Hello friends.
I came across a specific case.
I have an internet connection with a fixed public IP.
In the firewall connections section, I see connections whose source and destination IPs are not related to my network.
in one case, I noticed that the device in question on my network is a mobile phone.
I tried to log any unusual addresses that are trying to exit the pppoe-out1 port in the filter to drop them.
For example, the IPs that you see in the log image I posted below have nothing to do with my internal network and internet address.
So, there are no ISP network addresses among these, especially the address 26.124.76.50—which belongs to the U.S. Department of Defense and is requesting SSH and HTTP connections?
If so, do a netinstall, and if the issue repeats, contact your provider, as these are their settings.
It's best to leave netinstall as a last resort, as it's a lot of hassle.
Service provider?
The request is being made from a client on my router's network, which in this example is a mobile device.
What role could the service provider play in this request?
But I really don't understand how such a request is sent out from a mobile phone on my network.
I found out the source device from the MAC address, but how does the MikroTik router log the source address instead of the mobile phone's IP on the internal network in the range 192.168.1.0/24, a public IP?
I don't know if this is happening here, but I have seen that mobile phones that roam from the mobile network to a WiFi network still send some packets with source address they have on the mobile network towards the WiFi network. Probably they switch route tables and do not have policy routing in place.
Don't go by the whois information for 26.0.0.0/8 being Department of Defense. Lots of blocks from legacy /8 networks have been sold off because IPv4 addresses are very valuable. The original assignees never used the entire /8 (which was easy to obtain in the early days) and it is attractive to sell these blocks to mobile and cloud providers.
In my opinion, the most important part is NAT to connect the clients to the internet, I use a simple `srcnat` rule that translates the 192.168.1.0/24 addresses to my static public IP address.
I don't have any other specific settings in this regard.
However, if there is something specific you have in mind, please let me know and I will provide the details.
So, is it possible for a mobile phone specifically the Android operating system to redirect a request currently being processed on the mobile network to the Wi-Fi network?
I have seen it in my firewall logs, but in that case it was IPv6 traffic. But it would be possible for IPv4 as well I guess.
I presume that this 26.124.76.50 address actually IS the IP address that mobile phone uses when it is not on the WiFi? That DoD reference is a dead herring.
It is not totally unusual that a device is "confused" and sends out packets with the wrong source address. As for the "how can it" - quite simply: it does. There are a lot of devices with subtly broken network stacks. If you didn't look at the logs (or even have a router that makes it possible to log these), you too would have never noticed.
This is actually a nice place to use the raw chain of the firewall. A rule like this ensures that the source addresses are validated, and those that don't have the correct one are dropped.
/ip firewall raw add chain=prerouting action=drop in-interface=bridge1 src-address=!192.168.88.0/24
(of course assuming that you are using the default 192.168.88.0/24 subnet.)
No kidding, I’d dig deeper, not just drop in the raw data.
The local address (192.168.1.x) is most likely issued by the router’s DHCP—that is, so there is an IP-to-MAC address record.
Why does the LAN bridge see this mac-address as someone else's ip-address (26.124.76.50)(ok for "bad" packet) and forward it to the default gateway? That is, the router allows the processing of traffic for !192.168.x.x. , is this only due to known MAC-address?
Are there any open sessions on this mobile device?
It makes sense to record and analyze the traffic in more detail, as not only might someone's broken IP stack need fixing, but router logic (ROS) too.
Because that is what a router does. The only reason he got a log entry is that he apparently set up filter rules to drop traffic with wrong source address. In the default configuration this would go unnoticed.
People have this tendency to anthropomorphize the networking stack.
The packet is logged with this MAC address, because that's in the packet's header (the ethernet header part.) The packet is logged with this IP address because that's in the packet's header (the IP header part.)
It forwards it because it wasn't instructed not to. The two ways it can be thus instructed is via the firewall or with RP filtering.
Forwarding is done to the pppoe connection according to its destination, as looked up in the routing table.
Edit:
P.S. And yes, I'd really love-love-love to see per-interface rp filtering.
I specifically want to block unexpected addresses. As far as I know 0.0.0.0 is only used by DHCP, but that's captured before the firewall, yes, even the raw chain.
I'd have a talk with my network administrator if I were you. There's no legit reason for a mobile phone to try port 22 and 80 on random IPs, even less with a spoofed source IP.
Also check what funky apps you've installed on your phone, and keep it offline in airplane mode (or at least mobile data and wifi off) until you find the culprit.
