Hi
I am running two mikrotik routers at different sites, on the one I managed to drop the DNS from the WAN side and cant see port 53 if I use a port scanner from the outside.
But on my own one the rules don’t want to take, I do how ever have a hotspot here and I think I made a mess off the original config. Below are my firewall rules if some one can please tell me what i must change.
I keep on getting hammered on the DNS to the point that my router stops responding to requests.
I have tried to make in interface Ethernet 1 or pppoe which i use
lags: X - disabled, I - invalid, D - dynamic
0 chain=forward action=drop protocol=tcp in-interface=ether1-gateway
port=53 log=no log-prefix=“”
1 chain=forward action=drop protocol=udp in-interface=ether1-gateway
port=53 log=no log-prefix=“”
2 D chain=forward action=jump jump-target=hs-unauth hotspot=from-client,!aut>
log=no log-prefix=“”
3 D chain=forward action=jump jump-target=hs-unauth-to
hotspot=to-client,!auth log=no log-prefix=“”
4 D chain=input action=jump jump-target=hs-input hotspot=from-client log=no
log-prefix=“”
5 D chain=input action=drop protocol=tcp hotspot=!from-client
dst-port=64872-64875 log=no log-prefix=“”
6 D chain=hs-input action=jump jump-target=pre-hs-input log=no log-prefix=“”
7 D chain=hs-input action=accept protocol=udp dst-port=64872 log=no
log-prefix=“”
8 D chain=hs-input action=accept protocol=tcp dst-port=64872-64875 log=no
log-prefix=“”
9 D chain=hs-input action=jump jump-target=hs-unauth hotspot=!auth log=no
log-prefix=“”
10 D chain=hs-unauth action=reject reject-with=tcp-reset protocol=tcp log=no
log-prefix=“”
11 D chain=hs-unauth action=reject reject-with=icmp-net-prohibited log=no
log-prefix=“”
12 D chain=hs-unauth-to action=reject reject-with=icmp-host-prohibited log=no
log-prefix=“”
13 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough log=no log-prefix=“”
14 ;;; default configuration
chain=input action=accept protocol=icmp log=no log-prefix=“”
15 ;;; default configuration
chain=input action=accept connection-state=established log=no
log-prefix=“”
16 ;;; default configuration
chain=input action=accept connection-state=related log=no log-prefix=“”
17 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway log=no
log-prefix=“”
18 ;;; default configuration
chain=forward action=accept connection-state=established log=no
log-prefix=“”
19 ;;; default configuration
chain=forward action=accept connection-state=related log=no
log-prefix=“”
20 ;;; default configuration
chain=forward action=drop connection-state=invalid log=no log-prefix=“”