Open Source Security Atlas

mikrotik-blacklist: An Open Source Tool for Network Security | Open Source Security Atlas

Network Security

Tool

mikrotik-blacklist

MikroTik Blacklist provides a curated list of banned IPs and hostnames for enhanced network security on MikroTik routers.

View on GitHub

About This Tool

A collection of IP addresses and hostnames banned by Greek law and global security services like Spamhaus for MikroTik firewall configurations

Primary Use Case

This tool is used by network administrators and cybersecurity professionals to block malicious traffic and secure MikroTik routers by integrating a regularly updated blacklist of IPs and hostnames banned by Greek law and global security services. It helps in maintaining robust network security by filtering out unwanted traffic.

Key Features

Comprehensive Lists
Easy Integration
Regular Updates
Community Driven

Insights & Recommendations

Ensure regular updates to maintain the effectiveness of the blacklist. Test configurations to verify proper functionality.

Installation

Download the latest release from the Releases section
Download the relevant files for your MikroTik router’s configuration

Usage

/ip firewall address-list

Import the IP addresses and hostnames from the downloaded files

Set up rules to block traffic

Configure firewall rules to block traffic from the blacklisted IPs

Smart Usage Notes

Repurposing: Beyond blocking known malicious IPs, this tool can be adapted to monitor and alert on traffic from newly emerging threat sources by integrating with threat intelligence feeds.
Chaining: Combine MikroTik Blacklist with a SIEM system to correlate blocked IPs with other network events, providing a comprehensive view of potential threats and enhancing incident response capabilities.
Evasion/Detection: Attackers might use IP rotation or proxy services to bypass static blacklists. To detect such attempts, implement anomaly detection systems that flag unusual traffic patterns or unexpected geolocations.
Data Fusion: Integrate the blacklist data with DNS logs and endpoint security solutions to identify potential command and control communications or data exfiltration attempts, enriching threat intelligence.
Automation: Develop scripts to automatically update MikroTik Blacklist with the latest threat intelligence feeds and integrate with orchestration tools to dynamically adjust firewall rules based on real-time threat assessments.