MikroTik

libyatik

I connect using winbox version 3.11 with a ethernet cable in port 3 of the Mikrotik RB201 with base config running version 6.23. When I copy from notepad I can only paste in a max of 10 lines into terminal. If I try to do more than 10 lines none of the config is applied and I get booted out of the ...

libyatik

reinstall

libyatik

drop port 8000 wan

libyatik

wan ip adsl.jpg I checked my ip address on the adsl wan port and I think it is a private ip (pvc4 is the working one and its ip in range 10.0.0.0) and thus I guess I am behind a nat source from the isp. I asked them if I can be directly connected through public ip address and they are checking it. ...

libyatik

I disabled the firewall on the modem also and tried; no result.

http://www.tp-link.com/us/faq-72.html

libyatik

a hacker must scan a network to collect macs here is where the prevention acts (!=packets sniffing)
Nope. All you have to do is receive. If you never transmit, there is no way to detect it.

that statement holds true in traffic sniffing not network scans where its all request and response

libyatik

this page will resolve the mac spoofing process after a spoof is successful (mac cookie off and short ide times network) i have several ideas to detect 2 devices using the same mac using a mikrotik server only 1-packet response trap method : two devices with the same mac and ip will generate a doubl...

libyatik

There is no way to tell the difference between legitimate users and users spoofing MAC addresses of legitimate users, same for IP addresses. Scanning MAC addresses of legitimate users can be done passively, no way to tell that someone is doing that. the filter works before the spoof happens a hacke...

libyatik

arp poisoning attack may been done on your network while scaning the network an arp sweep is done to determine which mac have which ip when your device updates its arp table the connection is done check if you have any network software on your device or network devices that is broadcasting arp packets

libyatik

Sorry libyatik you lack the basic understanding of the problem and your solution is not a solution. Banning MAC addresses is going to lock out your paying users alongside with the attackers.... NOT a solution. the ban process is for scanners not network legit users (firewall filter) and its not a p...

libyatik

deal with the root reason which is network arp sweeps and icmp scans to reveal the connected macs
if you blocked the scan process then you solve the root of this problem,

libyatik

update winbox - device - and retest

libyatik

dsl modems have firewall rules on the wan side you need to configure it to allow remote connections through this can be a risk or you might be behind an isp nat

libyatik

pcc will dispatch connections between wans but will Not combine the speeds in 15mbps thats another story

libyatik

yes you did break RFC
review this paper
https://tools.ietf.org/html/rfc4343

libyatik

detect netcut users /ip firewall layer7-protocol add name=detect regexp="^.+(arcai.com|netCut)" /ip firewall mangle add action=add-src-to-address-list address-list=netcutuser address-list-timeout=3d chain=prerouting layer7-protocol=detect and ban their macs on dhcp and bridge firewall with...

libyatik

I think that this is what you are looking for: https://wiki.mikrotik.com/wiki/Manual:PCC will pcc merge connections of multi wan to a dst-address and support opening of multiple simultaneous download streams based on dst-address connection count? 20 mbps dsl and a 20 mbps dsl don't combine the spee...

libyatik

(example of concept) when opening new connections to a server that accepts 20 connections mikrotik will count 10 new opened connections to the dst ip then {route ,(redirect)} the other 10 to the second wan this will increase download speed by factor of wan1+wan2 (combined wans ) --------------------...

libyatik

-------------------?

libyatik

hello all how to set a global speed limit for multi users on the same hotspot user(shared users) a login set at 1024 up/down link with a shared users of three for each user will get the 1024 limit thats 3072 up/down and thats the issue how to set a limit at 1024 global speed for all to share (create...

libyatik

this is not working
how to block arp responses (reply) from clients to clients ?

libyatik

Anyone have problem with ethernet link down and up? i see that after i upgrade 6.40 from 6.39.

i noticed the same thing

libyatik

https ماتقدر تاخد اي بيانات عن العميل لان مشفر

libyatik

UPDATE Counter measures can prevent these kind of scanning and spoofing with via network map apps 1-/8 pool with random ips and dhcp /32 netmask a large pool with random ips+ hotspot 1 to 1 nat is very hard to scan for a (novak apk one click hackers) random pool pic ex 11.54.203.33 11.188.234.11 11....

libyatik

update
a switch rule i think can prevent the scan after detection but my switch chip not supporting any rule
need a tester
if true a script can add from scanner list to the switch rule table on block

libyatik

Any testers? Share results.

NOT working in blocking part but the local to local scan detect is very accurate

libyatik

viewtopic.php?f=2&t=124038

libyatik

viewtopic.php?f=2&t=124038
block ip scanner with no false alarms 100%

libyatik

DONE NO IP SCANNERS NO MORE FIREWALL RULES FIRST BEFORE EVEN HOTSPOT DEFAULT RULES =========================================================================================== /ip firewall filter add action=drop chain=output dst-address-list=Scanner src-address=local.lan.pool add action=jump chain=fo...

libyatik

log dhcp leases only and send logs by email if the other logs not important at the moment

libyatik

TEST on : RB951Ui-2HnD ver 6.38.7 (Bugfix only) app used in attack : synflooder Version2 the app flooded the server ip on port 80 result cpu 100% and denial of service present during attack even with firewall filter on drop chain the cpu was on 100% only solution was to block the flooder ip on hotsp...

libyatik

goooooooooooot it { :local x :foreach i in=[/ip firewall address-list find list="flooder-list"] do={ :set x [/ip firewall address-list get value-name=address $i] ip hotspot ip-binding add address=$x type=blocked }} firewall rule for detection add action=add-src-to-address-list address-list...

libyatik

On rule detect the flood and add the address to the list detected. Then your script moves the IP to the list to block if is serious enough. An other rule uses the block address list to block the flooders. how to move the ip from firewall address list and store it in a variable then block it in ip h...

libyatik

no help so far
the only thing i was able to do
{
:local x [/ip firewall address-list find list="doser" get $j address]
ip hotspot ip-binding add address=$x type=blocked
}

libyatik

or how to script
ip hotspot host make-binding type=blocked
from
/ip firewall address-list
???

libyatik

Mac address is layer 2. It is, if I understood correctly, only from router to router passed. For me, therefore, your network works. The router should only transmit its MAC address. Please refer: https://en.wikipedia.org/wiki/OSI_model Rosi thank you after testing this setup only one bug found : WHE...

libyatik

i use a firewall rule to detect flooders and even on drop chian the cpu goes up
i need to run script block dhcp ip lease and make binding and block mac on detection
manual blocking can not prevent this as the attacker can change mac to proceed
HOW TO RUN A SCRIPT ON EVENT FIREWALL LIST ADD ?

libyatik

my network uses hotspot on a first ap and a second repeater ap when client connects to main the client mac is shown but when client conects to the (repeater ap) the client mac is not shown and all clients who use (repeater ap) get the repeater mac on hotspot hosts list {ADDED A PIC} can this setup c...

libyatik

i want to block a range of mac addresses not A list
#drop any packets from any device starting with 00: mac
...........................................................................................

libyatik

#something to start with (general explanation) to disconnect a user automatically from hotspot at a pre set time and let him/her reconnect without manual resting the uptime in user profile is tricky deleting the user dhcp lease when he/she online that will cause hotspot logout in seconds or binding ...

libyatik

if you use the compatible hardware then the answer is no

libyatik

viewtopic.php?f=2&t=123676

libyatik

i found that making the dhcp lease static resolve lots of problems if a client is online and you have short lease time and long ide hotspot /server time the lease will be deleted on wifi disconnect and he/she will still be on hotspot hosts list on reloging a new lease will be given and 2 addresses f...

libyatik

i use an ap and a second repeater when i connect to the main ap all good the problem is in the repeater when using fasttrack rules the ping is fine but browsing is stuck not loading any site i did a lot of testing first i thought it was a repeater problem and i found that disabling or putting the FT...

libyatik

after further testing the rough dhcp was not blocked
another method can be used to ban the ips of the rough on hotspot upon detection to cut internet usage
any idea can help

libyatik

viewtopic.php?f=2&t=123062

libyatik

viewtopic.php?f=2&t=123062

libyatik

hello all this is my setup to deal with rouge dhcp servers first run dhcp client on lan interface with (add default rout ,dns ,ntp) OFF then on dhcp alert use the lan interface and add this code :local mac $"mac-address" /ip dhcp-server lease add mac-address=$mac block-access=yes /ip dhcp-...

libyatik

what you need is a router that support multihoming (protocol binding ) to get the max speed of 10
using other methods will only separate clients connections to reduce load

libyatik

use fasttrack rules

libyatik

YES you can
lan 1st mik to second mik wan
switch the second mik ports and done
OR just buy a switch

Search found 51 matches