I guess my router is being attacked, am I protected?

RouterOS General
1

OK so my main router that connects to my upstream provider is getting a ton of attention right now. I have a firewall rule that throws IP’s into an address list whenever someone attempts to telnet, ssh, or ftp into the input chain of that router. It stores these IP’s for 7 days and drops any and all traffic from these IP’s for the 7 days. As of right now that address list is 35,000 and growing! Its not bothering the router, CPU is around 10-15%.

So I decided to start logging their activity to see what they are trying to do and I’m being flooded by IP’s trying to telnet into the subnet ID, not the IP of the router itself. Is that even possible? Lets assume that router has an IP of 1.1.1.1/24, they are telnetting into 1.1.1.0.

Telnet is not even enabled in the services, but this router also protects other routers down the line, do I need something to protect the subnet ID’s of those other routers?

2

They dont know that .0 is the subnet ID, that is just because you are using a /24 subnet.
If you use a /16 subnet there are plenty of proper hosts ending in .0

Regarding aditional protection, that depends on your topology. If the routers down the line all have public IDs, then they should be firewalled themselves, but you can also implement additional security on the gateway in the forward chain.