Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
One of our customers runs a holiday park with <100 users on it.
We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been sending out spam emails and attempting to bruteforce online accounts.
What could we put in place to prevent malicious activity? Would using a service like DYN dns work? The ISP will not allow us back online until we have shown them we have took steps in preventing further abuse.
Thanks.
There is no simple solution to preventing abuse of shared Internet lines, especially if you want to make sure the line remains useful for the non-abusive users.
What I mean by that is: Many people using a Wifi will want to send emails from desktop email clients, use VPN connections, messengers or make calls using tools like Skype for example.
If you restrict ports to just the canonical http/https ports you will not prevent any brute force attack against GMail / Facebook / you name it but you will render the Wifi hotspot next to useless for many users. Internet isn't just the world wide web anymore for a long time.
Typical measures which are taken on public hotspots are limitations in terms of the amount of data allowed per unit of time. This usually means to implement some intelligent rate limiting algorythms which are once again far from trivial, because if a client sends 100 MB in a few seconds, this will be perfectly ok if it's a video chat, but you don't want to allow 100 MB of spam being sent out in a minute.
In case you don't have the expertise to deal with these issues on an ongoing basis and you don't think you want to built up that knowledge, one very wise decision might be to delegate this to a company which does that for a living.
I don't want to drop any names here but there are specialized companies in all parts of the world which operate a scheme by which you send all traffic from your customer's guests though a VPN connecton to them and they will sort of malicious traffic and delegate the legitimate traffic to the Internet using their publicly routed IP address and not that of your ISP.
Your ISP will only see the VPN traffic and never blame you (cut you line) for anything which got sent over that link unless the pure amount of traffic becomes an issue. But even that can usually be mitigated in the router firmware which that company you will be working with provides you.
With MikroTik the simplest thing is to apply QOS, DNS Interception, Outgoing PORT Blocking (allow only 443,80,53, block port 25 by default). You should use MikroTik Hotspot with authentication page.
You can maybe intercept DNS into Quad9 or any other service however QOS can be applied on any single client. For example you can restrict each client to a reasonable upload speed like between 2-5 Mbps max. You can also try to apply some max connections limits and local firewall blocklist. MikroTik RouterOS has a connlimit function in the firewall and you can verify that if someone passes a specific new connections rate he will be put in the blacklisted clients.
From my experience with NGFW you will need to know how to program/configure then and not all of them are intuitive enough for this specific use case.
MikroTik is a Router and FW device but doesn't do any Deep Inspection. One of the benefits of MikroTik is that it has support for IPSEC and other routing and VPN clients: PPTP/L2TP/OpenVPN/GRE/IPIP. With these you can try to route the local clients traffic via a remote/cloud NGFW like Fortinet or any other vendor.
You have loads of options.
Most of the best are paid, however start with blocking all ports except 443 and 80, as this then restricts to just normal web traffic.
Use OpenDNS and add a policy that prevents all known bad stuff.
Then slightly more complex, look at either blocking files on your firewall (need layer 7 aware/NGFW), a web proxy such as squid or an IPS. You will have difficulty with TLS and privacy concerns would outweigh the benefit.
Something like Sophos UTM or CISCO firepower can do all this for c.£1k.
I would use DNS and ports to provide some level of protection and maybe bandwidth restrictions. Otherwise it becomes complex, as you may log sensitive info and get caught up in bigger issues. Also anything too complex is likely not detected by the ISP for the same reasons.
