DoS Blocking on MikroTik Switch
Docusaurus supports technical documentation formatting with code examples, tables, and explanations. Below is an example of formatting for hardware IP blocking on MikroTik.
Configuration Example
/interface ethernet switch rule
add comment=dos-77.51.221.219 dst-address=77.51.221.219/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=qsfpplus1-1,qsfpplus2-1,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 switch=switch1
add comment=dos-81.8.93.66 dst-address=81.8.93.66/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=qsfpplus1-1,qsfpplus2-1,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 switch=switch1
add comment=dos-172.236.228.38 dst-address=172.236.228.38/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=qsfpplus1-1,qsfpplus2-1,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 switch=switch1
/interface ethernet switch rule
add comment=dos-77.51.221.219 dst-address=77.51.221.219/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=ether49 switch=switch2
add comment=dos-81.8.93.66 dst-address=81.8.93.66/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=ether49 switch=switch2
add comment=dos-172.236.228.38 dst-address=172.236.228.38/255.255.255.255 mac-protocol=ip new-dst-ports="" ports=ether49 switch=switch2
Parameter Description
| Parameter | Value/Example |
|---|---|
| comment | dos-77.51.221.219 |
| dst-address | 77.51.221.219/255.255.255.255 |
| mac-protocol | ip |
| new-dst-ports | "" (empty) |
| ports | qsfpplus1-1,qsfpplus2-1,sfp-sfpplus1,sfp-sfpplus2,sfp-sfpplus3,sfp-sfpplus4 |
| switch | switch1 |
How it works
This configuration creates hardware-level rules that:
- Block specific IP addresses at the switch level
- Drop traffic before it reaches the CPU
- Protect against DoS attacks efficiently
- Reduce CPU load on the router
Benefits
- Hardware-level protection: Rules are processed by the switch chip
- High performance: No impact on CPU performance
- Immediate effect: Traffic is dropped at the port level
- Scalable: Can handle many rules efficiently