the following command prevents internet access on RB2011UASRM
/ip firewall filter
chain=input action=drop protocol=icmp log=no log-prefix=“”
I would expect this rule to just block pings.
Maybe your isp is checking your router presence before he opens an access… Just guessing.
ICMP is not just PING! Blocking all ICMP is an extremely bad idea, and may inhibit communication when the
MTU of your link is less than that of your local network.
At the very least put such a rule later in the chain than permit ESTABLISHED and RELATED rules.
I will try it in the middle of the night when it as gone quiet.
This is a new 1:1 Fibre Cable that I have connected my spare 2011 with latest firmware installed connected it direct to NTE, this is temporary until I can get my main router off the old connection which is a 30Mbps wireless backhaul connected to a 1:1 private fibre.
I have that command in my RB1100AHx2 ( Connected to old Backhaul ) in exactly the same location and it works fine, when I put command in the 2011 it blocks internet.
***Something else I am getting that I do not get on RB1100 is that I cannot communicate with any devices that have public IP’s ether static or PPPoE server assigned even though they are on the same network segment.
I am also getting drop out of some PPPoE server Assigned IP’s customer routers, but not all of them, again when I route them via the 110AHx2 they stay up.
I have manually copied configuration ( Except for IP addresses ) from the 1100AHx2 even renaming the interfaces to match as far as I can see the only difference is the IP addresses and the firmware.
When you are in an environment using PPPoE (and thus issues with different MTU) then blocking all ICMP is a perfect recipe for big trouble.
Don’t do it…
I have been blocking all incoming pings on the WAN port for 4 and 1/2 years now and not had any problems at all, until I started using the 2011UAS with the latest firmware.
I need someone who can help solve the problem not someone telling to leave my WAN port open to abuse.
Blocking ICMP is not the same as blocking PING!
ICMP is much more than PING!
Many firewall operators do not understand that and cut themselves in the thumb.
ICMP = Internet Control Message Protocol. This is also used for things like determining the MTU of the next hop.
As you are using PPPoE, your next hop will not have the same MTU and by blocking ICMP you cause yourself to
be locked out.
I block incoming not outgoing and have had no problems even with PPPoE
Ok, I thought you had a problem. And I think it is caused by misunderstanding, not by
possible firewall issues. But when all is OK, good for you!
I have a problem with the new firmware not the old firmware I have been using for the past 4 1/2 years