سخت‌سازی فایروال MikroTik: چک‌لیست امنیتی تولیدی

/user set [find name=admin] password=V3ryStr0ng!P@ss

/user add name=netadmin password=V3ryStr0ng!P@ss group=full
/user disable admin

/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
set ssh port=2222
set www-ssl port=4443

/ip service
set ssh address=192.168.88.0/24
set www-ssl address=192.168.88.0/24
set winbox address=192.168.88.0/24

/ip firewall filter

# قبول established/related
add chain=input connection-state=established,related action=accept

# Drop پکت‌های invalid
add chain=input connection-state=invalid action=drop

# قبول ICMP
add chain=input protocol=icmp action=accept

# قبول مدیریت فقط از LAN
add chain=input src-address=192.168.88.0/24 action=accept

# Drop همه بقیه
add chain=input action=drop comment="Default deny input"

/ip firewall filter
add chain=forward connection-state=established,related action=accept
add chain=forward connection-state=invalid action=drop
add chain=forward action=drop comment="Default deny forward"

/ip neighbor discovery-settings set discover-interface-list=LAN

/tool mac-server set allowed-interface-list=LAN
/tool mac-server ping set enabled=no

/tool bandwidth-server set enabled=no

/ip dns set allow-remote-requests=no

/ip ssh set strong-crypto=yes

/ip service print
/ip firewall filter print
/tool mac-server print
/ip dns print

/system backup save name=post-hardening