Hello
I want set connection limit because a lot of people have a viruses or use p2p programs.
How I can set connection limit for dst address?
http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter#Properties
connection-limit (integer,netmask; Default: ) Restrict connection limit per address or address block
However, what you’re showing in your screenshot is in no way indicative of a problem. That would be a fairly small and compact web site pulling in content from a couple of resources. Any web page with a few pictures, CSS files, and JS files would look that way in connection tracking.
/ip firewall filter add chain=forward src-address=(“192.168.1.2”) protocol=tcp connection-limit=80,32 action=drop tcp-flags=syn disabled=no
This is good?
How I can limit all connections (with UDP)?
I look that “connection-limit” counts adres ip with different ports even as new connection.
I’m not sure I understand the question. connection-limit counts the number of connections sourced by an IP address as determined by the netmask fed to the function. 80/32 means “80 total connections per host”. 1000/24 means “1000 total connections for the /24 the host is in”.
So this line limit all connection per adres ip 192.168.1.2
/ip firewall filter add chain=forward src-address=(192.168.1.2/32) connection-limit=100,32 action=drop disabled=no
That line drops all new connections through the router (not to the router) from 192.168.1.2 while that host has more than 100 concurrent connections open. Once it has less than 100 connections open new ones will be permitted again. That said, “src-address=(192.168.1.2/32)” cannot contain parantheses, and the /32 is superfluous since a missing netmask is interpreted as a host IP. Therefore that part should be “src-address=192.168.1.2”.