with this creating dynamic ip’s..to stop dos attacks…and if you use Mr. Chupaka formula here… what firewall rule is used to allow your dns to still work so customers can still get to the internet …thank you for your time…
/ip firewall filter
add action=jump chain=forward comment=Detect-Ddos connection-state=new
disabled=no in-interface=ether1 jump-target=detect-ddos
add action=return chain=detect-ddos comment=DOS-Exceptions disabled=no
src-address-list=DOS-Exceptions
add action=return chain=detect-ddos comment=Detect-Ddos disabled=no
dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=
1w chain=detect-ddos comment=Detect-Ddos disabled=no
add action=add-src-to-address-list address-list=ddoser address-list-timeout=
1w chain=detect-ddos comment=Detect-Ddos disabled=no
add action=drop chain=forward comment=Detect-Ddos connection-state=new
disabled=no dst-address-list=ddosed src-address-list=ddoser
is this the correct way?
add address=10.0.0.0/8 list=DNS_Accept
add address=192.168.0.0/16 list=DNS_Accept
add action=jump chain=forward comment=“DoS Attack 1” connection-state=new
disabled=yes jump-target=detect-ddos
add action=return chain=detect-ddos comment=“DoS Attack 2” disabled=yes
dst-limit=1,5,dst-address src-address-list=DNS_Accept
add action=return chain=detect-ddos comment=“DoS Attack 3” disabled=yes
dst-limit=1,5,dst-address src-address-list=DNS_Accept
add action=return chain=detect-ddos comment=“DoS Attack 4” disabled=yes
dst-limit=1,5,dst-address src-address=192.168.0.0/16
add action=return chain=detect-ddos comment=“DoS Attack 5” disabled=yes
dst-limit=1,5,dst-address src-address=10.0.0.0/8
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=
10s chain=detect-ddos comment=“DoS Attack 8” disabled=yes
add action=add-src-to-address-list address-list=ddoser address-list-timeout=
10s chain=detect-ddos comment=“DoS Attack 9” disabled=yes
add action=drop chain=forward comment=“DoS Attack 10” connection-state=new
disabled=yes dst-address-list=ddosed src-address-list=ddoser
I need a pro’s advice…is or will this help me and my 8 customers from being attacked and still all of us be able to surf the web…thank you for your time