RB2011UAS-2HnD Will not Idle Seems to be constantly download

RouterOS Beginner Basics
1

Hi,

It seems that my RB2011UAS-2HnD is constantly downloading something but I don’t think it really is, almost like if something is looping repeatedly. I first noticed my internet speeds were frustratingly slow so I logged into my RB2011 using Winbox and checked the interfaces and ether1(WAN) is constantly busy doing something even when I unplug all cables except the one I use to connect to the router ether5. Than I thought may be my wireless might be hi jacked but as you can see in the screenshot that it is disabled.

What could cause this problem?

Not sure if its relevant as I am still somewhat new to Mikrotik but I did recently upgrade to v6.1 just a few days ago.

Any Help Would Be Great! Thank You!!
RB2011 Interfaces.JPG

2

Secure the services on your router, someone is probably using your router as a DNS server.

Setup your firewall input chain and protect your router…

3

Thanks for the Reply

How do I go about securing it? Just by putting in a username and password for the router settings?

4

And how would I check to make sure if some one is using my router as a dns server

5

Use torch on the interface and see what traffic is there.
If the destination is your public IP on port 53, then someone is abusing the DNS server in your router.

As for firewall, easies is this:

/ip firewall filter
add chain=input comment="Input chain" connection-state=established
add chain=input connection-state=related
add chain=input connection-state=invalid action=drop
add chain=input protocol=icmp
# change this to your LAN interface
add chain=input in-interface="br0 - LAN"
add action=log chain=input disabled=yes log-prefix=Drop
add action=drop chain=input
6

some one using my router as DNS server also what i did is simply dropped all DNS traffic from wan side
try this rule

/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=tcp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp

please award karma point if this helped you
Thanks

7

Thanks for the great advice, but after watching my system yesterday using the torch method in winbox, I never did see my public ip dst with port 53. I did however see a lot of other ports listed with my public ip when I was downloading from various sites just test it out. (Great Little feature I didn’t know was built in routerOS :smiley: Thanks!!). I am assuming this is normal?

I also noticed that it wasn’t as busy now, my internet speeds are pretty much back to normal again. Even tho I haven’t implemented any of the firewall rules yet as I wanted to know if some one was using it. Could it be something else possibly and only doing it randomly? But I think I will implement your guys suggestions about the firewall rules regardless just to be safer.

Thanks again for taking the time to help me on this, I’m learning a great deal about how advanced Mikrotik’s RouterOS is, even with limited brain capacity :wink:.