how to block kama sutra?

RouterOS General
1

hi guys
it seems that my network connection tracking is few thousands which is weird from IPs doesn’t exist on network to the server and it is slowing the server badly

thanks

2

make allowed IP list, block everything else, make firewall rule that allows only like 20 connections from each IP.

3

thanks for the fast reply
any firewall rule sample please?

4 
/ip firewall filter add chain=forward protocol=tcp tcp-flags=syn connection-limit=10,32 action=drop

this will limit each IP to 10 connections

http://www.mikrotik.com/docs/ros/2.9/ip/filter.content#6.38.3.1

there are some other examples

5

In general, is it good to limit the number of connections from one IP to a certain amount? I know some http sites create multiple connections at one time. Is there a good number to use? We have had issues with maybe a hundred connections at a time being generated by customers who happen to get infected with something and it affects our overall wireless network operation.

6

I use 80 without complaints, but started at 100 connections per/IP.

7

Does this work the same in pre 2.9 versions?

8

in v 2.8.28 this is the rule I use:

/ip firewall rule forward add protocol=tcp tcp-options=syn-only connection-limit=80 action=drop

9

Ok.. Just attempted this on a router. Here is the network topology on this particular network segment:

weeds → narnia → core router

On the narnia router, I have 6 ethernet ports. If I apply the rule above, is it not going to restrict to x number of connections the interface that has the backhaul to the weeds site thus slowing that site down when it exceeds the x number of connections set in the rule? I am running PPPoE on weeds and narnia so I can’t just restrict the rule to a specific interface that an AP sits on because then the PPPoE interfaces won’t get restricted and usually it is those customers that cause us problems. I could add to the rule but my link to the core router is also going to get restricted to x number of connections. Am I reading this all wrong? Is the rule restricting by interface or by IP?

10

oh wow! Just did this on another router and BOOM, got someone immediately with about 3 or 4 worms/virii on their system.

11

from Eugene in previous threads discussing connection limits:

Every computer can make no more than 80 TCP connections through the router.

I had problems with hundreds of connections,captured after using this rule and none exceeds the value 80.