Filter Rule Rate Limit

RouterOS General
1

I am trying to implement a request per second rate limit for DNS requests. I am wanting to put all IPs that go over the 20 requests per second to an address list, will the following rules accomplish that?


/ip firewall filter
add action=add-src-to-address-list address-list=DNS_LIMIT address-list-timeout=\
    10m chain=forward disabled=yes dst-address=192.168.0.53 dst-limit=\
    20,20,src-address/1s dst-port=53 log=yes log-prefix=DNS_LIMIT protocol=tcp
add action=add-src-to-address-list address-list=DNS_LIMIT address-list-timeout=\
    10m chain=forward disabled=yes dst-address=192.168.0.53 dst-limit=\
    20,20,src-address/1s dst-port=53 log=yes log-prefix=DNS_LIMIT protocol=udp
2

Hey

Normally you would want to accept anything under the limit, and only add if over. So two rules:

  1. under limit → accept
    2 over → add to list

tcp based access is usually a long running connection, ex nslookup program. Less likely to occur.

3

So the above rules will behave like I want then correct? Anything above 20 per second will add to the address list?

4

The opposite:
dst-limit=20,20,src-address/1s

matches anything below that limit, so all src ips below the limit will be added to the list. The offenders will not.

Doc:
https://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Properties

Matches packets until a given rate is exceeded. Rate is defined as packets per time interval. As opposed to the limit matcher, every flow has it’s own limit. Flow is defined by mode parameter. Parameters are written in following format: count[/time],burst,mode[/expire].