DDoS Protection on MikroTik: Scripts and Firewall Techniques

DDoS Protection Scripts for MikroTik

MikroTik RouterOS can be configured to detect and mitigate volumetric DDoS attacks. This post covers practical scripts and rules you can deploy immediately.

Understanding DDoS on MikroTik

When a DDoS attack hits your router:

CPU spikes to 100%
Legitimate traffic is dropped
The router may become unresponsive

RouterOS can't stop a true volumetric attack at the link level, but it can protect itself and route traffic more intelligently.

1. Block Fragmented Packets

DDoS attacks often use fragmented IP packets to overwhelm the router:

TEXT

/ip firewall filter
add chain=input protocol=udp dst-port=0-65535 fragment=yes action=drop comment="Drop fragmented UDP"
add chain=input protocol=tcp fragment=yes action=drop comment="Drop fragmented TCP"

2. Connection Rate Limiting

Limit the number of new connections per second from a single IP:

TEXT

/ip firewall filter
add chain=input connection-state=new action=jump jump-target=conn-rate-limit
/ip firewall filter
add chain=conn-rate-limit src-address-list=conn-flood action=drop
add chain=conn-rate-limit action=add-src-to-address-list address-list=conn-flood address-list-timeout=5m limit=20,10:packet
add chain=conn-rate-limit action=accept

Explanation: If a single IP creates more than 20 new connections in 10 seconds, it gets blacklisted for 5 minutes.

3. ICMP Flood Protection

TEXT

/ip firewall filter
add chain=input protocol=icmp icmp-options=8:0 action=jump jump-target=icmp-rate
/ip firewall filter
add chain=icmp-rate src-address-list=icmp-flood action=drop
add chain=icmp-rate action=add-src-to-address-list address-list=icmp-flood address-list-timeout=5m limit=10,5:packet
add chain=icmp-rate action=accept

4. SYN Flood Protection

SYN floods exploit the TCP handshake. Detect and block them:

TEXT

/ip firewall filter
add chain=input protocol=tcp tcp-flags=syn connection-state=new action=jump jump-target=syn-protect
/ip firewall filter
add chain=syn-protect src-address-list=syn-flood action=drop
add chain=syn-protect action=add-src-to-address-list address-list=syn-flood address-list-timeout=10m limit=50,5:packet
add chain=syn-protect action=accept

5. UDP Flood Protection

TEXT

/ip firewall filter
add chain=input protocol=udp action=jump jump-target=udp-protect
/ip firewall filter
add chain=udp-protect src-address-list=udp-flood action=drop
add chain=udp-protect action=add-src-to-address-list address-list=udp-flood address-list-timeout=10m limit=100,50:packet
add chain=udp-protect action=accept

6. Block Bogon IP Addresses

Bogons are IP ranges that should never appear on the internet. Block them at input:

TEXT

/ip firewall address-list
add list=bogons address=0.0.0.0/8
add list=bogons address=10.0.0.0/8
add list=bogons address=100.64.0.0/10
add list=bogons address=127.0.0.0/8
add list=bogons address=169.254.0.0/16
add list=bogons address=172.16.0.0/12
add list=bogons address=192.0.0.0/24
add list=bogons address=192.168.0.0/16
add list=bogons address=198.18.0.0/15
add list=bogons address=240.0.0.0/4

/ip firewall filter
add chain=input src-address-list=bogons action=drop comment="Drop bogon sources"
add chain=forward src-address-list=bogons action=drop

7. Automatic DDoS Detection Script

This script monitors connection counts and alerts you:

TEXT

/system script
add name=ddos-check source={
    :local conns [/ip firewall connection print count-only]
    :if ($conns > 5000) do={
        /log warning "DDoS suspected: $conns active connections"
        /tool e-mail send to="admin@example.com" subject="DDoS Alert" body="$conns connections active on router"
    }
}

/system scheduler
add name=ddos-monitor interval=1m on-event=ddos-check

8. CPU Protection — Drop if Overloaded

TEXT

/ip firewall filter
add chain=input action=drop comment="Overload protection" disabled=yes

During an attack you can temporarily enable this rule to drop all non-essential input traffic, protecting the router's CPU while you investigate.

Testing Your Rules

Check address lists to see if IPs are being flagged:

TEXT

/ip firewall address-list print where list~"flood"

Check connection count:

TEXT

/ip firewall connection print count-only

Monitor CPU:

TEXT

/system resource print