Detecting and Blocking Port Scans in MikroTik

Detecting and Blocking Port Scanners on MikroTik

Port scanners probe your router looking for open services. RouterOS has a built-in Port Scan Detection (PSD) module and additional firewall techniques to automatically detect and block scanners.

Method 1: Built-in PSD Module

RouterOS includes a psd firewall matcher that detects port scanning behavior:

TEXT

/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w comment="Detect TCP port scan"
add chain=input protocol=udp psd=21,3s,3,1 action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w comment="Detect UDP port scan"
add chain=input src-address-list=port-scanners action=drop comment="Drop port scanners"

PSD parameters: 21,3s,3,1 means:

21: weight threshold (21 = scanning lots of ports)
3s: time period to observe
3: low port weight (ports < 1024 count more)
1: high port weight (ports ≥ 1024)

Method 2: Catch Unused Port Access (Honeypot Technique)

Add rules that flag any IP attempting to connect to ports you never use:

TEXT

/ip firewall filter
# Flag connections to known unused ports as suspicious
add chain=input protocol=tcp dst-port=23 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-TELNET:"
add chain=input protocol=tcp dst-port=21 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-FTP:"
add chain=input protocol=tcp dst-port=25 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-SMTP:"
add chain=input protocol=tcp dst-port=445 action=add-src-to-address-list address-list=port-scanners address-list-timeout=1w log=yes log-prefix="SCAN-SMB:"

If Telnet (23), FTP (21), SMTP (25), SMB (445) are not running, any connection attempt is a scanner.

Method 3: Detect Nmap OS Fingerprinting

Nmap uses specific probe packets. Detect invalid TCP flag combinations:

TEXT

/ip firewall filter
# Nmap XMAS scan (FIN, URG, PSH all set)
add chain=input protocol=tcp tcp-flags=fin,urg,psh action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="XMAS-SCAN:"

# Null scan (no flags set)
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="NULL-SCAN:"

# FIN scan
add chain=input protocol=tcp tcp-flags=fin action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w log=yes log-prefix="FIN-SCAN:"

Method 4: Rate-Limit SYN Packets

Port scanners send SYN packets rapidly. Limit them:

TEXT

/ip firewall filter
add chain=input protocol=tcp tcp-flags=syn connection-state=new action=jump jump-target=syn-scan-detect
/ip firewall filter
add chain=syn-scan-detect src-address-list=port-scanners action=drop
add chain=syn-scan-detect action=add-src-to-address-list address-list=port-scanners address-list-timeout=2w limit=100,50:packet
add chain=syn-scan-detect action=accept

This blacklists any IP that sends more than 100 SYN packets in 50 seconds.

Viewing Detected Scanners

TEXT

/ip firewall address-list print where list=port-scanners

You'll typically see many entries — especially if your WAN IP is public.

Checking Logs

TEXT

/log print where message~"SCAN"

Script: Auto-Alert on New Port Scanners

TEXT

/system script
add name=scan-alert source={
    :local count [/ip firewall address-list print count-only where list=port-scanners]
    /log warning message="Port scanner count: $count"
}
/system scheduler add name=scan-alert interval=1h on-event=scan-alert

Important Notes

Place port scanner detection rules early in the input chain — before your accept rules — so scanners are blocked before they reach any open service.
Whitelist your own management IPs to avoid accidentally blocking yourself:

TEXT

/ip firewall filter
add chain=input src-address=192.168.88.10 action=accept comment="Management IP - never block" place-before=0

Summary

Technique	Detects
PSD module	Rapid multi-port scanning
Unused port honeypot	Any probe on closed service ports
Invalid TCP flags	Nmap XMAS/NULL/FIN scans
SYN rate limiting	High-speed SYN scanners