Looks like I’m having an absolute beginner question. On other systems than MikroTik this question is easy to be answered.
I have a cellular MikroTik IoT router (KNOT), that uses LTE-M / NB-IoT. One of the clients is flooding the network with dozens of DNS requests. Due to the limited bandwidth, this let the entire upstream to congest.
Client (172.16.64.199) ---> (172.16.64.254) MikroTik (1.2.3.4) ----> Internet
Since this one client doesn’t need any DNS to work properly, I tried to create a firewall rule that drops any DNS traffic originating from this client. But I’m definitely not able to…
I tried all kind of rules, but the only one that blocks requests is an outbound rule, that also blocks all other kind of DNS traffic. I thought I could make an inbound or forward rule, having my client as the source and port 53 as the destination. (Intentionally ignored TCP).
To see the effect of any rule, I reset the counter:
I activated the log, and all the logged requests are
172.16.64.254:9876 ---> 8.8.8.8:53
If I use the torch tool and set the interface to WLAN or Bridge, then I see dozens of
172.16.64.199 ---> 172.16.64.254:53
. But no idea how to filter them. Any ideas what I can try?
Yup, it makes me cringe when I see people deviate from the defaults and dont know what they are doing.
(1) Why in gods earth would you allow port 80 to the router from the internet side. I would guess that using ether1 probably wont work as traffic is actually via the interface name in pppoe.
(2) Then you allow an input chain rule to a private IP on the LAN via an input chain rule… Ridonkulous.
Delete all the crap DNS rules and you should be left with the defaults with some additional adjustment you get the below settings:
/ip firewall address-list { using static dhcp leases mostly } add address=172.16.64.10x/32 list=Authorized comment=“admin local desktop”
add address=172.16.64.10y/32 list=Authorized comment=“admin local laptop”
add address=172.16.64.10z/32 list=Authorized comment=“admin ipad/smartphone”
add address=192.168.252.3 list=Authorized comment=“admin remote access” /ip firewall filter
{Input Chain}
(default rules to keep) add action=accept chain=input comment=“defconf: accept established,related,untracked” connection-state=established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
( admin rules ) add action=accept chain=input dst-port=51820 protocol=udp comment=“wireguard handshake”
add action=accept chain=input src-address-list=Authorized comment=“Config Access”
add action=accept chain=input comment=“Allow LAN DNS queries-UDP”
dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow LAN DNS queries - TCP”
dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=“drop all else”
{forward chain}
(default rules to keep) add action=fasttrack-connection chain=forward comment=“defconf: fasttrack” connection-state=established,related
add action=accept chain=forward comment=“defconf: accept established,related, untracked” connection-state=established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid” connection-state=invalid
(user rules) add action=accept chain=forward comment=“allow internet traffic” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat disabled=yes { enable if required }
—> add additional user rules here <— add action=drop chain=forward comment=“drop all else”
To all the others, as mentioned in my previous post, these rules are far from production.
Why in gods earth would you allow port 80 to the router from the internet side. I would guess that using ether1 probably wont work as traffic is actually via the interface name in pppoe
Tesing! The router’s WAN port was temporarily attached to a LAN port of my internal network. Just for the sake of simulating non-metered internet. LTE-M/NB-IoT is to expensive to do updates and mess around. And since all my other devices live in my regular LAN, I wanted to configure the Mikrotik without patching cables all the time.
Then you allow an input chain rule to a private IP on the LAN via an input chain rule… Ridonkulous
I guess everything is said.
Delete all the crap DNS rules and you should be left with the defaults with some additional adjustment you get the below settings:
First, thanks for helping me. Nevertheless, a bit of reading would help before blaming.
I had totally overseen the second input rule. Then I created further, more precise rules with enabled logging to see where the packet counter increase and why.
It’s a fact, I’m not really familiar with MikroTik and wouldn’t use one of the product ever if I could avoid it, just because I’m not experienced enough with the RouterOS. I prefer other brands and products. Therefore, you have to excuse, that I potentially haven’t used the correct way to monitor or log what’s going on, on the router. Looks like there is the torch and the log. Both a rather minimalistic and limited tool, to do real debugging. But as I said, may there is more I’m not aware of.
Since I found the root cause, I was able to remove all the custom rules and just added the few I really ned.
