/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
I have declare DNS 1.1.1.1
dig google.com shows as dns server the 1.1.1.1 and i am just fine with that.
Why do you need my LAN config for a firewall problem?
The ether 1 is the WAN and all the others lan ports in bridge are LAN. Not so complicated.
All the relevant info is there.
The most interesting thing is that with exactly the same config in another mikrotik machine (RB941) the 53 port is filtered in nmap scanning. The machine with the open port is RB4011. I have also take a backup and RESET configuration. With the default config is the exact SAME problem.
Also if the scanning is : nmap - Pn -p 53 the port is closed. If the scanning is nmap -sS (or -sU) -Pn -p 53 the port is open.
It gets a better overall picture on what is going on.
What other ports open/service running.
How the bridge/ports are configured.
If you post /export hide-sensitive and remove all sensitive IP, I do not see any reason for not posting your config.
At the same time post what version of RouterOS you are running on and what hardware.
Can you post some logging ? And also enable the logging for the other 3 rules below.
Then basically perform this nmap scan from exterior and post some logging ? Just to make sure these rules are effectively hit ?
Since there is for these rules no “state” flags selected (eg. new,invalid,…) I would assume ANY state would be dropped in the incoming packets, so that should not be a problem.
sudo nmap -sS -sU -sV -Pn -p 53 (from a machine outside the LAN)
Starting Nmap 7.70 ( https://nmap.org ) at 2021-04-02 19:55 EEST
Nmap scan report for ******************************
Host is up (0.0025s latency).
PORT STATE SERVICE VERSION
53/tcp open domain dnsmasq 2.79
53/udp open domain dnsmasq 2.79
MAC Address: ******************* (Unknown)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.34 seconds
Configuration looks OK. Normally you should not need to block port 53 on outside, nor should it be open by it self.
I have no linux server outside, so can not test my port.
Do you see any count increase on your firewall rule when you test port 53?
No, the counters are freeze.
I think that the whole process of nmap is not reaching the firewall rules. Have no idea why.
It is something more fundamental wrong, beneath the user configuration, maybe a security flaw.
It is not helpful. If you scan with classic nmap query “sudo nmap -sV -p 53 ”
without the -Pn then the answer is that the host seems down.
Just try a nmap scan even from a raspberry pi…Ideally in a RB4011 because another RB that i have behave normally
Did test my server with the same command as above.
nmap -sS -sU -sV -Pn -p 53 92.220.xx.yy
Starting Nmap 7.80 ( > https://nmap.org > ) at 2021-04-02 20:43 CEST
Nmap scan report for x.y.z(92.220.xx.yy)
Host is up.
PORT STATE SERVICE VERSION
53/tcp filtered domain
53/udp open|filtered domain
Service detection performed. Please report any incorrect results at > https://nmap.org/submit/ > .
Nmap done: 1 IP address (1 host up) scanned in 104.45 seconds
So from this test it looks up, but DNS does not resolve anything.
nslookup
server 92.220.xx.yy
Default server: 92.220.xx.yy
Address: 92.220.xx.yy#53 google.com
;; connection timed out; no servers could be reached
Another thing I did see, is that IP entered my block list.
I have a rule that if someone tries any port on my router that is not open, it will be blocked for 24 hour on all port, even open ports.
So this may just be some ghost errors. Do not think anything are in dangerous.
PS no need to quote the post above, use Post Reply under the post to reply to it.
Your results are different.
TCP filtered means blocked by firewall.
UDP open/filtered means no response from the server ==> blocked by firewall.
Your machine seems to work as expected.
In my 4011 when i perform the test:
The ports are open, that means that the router responds with an ACK to the SYN of the nmap. Its not false positive.
The firewall counters are not catching anything. And the rules are at the TOP. That means that something is wrong inside the routerOS that we cannot see.