Big undefined upload to somewhere

RouterOS General
1

Dears,
We have some troubles with MikroTik few months… The truth is, i am not sure if the problem is on mikrotik side…
We have public static IP. Sometimes WAN connection is still uploading something to out to the internet to few IP addresses. I checked that all users in network had turned off the computers. Only Mikrotik was online. The upload was very strong and actualy it was not possible to work with internet.
I blocked those addresses, but after maybe 2 days it was the same with new addresses. And it is still the same. My blacklist has maybe 40 addresses till today.
Limit of my WAN Upload is approximately 4 Mbps.

List of my blacklist (And is still growing :slight_smile:)) )

Do you have please any experience with this problem?

Thank you for support !

2

check if you have opened dns server, proxy or ntp server on mikrotik to inbound connections from internet
maybe those services are being attacked/abused from internet

3

It looks like dns. Below is the screen.
What is the best solution for protection?

4

You need to adopt common firewall approach for input chain: drop everything coming from the wan port that is not established or related. Maybe accept icmp before if necessary. Nothing more.