Add RDP brute-force protection script for MikroTik RouterOS

routeros/README.md

@@ -7,6 +7,7 @@
 | `autorun.rsc` | Шаблон первичной настройки роутера: адресация, отключение небезопасных сервисов (telnet, ftp, api и т.д.), NTP, часовой пояс. Замените `CHANGE_ME` на свои значения. |
 | `initial-setup.rsc` | Расширенный шаблон настройки: bridge, interface-lists (WAN/LAN/StS/VPN), полный firewall (port knocking, anti-bruteforce, ICMP), NAT, DNS, харднинг сервисов, OSPF-фильтры, автообновление прошивки. |
 | `check-isp.rsc` | Проверка доступности двух провайдеров пингом и сброс соединений упавшего канала (для dual-WAN). |
+| `rdp-bruteforce.rsc` | Защита от перебора RDP (TCP/3389): ступенчатое (`rdp_stage1`…`rdp_stage5`) добавление источников в `black-list attackers` с баном на 4w2d и правилом `drop` в filter. Списки `RDP` (доверенные клиенты) и `management` заполняются вручную; `192.168.0.0/16` не банится. |
 | `cloudflare-ip-updater.rsc` | Обновление address-list `CF` актуальными IPv4-подсетями Cloudflare (по расписанию). |
 | `telegram-ip-updater.rsc` | Обновление address-list `TG` актуальными IPv4-подсетями Telegram (по расписанию). |
 | `google-ip-updater.rsc` | Обновление address-list `VPN_ytb` актуальными IPv4-диапазонами Google (goog.json) — для policy-routing на Google/YouTube (по расписанию). |

routeros/rdp-bruteforce.rsc

@@ -0,0 +1,55 @@
+# RDP brute-force protection for MikroTik RouterOS.
+#
+# Detects repeated new RDP (TCP/3389) connection attempts aimed at hosts behind
+# the router and escalates every offending source through five staged
+# address-lists. A source that keeps hammering RDP eventually lands in
+# "black-list attackers" and is banned for 4w2d.
+#
+# How the staging works (the rules are ordered high stage -> low stage on
+# purpose, so a single new connection advances a source by only one stage per
+# pass and never cascades through all lists at once):
+#
+#   unknown source        -> rdp_stage1           (3m)
+#   already in rdp_stage1  -> rdp_stage2           (3m)
+#   already in rdp_stage2  -> rdp_stage3           (3m)
+#   already in rdp_stage3  -> rdp_stage4           (3m)
+#   already in rdp_stage4  -> rdp_stage5           (5m)
+#   already in rdp_stage5  -> black-list attackers (4w2d)   <-- banned & dropped
+#
+# Address-lists you maintain yourself:
+#   RDP         - trusted RDP clients, always accepted (whitelist).
+#   management  - management hosts that must never be staged or banned.
+# Sources inside 192.168.0.0/16 are never banned.
+#
+# Import once:  /import file-name=rdp-bruteforce.rsc
+
+# --- Detection / staging (mangle, forward chain) --------------------------
+/ip firewall mangle
+add action=add-src-to-address-list address-list="black-list attackers" \
+    address-list-timeout=4w2d chain=forward comment="RDP bruteforce" \
+    connection-state=new dst-port=3389 protocol=tcp \
+    src-address=!192.168.0.0/16 src-address-list=rdp_stage5
+add action=add-src-to-address-list address-list=rdp_stage5 \
+    address-list-timeout=5m chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=rdp_stage4
+add action=add-src-to-address-list address-list=rdp_stage4 \
+    address-list-timeout=3m chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=rdp_stage3
+add action=add-src-to-address-list address-list=rdp_stage3 \
+    address-list-timeout=3m chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=rdp_stage2
+add action=add-src-to-address-list address-list=rdp_stage2 \
+    address-list-timeout=3m chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=rdp_stage1
+add action=accept chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=RDP
+add action=add-src-to-address-list address-list=rdp_stage1 \
+    address-list-timeout=3m chain=forward connection-state=new dst-port=3389 \
+    protocol=tcp src-address-list=!management
+
+# --- Blocking (filter, forward chain) -------------------------------------
+# Drop every packet coming from a banned attacker. Place this rule near the top
+# of the forward chain so a ban takes effect immediately.
+/ip firewall filter
+add action=drop chain=forward comment="RDP bruteforce: drop banned attackers" \
+    src-address-list="black-list attackers"