I have an ADSL Modem in bridged mode and then my mikrotik connects to it and does 2 PPPoe Connections out, one to my ISP and one for my VPN connection, ontop of the pppoe vpn connection I have a ppptp connection to establish a tunnel between me and the other end.
My problem is that for some reason In getting a lot of traffic comming into my router from outside. It does not enter my LAN, just get inot the PPPoe connection for my internet. The traffic is between 400-800kbps, not that much, but its only on my PPPoe ISP connection, dont go throuh the router. While that traffic is so much, my internet is extremely slow to unresponsive, this happens randomly. We used to have it alot at work and I then just add a firewall blocked rule to block it, that method does not work for me at home. I fllowed some online tutorials and added a lot of firewall rules to block all kinds of random stuff from outside, even with that it is not having a effect on the incomming traffic to the isp account.
I need to be able to block all access to my router from outside completely no exeptions
Here is a bunch of rules that I added:
/ip firewall filter
add action=drop chain=input in-interface=ISP1
add action=add-src-to-address-list address-list=Syn_Flooder address-list-timeout=30m chain=input
comment=“Add Syn Flood IP to the list” connection-limit=30,32 disabled=no protocol=tcp tcp-flags=syn
add action=drop chain=input comment=“Drop to syn flood list” disabled=no src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner address-list-timeout=1w chain=input comment=“Port Scanner Detect”
disabled=no protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment=“Drop to port scan list” disabled=no src-address-list=Port_Scanner
add action=jump chain=input comment=“Jump for icmp input flow” disabled=no jump-target=ICMP protocol=icmp
add action=drop chain=input
comment=“Block all access to the winbox - except to support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT ADDRESS LIST”
disabled=yes dst-port=8291 protocol=tcp src-address-list=!support
add action=jump chain=forward comment=“Jump for icmp forward flow” disabled=no jump-target=ICMP protocol=icmp
add action=drop chain=forward comment=“Drop to bogon list” disabled=no dst-address-list=bogons
add action=add-src-to-address-list address-list=spammers address-list-timeout=3h chain=forward comment=“Add Spammers to the list for 3 hours”
connection-limit=30,32 disabled=no dst-port=25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment=“Avoid spammers action” disabled=no dst-port=25,587 protocol=tcp src-address-list=spammers
add action=accept chain=input comment=“Accept DNS - UDP” disabled=no port=53 protocol=udp
add action=accept chain=input comment=“Accept DNS - TCP” disabled=no port=53 protocol=tcp
add action=accept chain=input comment=“Accept to established connections” connection-state=established
disabled=no
add action=accept chain=input comment=“Accept to related connections” connection-state=related disabled=no
add action=accept chain=input comment=“Full access to SUPPORT address list” disabled=no src-address-list=support
add action=drop chain=input comment=“Drop anything else! # DO NOT ENABLE THIS RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED”
disabled=yes
add action=accept chain=ICMP comment=“Echo request - Avoiding Ping Flood” disabled=no icmp-options=8:0 limit=1,5 protocol=icmp
add action=accept chain=ICMP comment=“Echo reply” disabled=no icmp-options=0:0 protocol=icmp
add action=accept chain=ICMP comment=“Time Exceeded” disabled=no icmp-options=11:0 protocol=icmp
add action=accept chain=ICMP comment=“Destination unreachable” disabled=no icmp-options=3:0-1 protocol=icmp
add action=accept chain=ICMP comment=PMTUD disabled=no icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment=“Drop to the other ICMPs” disabled=no protocol=icmp
add action=jump chain=output comment=“Jump for icmp output” disabled=no jump-target=ICMP protocol=icmp
I’m confused. You can’t block traffic to your router before the router. If you want to stop it before it gets to you your isp will have to block it. You can only drop the traffic once it arrives
agree, if the in coming traffic fills you uplink it doesn’t matter whether you drop it on the router. try to find out what kind of traffic you’re getting and why you are getting it. an attack? was there a open dns server running and someone is abusing it for a dns amplification attack? once you know it talk to your upstream isp. the isp might be able to drop it for you or give you a new ip address.
For example, if I look at my Interfaces, my ISP interface shows under tx the traffic, none of my other interfaces shows the traffic, looks like it goes just to the ISP Connection. It seems like some kind of attack as it comes in bursts and the router shows the traffic coming from ‘eth protocol 800(ip)’ and ‘Internet IP:443 and 80’ to my routers ‘public ip’, the ip is dynamic so it changes.
All the while it stays so high my internet connection is dead slow.
As for the open DNS server, I have nothing running on my router that has to be able to be accessed from the outside.
Im not very good at explaining this. I spoke tomy ISP awhile back and they asked me to provide them with an IP thats causing the problems, but it is never the same, they keep changing to net ones, not even the same type of ip, some for example starts with 197.242.x.x other from 87.230.x.x other from 112.209.x.x.
With Torch, thats where I get all my info. Its mostly https traffic. Funny thing is I changed my ISP account to a different account but on the same ISP, still the same problem, If I look at the interfaces, theres only traffic on my bridged and ISP interface and my wifi where im connecting from, the rest stands on 0.
At this moment theres no problem, the network is quiet as you can see, I anyway took a screenshot and will do again when the traffic starts jumping again. Just to show you how I scan. Unlike normal traffic that fluxuates, this problem traffic stays more or less solid at a high speed. and I can see that its not coming fromt he LAN.
Last night I switched to my Capped Internet Account, Same ISP to get a different IP, didnt check, but I assume it would. Still I had the same traffic problem, I can see High Traffic on the PPPoE Interface and the ISP1 PPPoE Account. The other interfaces exept for my Wifi Router’s Interface had 0bs traffic. The Wifi had very low, like 20-40kbps while the ISP had between 400-800kbps. Web pages even was crawling slow
A Thought just came to me that may be preventing my firewall rules from working, I dont know if it will have an effect. I had the router setup with 2 ADSL Accounts and 2 LANs (Capped + Uncapped) awhile ago and the mark routing is still on the router, maybe I must just add a mark to the rules?, I am going to setup those settings again once I sorted out this problem.
