firewall action=log not working with certain ports

RouterOS Beginner Basics
1

Hello everyone,

I’m trying to log SSH portscan attempts. When I enable rule 2, I can SSH into my router from anywhere. So it appears my ISP is not blocking port 22.
Although my log rule works fine with many ports, it does not seem to work with ports 900, 22, 700,… Any idea why it (rule 9) does not fire for specific ports like port 22? I’m using this online port scanner to generate traffic http://www.yougetsignal.com/tools/open-ports/

Flags: X - disabled, I - invalid, D - dynamic
 0   ;;; Drop invalid connections
     chain=input action=drop connection-state=invalid

 1 X ;;; Enable to allow pinging the router
     chain=input action=accept protocol=icmp

 2 X ;;; Enable to allow ssh to the router on port 22
     chain=input action=accept protocol=tcp dst-port=22

 3   ;;; Allow established connections
     chain=input action=accept connection-state=established

 4   ;;; Allow internal LAN to connect to the router (required for DNS!)
     chain=input action=accept src-address=192.168.0.0/24 in-interface=!WAN


 9  chain=input action=log protocol=tcp dst-port=22 log-prefix=""

10   ;;; Drop everything that is not previously allowed
     chain=input action=drop

Thanks for thinking with me on this one!

cheers,
Jeroen

2

The problem is your log rules must be placed before accept or drop rules. Try to place rule 9 before rule 2.

3

Thanks otgooneo but for some reason that does not work either.

Note rule 2 is disabled so the log rule at position 9 should work for port 22. If I keep the rule where it is at position 9, it will work for port 7000 for instance, but not for port 100. It will work for port 30000 but not for port 60000. That why I having trouble figuring out what is wrong.

4

It appears the test websites don’t work well for every port. Normal SSH login attempts do appear to register.
Weird. Perhaps anybody can reproduce?