i think i am hacked, my NAT goes down automatically

RouterOS Scripting
1

Hello friends.

i have a small network with SXT, OmniTIk and some UBNT antennas.

before 1 week my network it was down. when i entered with winbox i saw that PPPOE client or server was disable..
and NAT (masquarade) too.

this situation was in all my antenas, SXT, and OmniTik.(pppoe and nat was disable)

i changed the password because i thought it was a hacking.

I am right or it is something wrong with my network.

my antenas is 3 years old so i just updated some times nothing change or edit..

Thanks mate

2

Look in the log and see if somebody has accessed the system.

3

Look also:

  1. if someone has added scheduled jobs or netwatch event to disable something, reset password, add users, etc.

  2. if you have some radius on radius list and on routerboard users “use radius” is active… (nothing to do to hotspot or ppp users)

  3. if on system / users are present other users than your administrative accout.

4

CelticComms

I can not see my log because when i saw that problem it wat 7:30 AM and in 4:00 my antenas automatically reboot.(scheduler) and it was clear all my logs.

Do you know how to save logs and before reboot send them by email or IP (lan)…

Thanks

5

rextended

i didn’t change anything from 2011 year.
i just updated some times and anything else. i have changed my pass and i made it 12 irregular text…

i am looking now to save my logs and my activity on my antennas and send them by email or IP(lan) but till now nothing…

Do you know how to do that..

Thanks mate :slight_smile:

6

Set logging to disk. Then you can send log files easily.

7

disable other services

8

You can also log online to remote syslog server or to local disk. Then the logs survive reboot.