Add RDP brute-force protection script for MikroTik RouterOS

[gpas45]

Summary

Added a new MikroTik RouterOS script that implements staged RDP brute-force protection with automatic escalation and banning of attacking sources.

Changes

• New file: routeros/rdp-bruteforce.rsc - Complete RDP brute-force detection and mitigation system

  • Implements a 5-stage escalation system for RDP connection attempts (TCP/3389)
  • Each stage has a 3-minute timeout, with stage 5 having a 5-minute timeout
  • Sources that reach stage 5 are added to a blacklist with a 4-week 2-day ban
  • Includes firewall mangle rules for detection/staging and filter rules for blocking
  • Supports whitelisting via RDP address-list (trusted clients)
  • Supports management hosts that bypass staging via management address-list
  • Exempts internal network 192.168.0.0/16 from banning
  • Includes comprehensive documentation of the staging mechanism

• Updated: routeros/README.md - Added documentation entry for the new script

  • Describes the script's purpose, staging mechanism, and configuration requirements

Implementation Details

• Uses MikroTik firewall mangle rules to progressively add sources to address-lists based on connection state
• Rules are ordered from high stage to low stage to prevent cascading through all lists in a single pass
• Blocking is handled by a separate filter rule that drops all packets from blacklisted sources
• The script is designed to be imported once and requires manual maintenance of whitelist/management address-lists

https://claude.ai/code/session_011QmBU1hdErFnfrU7SrpaUh