Denial of Service attack

RouterOS General
1

I got hit with a DOS attack ad I tried many things to stop it. CPU was 100% with a 2meg bounce on the WAN. DOS never entered the LAN but it ran the CPU at 100% which created all sorts of delay and disconnect type issues on the LAN. The DNS cache showed the source repeating over and over.

I finally stopped it via unchecking “Allow Remote Requests” in the DNS settings. I also had to change my DHCP DNS settings in order to get my DNS working properly again. 750UP is happy again.

Just a FYI to all incase they run into this issue. Any comments are welcomed.

2

I had a similar problem. I used a filter rule.

/ip firewall filter
add chain=input dst-port=53 protocol=udp in-interface=ether1 action=drop

move X 0

Change the X to the line number of this new rule. You don’t need to move it all the way to the top of the rules, but insure there is no rule above this one that would allow that.

If ether1 is not your WAN interface, change that too.

3

tnx