vtino17/mikrotik-hardening

# MikroTik 安全加固 [](LICENSE) [](https://github.com/vtino17/mikrotik-hardening/stargazers) [](https://mikrotik.com/) [](https://github.com/vtino17/mikrotik-hardening/commits) [](CONTRIBUTING.md) 适用于 MikroTik RouterOS v7+ 的生产级安全配置。 本指南汇编了来自实际部署的实战配置——而非纯理论。每个部分都针对特定的攻击面，并提供了可直接复制粘贴的 RouterOS 命令。 ## 目录 1. [初始安全](#1-initial-security) 2. [Firewall 规则集](#2-firewall-rulesets) 3. [VLAN 分段](#3-vlan-segmentation) 4. [VPN 隧道](#4-vpn-tunnels) 5. [DNS 与 Web 过滤](#5-dns--web-filtering) 6. [带宽管理](#6-bandwidth-management) 7. [日志与监控](#7-logging--monitoring) 8. [Wazuh SIEM 集成](#8-wazuh-siem-integration) 9. [备份与灾难恢复](#9-backup--disaster-recovery) 10. [审计清单](#10-audit-checklist) ## 1. 初始安全 ### 移除默认用户并保障管理员访问安全 ``` /user remove admin /user add name=admin group=full disabled=yes /user add name=neteng group=full password="" # SSH 加固 /ip ssh set strong-crypto=yes host-key-size=4096 allow-none-crypto=no /ip ssh set always-allow-password-login=no # 禁用未使用的服务 /ip service disable telnet,ftp,www,api,api-ssl,winbox /ip service set ssh port=2222 /ip service set www-ssl port=443 /tool bandwidth-server set enabled=no /tool mac-server set allowed-interface-list=none /tool mac-winbox-server set allowed-interface-list=none ``` ### NTP 与时间同步 ``` /system ntp client set enabled=yes primary=162.159.200.1 secondary=162.159.200.123 /system clock set time-zone-autodetect=no time-zone-name=Asia/Jakarta ``` ## 2. Firewall 规则集 ### 基础防护（连接跟踪 + 默认丢弃） ``` /ip firewall filter # Default drops add chain=input connection-state=invalid action=drop comment="Drop invalid" add chain=input connection-state=established action=accept add chain=input connection-state=related action=accept add chain=input protocol=icmp action=accept comment="Allow ICMP" add chain=input action=drop comment="Drop all else" # Layer-7 DDoS 防护 /ip firewall layer7-protocol add name=dns-flood regexp="^.+(suspicious\.domain\.com).*$" # 端口扫描检测 /ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \ address-list=port-scanners address-list-timeout=1d comment="PSD scan detect" add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list \ address-list=port-scanners address-list-timeout=1d comment="Connection limit" add chain=input src-address-list=port-scanners action=drop comment="Drop scanners" ``` ### Forward 链 / VLAN 隔离 ``` /ip firewall filter add chain=forward in-interface=br-management out-interface=br-guest action=drop add chain=forward in-interface=br-guest out-interface=br-management action=drop add chain=forward in-interface=br-guest out-interface=br-server action=drop add chain=forward in-interface=br-iot out-interface=!br-iot action=drop ``` ### NAT / Masquerade ``` /ip firewall nat add chain=srcnat out-interface=pppoe-out action=masquerade comment="Internet access" add chain=dstnat in-interface=pppoe-out protocol=tcp dst-port=443 \ action=dst-nat to-addresses=192.168.1.10 to-ports=443 comment="Wazuh dashboard" ``` ## 3. VLAN 分段 ``` # 创建 VLAN 接口 /interface vlan add name=vlan-management vlan-id=10 interface=bridge-local /interface vlan add name=vlan-server vlan-id=20 interface=bridge-local /interface vlan add name=vlan-guest vlan-id=30 interface=bridge-local /interface vlan add name=vlan-iot vlan-id=40 interface=bridge-local /interface vlan add name=vlan-voip vlan-id=50 interface=bridge-local # 带 VLAN 过滤的 Bridge /interface bridge add name=bridge-local vlan-filtering=yes /interface bridge port add bridge=bridge-local interface=ether2 /interface bridge vlan add bridge=bridge-local tagged=bridge-local untagged=ether2 vlan-ids=10,20,30,40,50 # 每个 VLAN 的 DHCP /ip dhcp-server add name=dhcp-management interface=vlan-management address-pool=pool-management /ip pool add name=pool-management ranges=192.168.10.2-192.168.10.254 ``` | VLAN | ID | Subnet | 用途 | Internet | VLAN 间互访 | |------|----|--------|---------|----------|------------| | Management | 10 | 192.168.10.0/24 | 管理设备 | ✅ | 所有 | | Server | 20 | 192.168.20.0/24 | Wazuh, Nginx, DB | ✅ | 仅 Management | | Guest | 30 | 192.168.30.0/24 | 访客 | ✅ | 无 | | IoT | 40 | 192.168.40.0/24 | 智能设备 | ✅ | 无 | | VoIP | 50 | 192.168.50.0/24 | 电话 | ✅ | 仅 Management | ## 4. VPN 隧道 ### WireGuard 站点到站点 ``` /interface wireguard add name=wg-office listen-port=51820 private-key="..." /ip address add address=10.0.1.1/30 interface=wg-office /interface wireguard peers add interface=wg-office public-key="..." \ endpoint-address=203.0.113.10 endpoint-port=51820 allowed-address=10.0.2.0/24 /ip route add dst-address=10.0.2.0/24 gateway=wg-office ``` ### 面向远程用户的 L2TP/IPsec ``` /interface l2tp-server server set enabled=yes use-ipsec=yes \ ipsec-secret="" default-profile=l2tp-profile /ppp profile add name=l2tp-profile local-address=192.168.100.1 \ remote-address=192.168.100.2-192.168.100.50 use-encryption=yes /ppp secret add name=remote-user password="" service=l2tp profile=l2tp-profile ``` ## 5. DNS 与 Web 过滤 ### 带有阻止列表的本地 DNS 缓存 ``` /ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=4096 # 屏蔽恶意域名 /ip dns static add name=malware.example.com address=0.0.0.0 type=A /ip dns static add name=phishing.example.com address=0.0.0.0 type=A ``` ### AdGuard Home / PiHole 上游 ``` # 将客户端指向位于 192.168.20.10 的 AdGuard VM /ip dhcp-server network set 0 dns-server=192.168.20.10 # 如果 AdGuard 宕机，回退到 RouterOS DNS /ip dns set servers=192.168.20.10,1.1.1.1 ``` ## 6. 带宽管理 ### 每个 VLAN 的 Simple Queue ``` /queue simple add name=guest-limit target=vlan-guest/30 max-limit=10M/10M \ burst-limit=20M/20M burst-threshold=8M/8M burst-time=30s /queue simple add name=iot-limit target=vlan-iot/40 max-limit=5M/5M \ burst-limit=10M/10M burst-threshold=4M/4M burst-time=30s /queue simple add name=voip-priority target=vlan-voip/50 max-limit=50M/50M \ parent=none queue=wireless-default/wireless-default priority=1 ``` ### 用于公平分配的 PCQ ``` /queue type add name=pcq-download kind=pcq pcq-classifier=dst-address /queue type add name=pcq-upload kind=pcq pcq-classifier=src-address /queue simple add name=pcq-all target=bridge-local/24 max-limit=100M/100M \ queue=pcq-upload/pcq-download ``` ## 7. 日志与监控 ### 发送至远程 SIEM 的 Syslog ``` /system logging action add name=remote-siem target=remote \ remote=192.168.20.5:514 remote-log-level=info /system logging add action=remote-siem topics=info,error,warning,firewall /system logging add action=remote-siem topics=account,critical ``` ### 用于网络监控的 SNMP ### 针对关键事件的电子邮件告警 ``` /tool e-mail set address=smtp.example.com port=587 \ user="neteng@example.com" password="" start-tls=yes /system script add name=alert-admin source={ :log warning "Router rebooted" /tool e-mail send to="admin@example.com" \ subject="[MikroTik] Router rebooted" body="Uptime: [/system resource get uptime]" } ``` ## 8. Wazuh SIEM 集成 ### RouterOS syslog 配置 ``` # 在 Wazuh agent 上：/var/ossec/etc/ossec.conf syslog 192.168.20.5:514 ``` ### 自定义解码器参考 请参阅 [wazuh-custom-decoders](https://github.com/vtino17/wazuh-custom-decoders) 仓库以获取完整的 MikroTik 解码器规则集。 ## 9. 备份与灾难恢复 ### 定时备份至远程 ``` /system script add name=backup-cloud source={ /system backup save name=($ystem.identity..."-"...[/system clock get date]) /tool fetch url="sftp://192.168.20.5/backups/" \ user=backup password="" \ src-path=($ystem.identity..."-"...[/system clock get date]...".backup") :delay 5s /file remove [find name~$ystem.identity] } /system scheduler add name=sched-backup interval=1d start-time=03:00 \ on-event=backup-cloud ``` ### 导出配置 ``` /export file=router-config-20260721 ``` ## 10. 审计清单 - [ ] 已移除默认管理员并设置了复杂密码 - [ ] 已禁用未使用的服务（telnet、ftp、api、winbox） - [ ] SSH 运行在非标准端口上，采用仅密钥或强密码 - [ ] 已启用连接跟踪和状态规则 - [ ] 端口扫描检测已激活 - [ ] 已启用带有 VLAN 间规则的 VLAN 过滤 - [ ] DDoS 防护（连接限制、layer-7） - [ ] DNS 指向已过滤的解析器 - [ ] 日志发送至远程 SIEM（Wazuh） - [ ] Firewall 关键链已记录日志 - [ ] NTP 配置正确 - [ ] SNMP 仅限于管理网络访问 - [ ] 已计划自动备份 - [ ] VPN 采用强加密（WireGuard 或 IPsec） - [ ] 固件已更新至最新的 RouterOS 稳定版 - [ ] 已启用带宽管理，至少配置了基本队列 ## 参考 - [MikroTik 安全手册](https://wiki.mikrotik.com/wiki/Manual:Security) - [RouterOS v7 Firewall](https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter) - [CIS MikroTik 基准测试](https://www.cisecurity.org/benchmark/mikrotik) **由 [vtino17](https://github.com/vtino17) 维护** — 欢迎通过 PR 贡献。