Hi Friends of the forum, I am having a persistent problem with icmp in one of the public interfaces in my RB, as shown in the attached image, the problem I tried to block the segment but it does not work, could you please help me .. .. Thank you!
Which rules you used to try block the icmp attack?
Also, what is the destination of that? To router (input)? To some client (forward)?
Try using rules in icmp chain of basic firewall script.
https://wiki.mikrotik.com/wiki/Basic_universal_firewall_script
Adjust the jump rule to input or forward, according of the issue.
Sent from my iPhone using Tapatalk
Thanks for the help, I have the basic blocking rules, but as seen in the image it consumes the full bandwidth (10mb) and fails to block them, it does not even detect them. But by ping me from the internet if I block it
By creating these blocking rules you actually preventing responses to those requests (you see it is working since there is no Tx flow on your interface). But it will never block incoming traffic hitting and saturating your incoming interface, which is physically impossible, and there is nothing YOU can do.
An option could be to use reject instead of drop so that the attacker gets a “host unreachable” or “network unreachable” response and maybe stop. Maybe. But this will probably only create uplink traffic from your side and nothing more…
Filtering incoming packets not to reach your device can only be done by your upstream provider. Maybe it is time to get in contact with them to jointly solve this problem.
Thanks for your comments, finally resolved by making a rule in raw, in prerouting, as it appears in the attached image. regards
