard)

ISP atau scanner luar dapat mendeteksi keberadaan RouterBOARD melalui protokol broadcast Layer 2 (MNDP, CDP, LLDP) dan MAC winbox. Fitur Ninja Mode BuanaNET mematikan seluruh jejak discovery pada interface WAN:

# Matikan Neighbor Discovery pada Interface WAN
/ip neighbor discovery-settings set discover-interface-list=!WAN

# Matikan MAC-Telnet dan MAC-Winbox Server dari arah WAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

2. Skrip Anti Brute-Force Winbox & SSH Bertingkat 3 Tahap

# Blokir permanen IP penyerang yang gagal login 3 kali dalam 1 menit
/ip firewall filter add chain=input protocol=tcp dst-port=8291,22 src-address-list=Blacklist-Attacker action=drop comment="Drop Brute Force Attackers"

/ip firewall filter add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=Winbox-Stage-2 action=add-src-to-address-list address-list=Blacklist-Attacker address-list-timeout=7d comment="Stage 3 -> Masuk Blacklist 7 Hari"
/ip firewall filter add chain=input protocol=tcp dst-port=8291,22 connection-state=new src-address-list=Winbox-Stage-1 action=add-src-to-address-list address-list=Winbox-Stage-2 address-list-timeout=1m comment="Stage 2"
/ip firewall filter add chain=input protocol=tcp dst-port=8291,22 connection-state=new action=add-src-to-address-list address-list=Winbox-Stage-1 address-list-timeout=1m comment="Stage 1"