Per connection limit per time interval with burst on Mikroti

RouterOS General
1

Hello, i’m moving from a FreeBSD-based router to a RouterBoard. I’m currently on 6.0rc11

I’ve been trying to implement anti-ddos protection for my servers, but I can’t quite figure it out. Is there a way to mimic this set of PF rules?:

anti ddos from 80 port

table persist
block in quick from

pass in quick on $AFF proto tcp from any to 81.200.12.10 port 80 keep state
(> max-src-conn 70, max-src-conn-rate 40/5> , overload flush)

pass in quick on vlan500 proto tcp from any to 81.200.12.10 port 80 keep state
(> max-src-conn 70, max-src-conn-rate 40/5> , overload flush)

To my current understanding, Mikrotik cannot do that (connlimit per time interval per ip and with burst)?

2

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Filter
Read about ‘dst-limit’ matcher.

HTH,

3

I read about it, but it does not solve my problem since it doesn’t differentiate between separate source IPs. I mean it doesn’t support a separate counter for each source IP, it’s a global counter.
And also it limits packets per time interval, not connections per time interval (although I could workaround it with tracking SYNs).

4

If you set limit by src and dest then it will.

5

hm, do I understand this correctly, that this rule:

add action=jump chain=forward connection-state=new dst-port=80 jump-target=anti-ddos protocol=tcp
add action=return chain=anti-ddos dst-limit=40/5s,70,src-and-dst-addresses/1h

will match from a single IP up to 70 new connections (burst) and then 40 new connections in the interval of 5 seconds. The pair src-addr/dst-addr expires in 1 hour (I don’t really understand what happens after it expires).
Will this work as I describe?

6

IMHO it should be:
add action=jump chain=forward connection-state=new dst-port=80 jump-target=anti-ddos protocol=tcp
add action=return chain=anti-ddos dst-limit=40/5s,70,src-and-dst-addresses/1h
add action=drop chain=anti-ddosLine 2 allows up to 40 new connections in the interval of 5 seconds, line 3 explicitly drops packets if number of new connections is above 40/5s.
This post should be also useful for you in case of DDoS attack.

The pair src-addr/dst-addr expires in 1 hour (I don’t really understand what happens after it expires).

All counters for this particular src-addr/dst-addr pair are deleted and measurement starts from beginning.

HTH,