I’m new to Mikrotik and identified a slow and laggy network reported by multiple users. I was able to identify that most of my bandwidth was being “hogged” on the WAN port. What’s odd is that this bandwidth usage seems to be coming directly from the router and not any of the 10s of servers set up behind the network because theoretically I would assume (as I understand it) that the values on the bridges that all servers are behind would match out the output.
How can I identify what may be causing this? Has anyone experienced something like this?
Maybe I’m just thinking and reviewing the information incorrectly. Screenshot below for reference.
Hi, please share the output of a “/export hide-sensitive” (if ROS 6.x) ot “/export” (if ROS 7.x) command so we can have a better understanding of what could be happening.
My guess: missing/wrong firewall rules and dns open to public or proxy enabled and open to public.
Indeed. Your DNS server accepts remote requests (doesn’t matter where client is located) and your firewall is a piece of …, it doesn’t block any traffic whatsoever … neither from internet towards LAN nor towards router itself. So it’s easily used as part of (D)DoS amplification attack.
I guess that RB1100 doesn’t come with default config … so here’s default firewall config for SoHo devices (and it’s a good starting point for other as well):
/interface list add name=WAN comment="defconf"
/interface list add name=LAN comment="defconf"
/interface list member add list=LAN interface=bridge comment="defconf"
/interface list member add list=WAN interface=ether1 comment="defconf"
/ip firewall nat add chain=srcnat out-interface-list=WAN ipsec-policy=out,none action=masquerade comment="defconf: masquerade"
/ip firewall {
filter add chain=input action=accept connection-state=established,related,untracked comment="defconf: accept established,related,untracked"
filter add chain=input action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
filter add chain=input action=accept dst-address=127.0.0.1 comment="defconf: accept to local loopback (for CAPsMAN)"
filter add chain=input action=drop in-interface-list=!LAN comment="defconf: drop all not coming from LAN"
filter add chain=forward action=accept ipsec-policy=in,ipsec comment="defconf: accept in ipsec policy"
filter add chain=forward action=accept ipsec-policy=out,ipsec comment="defconf: accept out ipsec policy"
filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept established,related, untracked"
filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop all from WAN not DSTNATed"
}
Adjust the interface list membership to what you need (SoHo default uses ether1 as WAN interface, the rest of ports are members of bridge and used as LAN), the rest of firewall will probably fit your needs just fine. The only exception being hair-pin NAT you have, you might need to alter it a bit.
Disabling remote requests will block also requests from your LAN clients (so if DHCP server settings instruct them to use your RB1100 as DNS server, they will suffer) - this then means that DNS server on RB will only serve for it’s own needs (e.g. resolving upgrade.mikrotik.com or some such). Configuring firewall (specially chain=input) will block connections from WAN but still alow LAN clients to use the service. Similarly for other services (e.g. WebFig or SSH or WinBox). So definitely do something about firewall.
