Mikrotik protection from DOS attacks: firewall setup | ServerFlow
In this video, a Server Flow specialist will detail methods for protecting against DOS attacks on Mikrotik equipment running RouterOS.
Before discussing protection methods, we consider it necessary to explain the difference between DOS and DDOS attacks.
A DOS (Denial of Service) attack occurs when one client uses specialized DOS loaders, such as Siege, to send a huge number of packets to the server. This clogs the communication channel and overloads the CPU of both the server and Mikrotik. Failure to protect against such attacks can lead to a server crash or a significant reduction in its response time to real client requests.
A DDOS (Distributed Denial of Service) attack is a more complex type of attack that uses botnets—entire networks of infected devices with pre-installed software—as the attackers. These devices can number in the thousands, making defense against such attacks significantly more difficult.
Now, let's use RouterOS as an example to understand how to combat DOS attacks on Mikrotik equipment:
1. First, let's learn how to identify attack indicators (CPU and network adapter load on the PC) and detect a large number of connections from a single IP address using the Torch tool in RouterOS.
2. Using the identified attacker IP address, create a "Drop" rule in Firewall to terminate the connection to the attacking computer.
Now, let's review the firewall rules we've created to automatically block attackers. These will immediately blacklist attackers, preventing them from damaging your network infrastructure.
We'd also like to explain why this method isn't suitable for protecting against DDoS attacks.
If you have a home server (home hosted), you're using an internet service provider (ISP) that has allocated you a limited Ethernet connection. A DDoS attack can paralyze this connection at the ISP level, resulting in the disconnection of your internet access.
Therefore, to effectively combat DDOS attacks, it is recommended to place equipment in a data center where the provider already has an infrastructure to protect against DDOS attacks and high equipment throughput.
Our website - https://serverflow.ru
ServerFlow Blog - https://serverflow.ru/blog/