anti dos attack rule for forward

RouterOS General
1

Hi

Ive been struggling to make a forward rule to stop a internal IP to dos attack a external IP


add action=add-src-to-address-list address-list=Syn_Flooder \
    address-list-timeout=30m chain=forward connection-limit=100,32 protocol=\
    tcp tcp-flags=syn

this rule suck, it keeps on adding the src and dst to my address list, but I only want to add the src address to my address list, I don’t care about the dst ip that is getting attack, can someone help me?

when changed to input the rule works like a charm

2

Add ‘incoming’ and ‘outgoing’ interfaces as conditions to rule.

HTH,

3

I’m such a idiot sometimes :laughing: … .thx mate :smiley: