how can i block this traffic to dst. port 445
use this rule for router users:
‘ip firewall filter add action=drop chain=forward dst-port=445 protocol=tcp’
well i have thi rule but i still when i dotorch i see such traffic on that ip. also i user arp reply-only and when i disable the mac address of that ip in the arp list i still see this upload traffic also i have limits through pcq to the costumers and this ip have a limit of 32kbit upload but i see about 64 to 80 kbits traffic from this user. how could i solve this problem
your first question was about dropping 445 port, check if there no accept rule before drop one.
give more information about queue configuration!
I think Torch shows even dropped connections. Set rule to write to log and check in log if it actualy works.
well in the log i see the packet being dropped. but in the torch i still see this traffic. could this affect other costumers.the problem is even i blocked his mac addess in the arp i still see this upload traffic while the down traffic is 0
Wel, if log says its dropped it is dropped.I also find it rather confusing that Torch and some other tools still show such connections.
’
Torch intercepts traffic before it is denied.
Regarding ARP, you didnt block anything. You just stopped your router from resolving his mac address. It could potentially prevent him from download although that is fairly simple to go around. He will stop uploading when you block the undesired traffic on his side of the link.