3

One of our customers runs a holiday park with <100 users on it.

We currently have a mikrotik in place that prevents torrenting etc, however their line has been cut off as someone there has been sending out spam emails and attempting to bruteforce online accounts.

What could we put in place to prevent malicious activity? Would using a service like DYN dns work? The ISP will not allow us back online until we have shown them we have took steps in preventing further abuse.

Thanks.

2
  • I would recommend a device like Sophos Simple & Secure Wi-Fi and Secure Web Appliance. It´s made for this question. Find more information on their Website
    – Cyberduck
    Commented Aug 29, 2018 at 21:42
  • blocking outbound port 25 (smtp) should be a good start to stop email spamming.
    – Lukas
    Commented Sep 1, 2018 at 8:22

3 Answers 3

4

There is no simple solution to preventing abuse of shared Internet lines, especially if you want to make sure the line remains useful for the non-abusive users.

What I mean by that is: Many people using a Wifi will want to send emails from desktop email clients, use VPN connections, messengers or make calls using tools like Skype for example.

If you restrict ports to just the canonical http/https ports you will not prevent any brute force attack against GMail / Facebook / you name it but you will render the Wifi hotspot next to useless for many users. Internet isn't just the world wide web anymore for a long time.

Typical measures which are taken on public hotspots are limitations in terms of the amount of data allowed per unit of time. This usually means to implement some intelligent rate limiting algorythms which are once again far from trivial, because if a client sends 100 MB in a few seconds, this will be perfectly ok if it's a video chat, but you don't want to allow 100 MB of spam being sent out in a minute.

In case you don't have the expertise to deal with these issues on an ongoing basis and you don't think you want to built up that knowledge, one very wise decision might be to delegate this to a company which does that for a living.

I don't want to drop any names here but there are specialized companies in all parts of the world which operate a scheme by which you send all traffic from your customer's guests though a VPN connecton to them and they will sort of malicious traffic and delegate the legitimate traffic to the Internet using their publicly routed IP address and not that of your ISP.

Your ISP will only see the VPN traffic and never blame you (cut you line) for anything which got sent over that link unless the pure amount of traffic becomes an issue. But even that can usually be mitigated in the router firmware which that company you will be working with provides you.

1
  • Thank you for your reply. Would you please be able to give me a list of these companys? i have had a look into Cisco umbrella. Commented Aug 29, 2018 at 10:34
0

With MikroTik the simplest thing is to apply QOS, DNS Interception, Outgoing PORT Blocking (allow only 443,80,53, block port 25 by default). You should use MikroTik Hotspot with authentication page.

You can maybe intercept DNS into Quad9 or any other service however QOS can be applied on any single client. For example you can restrict each client to a reasonable upload speed like between 2-5 Mbps max. You can also try to apply some max connections limits and local firewall blocklist. MikroTik RouterOS has a connlimit function in the firewall and you can verify that if someone passes a specific new connections rate he will be put in the blacklisted clients.

From my experience with NGFW you will need to know how to program/configure then and not all of them are intuitive enough for this specific use case.

MikroTik is a Router and FW device but doesn't do any Deep Inspection. One of the benefits of MikroTik is that it has support for IPSEC and other routing and VPN clients: PPTP/L2TP/OpenVPN/GRE/IPIP. With these you can try to route the local clients traffic via a remote/cloud NGFW like Fortinet or any other vendor.

7
  • 1
    You have posted links to the same YouTube channel on a couple of your posts. It starts to look like spam when you do that. And since the videos are merely reference material to a subpoint in your answers, I removed them. Please include the relevant parts of your links in your answer here.
    – schroeder
    Commented Mar 31, 2021 at 19:29
  • @schroeder It's not spam. I will not write here a full lecture when someone else is doing a better job then I will do in a million yers. I do understand why you are getting to this doubt. What is the best way to refer to a video resource?
    – elico
    Commented Mar 31, 2021 at 23:35
  • As I said, only include them if they are directly relevant to the question (they really haven't been) and make sure the answer can stand alone without them, and include them only as a reference.
    – schroeder
    Commented Mar 31, 2021 at 23:39
  • Like a reference in the bottom? I believe that understanding the nature of the question and answering with a video link to it is relevant. I assume You Might have more experience then me here. If you would have known these videos from sec 0 till the very end and would have experience with MT Routers you would probably would understand. My assumption is that you probably never programmed these in such advanced setup.
    – elico
    Commented Mar 31, 2021 at 23:43
  • I have. But that's not the point. It's about relevance
    – schroeder
    Commented Mar 31, 2021 at 23:43
-1

You have loads of options.

Most of the best are paid, however start with blocking all ports except 443 and 80, as this then restricts to just normal web traffic.

Use OpenDNS and add a policy that prevents all known bad stuff.

Then slightly more complex, look at either blocking files on your firewall (need layer 7 aware/NGFW), a web proxy such as squid or an IPS. You will have difficulty with TLS and privacy concerns would outweigh the benefit.

Something like Sophos UTM or CISCO firepower can do all this for c.£1k.

I would use DNS and ports to provide some level of protection and maybe bandwidth restrictions. Otherwise it becomes complex, as you may log sensitive info and get caught up in bigger issues. Also anything too complex is likely not detected by the ISP for the same reasons.

3
  • 2
    What you are suggesting is a mixture of measures which render the Internet next to useless on one hand and will not prevent a lot of malicious activity at all. For example, how would OpenDNS prevent any "bad stuff". Also it is a common misconception that just buying any piece of hard- or software with a popular name on it will solve any problems, but it will not unless you know how to configure it.
    – TorstenS
    Commented Aug 29, 2018 at 9:22
  • We are hardly talking top security requirements here. Commented Aug 29, 2018 at 13:24
  • OpenDNS does site categorisation. You need to ask if full all singing internet is a key part of the business model, or can restrictions be made such as not opening ports. Sure there's going to be the odd Skype user but that's not going to be hard to fix. At the end of the day you still have internet, it's simple and less likely to have issues. Outsourcing is fine, but involves costs like legal fees and if in the EU you need to change all the agreements to cover that processing, which is far more complex. Commented Aug 29, 2018 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .