port knocking mikrotik [misc]

Allow access to ssh and web interface of Mikrotik router from Internet for a limited time (5 min) by knocking on predefined port combination.
Open ssh session to the router and enter following commands:

/ip firewall filter   

add chain=input action=add-src-to-address-list address-list="stage1" address-list-timeout=30s comment="stage1 list - 30s" dst-port=12345 protocol=tcp in-interface=ether1 place-before=3   

add chain=input action=add-src-to-address-list address-list="stage2" address-list-timeout=30s comment="stage2 list - 30s" dst-port=23456 protocol=udp src-address-list="stage1" in-interface=ether1 place-before=3   

add chain=input action=add-src-to-address-list address-list="allow_ssh" address-list-timeout=5m comment="allow ssh - 05m" dst-port=34567 protocol=tcp src-address-list="stage2" in-interface=ether1 place-before=3   

add chain=input action=accept chain=input comment="Accept 80,22 from IPs in allow_ssh list" dst-port=80,22 protocol=tcp src-address-list="allow_ssh" in-interface=ether1 place-before=3  

Verify rules by printing out ‘input’ chain. The result should look like:

[admin@MikroTik] /ip firewall filter> print chain=input
Flags: X - disabled, I - invalid, D - dynamic
 0    ;;; defconf: accept ICMP
    chain=input action=accept protocol=icmp

 1    ;;; defconf: accept established,related
    chain=input action=accept connection-state=established,related

 2    ;;; Accept 80,22 from IPs in allow_ssh list
    chain=input action=accept protocol=tcp src-address-list=allow_ssh in-interface=ether1 dst-port=80,22

 3    ;;; allow ssh - 05m
    chain=input action=add-src-to-address-list protocol=tcp src-address-list=stage2 address-list=allow_ssh address-list-timeout=5m
    in-interface=ether1 dst-port=34567

 4    ;;; stage2 list - 30s
    chain=input action=add-src-to-address-list protocol=udp src-address-list=stage1 address-list=stage2 address-list-timeout=30s
    in-interface=ether1 dst-port=23456

 5    ;;; stage1 list - 30s
    chain=input action=add-src-to-address-list protocol=tcp address-list=stage1 address-list-timeout=30s in-interface=ether1 dst-port=12345

 6    ;;; defconf: drop all from WAN
    chain=input action=drop in-interface=ether1 log=no
[admin@MikroTik] /ip firewall filter>

To access web interface or ssh from internet use knock (Linux) or GregSowell.con Port Knock (Windows) to knock the ports in right order.
Example using knock on Linux (xxx.xxx.xxx.xxx is the public IP address of your Mikrotik Router):

knock xxx.xxx.xxx.xxx 12345:tcp 23456:udp 34567:tcp   

Then ssh to the device or open IP in a browser.