OK bit of info first
I have a Static IP address from my ISP (WISP routed network)
Router is Mikrotik RB2011uias running 6.30.2 firmware
DHCP Client on ether 10
DHCP client on ether 8 as secondary internet connection (if primary fails i hookup a backup connection to ether 8 but usually nothing connected)
ether 1-3 on bridge for internal network
Ok now to whats happening.
I have noticed a slowdown in my internet lately and decided to poke around and see which one of my kids is Netflix-ing while im trying to work I notice that my outbound connection on the router (ether 10) is TX at 15Mbps almost constant. I fire up “The Dude” (which i started mapping my internal network out but never finished) and saw the same thing on the outbound of 15Mbps for days constant.
Ok rogue computer on the network? NOPE I have good wifi password policy (wife hates it)
Virus? Nope mostly Macs and only my managed PC on the network but to be certain i will UNHOOK the ether cables from my switch one by one till i find that bastard!
Last cable unhooked and still uploading, I went as far as unhooking EVERYTHING from EVERY port except ether10 (my dhcp client) so there is NOTHING else hooked up, no wifi, no switch, nothing but the cable from the internet. STILL UPLOADING 15Mbps
How do i know if nothing is hooked up? went to wisp and they of course log data via “The Dude” so i could see the data screaming out of my router @ 15Mbps. I unplug from ether10 and the data stops
plug into ether8 (my backup internet port) and its normal (just whatever data i use) I have lost my static IP (Static IP was routed to the DHCP that was given to ether10 and ether8 got a different DHCP address)
So my question is how or why is my router UPLOADING at such a rate? (Yes my router has a GOOD password) The log shows only about 5 login failures for the last 24hrs and i’m running only 1 script, a ssh blacklist that has about 50 ip addresses. Where to go from here?
Sounds like a DNS amplification attack is being ran off your router. Is TCP/UDP port 53 open to the outside world? Sounds like you need to reevaluate your firewall rules.
Guess i should have went to GRC Shields up to check this out first. port 53 showed open
Thanks bds1904, That was exactually it! I checked the firewall and i did NOT have it open to anything but for an unknown reason under system>DNS>allow-remote-requests: yes…GGGRRRRRRR
Change to.. allow-remote-requests: no
If you try these rules please enable the last rule only when you know that your LAN addresses are correctly configured in 3rd rule!
Otherwise you will be disconnected from administration
Your fw rules are crap and dont really do much."
You would be far better off and safer with the default rules.
The reason why your firewall rules didnt protect you from DNS exposure, it was not your DNS rules… it was the lack of basic firewall protection.
For example this is disabled.
add action=drop chain=input comment=“Drop anything else! # DO NOT ENABLE THIS RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED”
disabled=yes
Therefore anything you didnt block at the input chain would be allowed to access the router.
However, you shouldnt enable this rule until you actually construct a firewall address list that would be used in this rule…
add action=drop chain=input
comment=“Block all access to the winbox - except to support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUPPORT ADDRESS LIST”
disabled=yes dst-port=8291 protocol=tcp src-address-list=!support
The above is also disabled but I wouldnt touch this rule because you will block far more than you desire if enabled.
Summary: You have no clue what the rules are doing. Get rid of all the garbage and reinstate the default firewall rules and then build slowly things that actually work.
I notice that my outbound connection on the router (ether 10) is TX at 15Mbps almost constant. I fire up “The Dude” (which i started mapping my internal network out but never finished) and saw the same thing on the outbound of 15Mbps for days constant.
