Toby7
January 4, 2014, 2:37pm
1
Hello,
I am currently working on my firewall improvements. There is a PPPoE connection to my ISP. My router is configured as source nat with filter rules. Currently I have only the basic filter rules which are recommended in the book “Router OS by example”.
0 ;;; ###
chain=input action=drop connection-state=invalid
in-interface=PPPoE-TelekomDSL
1 ;;; ###
chain=forward action=drop connection-state=invalid
in-interface=PPPoE-TelekomDSL
2 ;;; ###
chain=input action=accept connection-state=established
in-interface=PPPoE-TelekomDSL
3 ;;; ###
chain=input action=drop in-interface=PPPoE-TelekomDSL
4 ;;; ###
chain=forward action=accept connection-state=new
src-address-list=Telekom Subnet in-interface=PPPoE-TelekomDSL
5 ;;; ###
chain=forward action=accept connection-state=related
in-interface=PPPoE-TelekomDSL
6 ;;; ###
chain=forward action=accept connection-state=established
in-interface=PPPoE-TelekomDSL
7 ;;; ###
chain=forward action=drop in-interface=PPPoE-TelekomDSL
To validate my settings nmap is the tool I use. So doing nmap -sT gives my this output:
PORT STATE SERVICE
Currently I don’t know where any of these open port come from? Can you help please…
Thank you
Do you have any port forwarding NAT rules?
If no, you may not be scanning the correct IP address. Is “” the address assigned to your PPPoE-TelekomDSL interface or a LAN IP?
Toby7
January 5, 2014, 2:22pm
3
No there are just the firewall → service ports enabled. I thought they should be a kind of nat helper which you better do no disable.
I used android tethering(mobile network) as internet connection for the scan. May this influence something?
In order to do more than guess, I believe we need to see
/interface print
/ip address export
/ip firewall export
/ip firewall print
/ip mangle print
/ip route print
Then tell us the IP address of your nmap machine, the physical port on the MikroTik to which your nmap machine is connected, and the actual IP that you are testing, and run your nmap again. You can replace the first two octets of any public IP address with letters so long as the letters are a one-to-one substitution for the octets they are replacing.
Toby7
January 6, 2014, 11:08pm
5
Here are the exports:
0 R ether1_fritzbox ether 1500 1598 4074 00:0C:42:C1:F9:9D
/ip address
/ip firewall export
/ip route print
0 A S 0.0.0.0/0 PPPoE-TelekomDSL 1
I think I forgot to ask for
ip address print
and your nmap command is ? nmap -sT A.B.C.14 ?
It looks like you are using routing marks. Could you show us the output of
/ip route export
Are you trying to keep address space isolated (VRF) or are you trying to do rate limits (queues)? I haven’t done much with VRFs, yet.
Toby7
January 9, 2014, 5:18pm
7
nmap command is nmap -sT as you said.
0 192.168.0.254/24 192.168.0.0 ether2_homenet
/ip route export
/ip route rule
I don’t see anything that tells me what the issue is. Are you still seeing the extra ports when you nmap your A.B.C.14 IP?
I don’t use routing-marks so it may be some side effect of that. I’m sorry but I’m out of ideas.
Toby7
January 11, 2014, 7:18pm
9
I’ll give a try again tomorrow. Normally the open ports are still visible… Hm strange if routing marks affect open firewall ports.
Toby7
January 12, 2014, 11:16pm
10
The namp -sT test now show a different result:
PORT STATE SERVICE
Less open ports but still now explanation for them… No changes were made to routing-marks etc.
Toby7
January 14, 2014, 8:02pm
11
Another input from my side. The pppoe connection is done over a Draytek Vigor 120v2 ADSL modem. Has this device something to do with the open ports?
lambert
January 24, 2014, 10:28pm
12
nmap the internal address just for fun.
CblP
January 29, 2014, 4:21pm
13
use the force of the packet sniffer, Luke!#1 tool for digging into any kind of network trouble/question.
