文档介绍：Mikrotik Security
IP -> Services
• Disable unused services
• Set Available From for appropriate hosts
• Secure protocols are preferred
(Winbox/SSH)
IP -> Neighbors
• Disable Discovery Interfaces where not
necessary. All interfaces that don’t directly
connect to your own infrastructure.
• Note: Winbox discovery won’t work if you
disable neighbor discovery.
Tools -> Btest Server
• By default the bandwidth test server is
enabled. Be sure to only activate this
when necessary.
System -> Users
• Users are assigned to groups.
• Groups specify what access you get.
• User section allows password changes.
System -> Logging and Log
• Setup special actions to get more detail on
a specific subject.
• Send to syslog server (CactiEZ).
Basic Diagram
Packet Flow - Bridging
• Via http://wiki./wiki/Packet_Flow
Packet Flow - Routing
• Via http://wiki./wiki/Packet_Flow
PAT Protection
• PAT(Port Address Translation) “NAT
Overload”
• This gives you some protection because
connections can’t be sourced from outside
of work.
• The easiest method is to IP -> firewall ->
NAT. Then create a source nat with action
of masquerade.