how can I limit the connection to the router?

RouterOS General
1

Hello ,
wanted to know - is there any way I can limit the connection to the router using API to 5 (for example)?
meaning that only up to 5 open connection can be at the same time?

2

Hi

You can do that in firewall, using connection-limit to local ip and API port.

3

this is what I did :

add action=accept chain=input connection-limit=5,32 disabled=yes dst-port=8728 protocol=tcp

but the API is still able to connect more then 5 times and stay connected …

4

try this

<accept established / related should be before>

add action=accept chain=input connection-limit=5,32 connection-state=new dst-address-type=local dst-port=8728 protocol=tcp
add action=reject chain=input dst-address-type=local dst-port=8728 protocol=tcp

Make sure accept established & related is before these rules!!!

5

So what you want after 5 times connecting, would you like to stop processing the packets in your router?

It means no one can get access

6

One more comment:

that first rule is heavy on system. If your router is being “bombarded” by API, rate-limit the first rule to only few reqs / s.
To adjust add to first rule: " limit=1,1:packet" (== 1/s with burst of 1)

7

i understadn how to do it api
but how can I do this with spesific (unknown ) ip?
so for example
user computer is 192.168.101.1
and he want to connect into the router using putty (ssh , port 22)
I want him to be able to only open only 1 connection (1 window…)
but if user2 with ip 192.168.101.9 want to connect he can connect (also with only 1 connection)
another example :
limit l2tp connection from office to server so can make only 5 lt2p client max (in that case limit udp port 1701 to 5 connection from the same IP)

I have try this :

/ip firewall filter
add action=drop chain=input connection-limit=2,32 connection-state="" dst-port=1701 protocol=udp

but it doesn’t work - I mange to connect 5 users with the same IP
Thanks ,

8

to control you need the two rules:

  • first allows based on criteria
  • second blocks any “overflow”

If you look at doc for connection-limit:

Matches connections per address or address block up to and including given value.

9

Try this one.
Only one trying can get access. The rest of will be rejected. (until the limit expire)

add chain=input connection-state=established,related
add chain=input connection-state=new dst-address-type=local dst-port=23 limit=3/1h,0:packet protocol=tcp
add action=reject chain=input dst-address-type=local dst-port=23 protocol=tcp