1-add the rule in the new terminal
2-edit this rule by yourself
3-remove all IPs from address list
4-try to run Net Cut to find if the Microtik detected it or not
first,add this code in the new terminal
/ip firewall filter
add action=reject chain=forward comment=“Reject if in the 24-hour-list” disabled=no reject-with=icmp-network-unreachable src-address-list=24-hour-list
add action=jump chain=forward comment=“Check if dest is an open customer” disabled=no dst-address-list=open-customers jump-target=open-customers
add action=jump chain=forward comment=“Check Known Bad Hosts” disabled=no jump-target=bad-hosts
add action=reject chain=forward comment=“Reject if in the 24-hour-list” disabled=no reject-with=icmp-network-unreachable src-address-list=24-hour-list
add action=return chain=bad-host-detection comment=“Take no action on bogons” disabled=no src-address-list=bogons
add action=add-src-to-address-list address-list=30-seond-list address-list-timeout=30s chain=bad-host-detection comment=“Add to the 30 second list” disabled=no
add action=add-src-to-address-list address-list=24-hour-list address-list-timeout=“1d 00:00:00” chain=bad-host-detection comment=“If seen 20 time in 30 seconds add to the one day block list” disabled=no nth=50 src-address-list=30-seond-list
add action=return chain=bad-host-detection comment=“” disabled=no
add action=jump chain=forward comment=“jump to the bad-host-detection chain” disabled=no jump-target=bad-host-detection src-address-list=!our-networks
add action=jump chain=forward comment=“jump to the bad-host-detection chain” disabled=no jump-target=bad-host-detection src-address-list=!our-networks
add action=log chain=forward comment=“log and reject the rest” disabled=no log-prefix=“”
add action=reject chain=forward comment=“” disabled=no reject-with=icmp-network-unreachable
2-follow the next pic to edit this rule
But change 192.168.0.0/24 to your network IP
3-remove all IPs from the network like this pic
4-try to run Net Cut
After 10 seconds you will see the IP in the “30 seconds list”
After 10 seconds you will see the IP in the “24 list”
As you see the Microtik catch the IP he run net cut
Now if we could only redirect browser traffic to a page saying:
“We have detected Netcut or Arp tool running in your system. Thus we have blocked your traffic for XXseconds. Please unistall to avoid further inconviencies”
i have already setup my mikrotik server v (5.7)
and i used the fake gateway to perevent the netcut
but there is a strange thing happened :
when i open the netcut on my PC
i found a many numbers of IPs ( unlimited numbers ) is this a type of hacking or what >?!
here is the PIC
I’m running v4.6 and when I add the code via the terminal I get an error with this piece of code:
add action=add-src-to-address-list address-list=24-hour-list address-list-timeout="1d 00:00:00" chain=bad-host-detection comment="If seen 20 time in 30 seconds add to the one day block list" disabled=no nth=50 src-address-list=30-seond-list
Error: failure: nth_every and nth_packet must be >= 0
Does anyone know what that means and how to fix it?
use that additional security as required. I really doubt that “smart-guys” are all over the network. And yes, it is only way how to protect the network from them as there is no way around it other but brake the encryption.
