i use a firewall rule to detect flooders and even on drop chian the cpu goes up
i need to run script block dhcp ip lease and make binding and block mac on detection
manual blocking can not prevent this as the attacker can change mac to proceed
HOW TO RUN A SCRIPT ON EVENT FIREWALL LIST ADD ?
or how to script
ip hotspot host make-binding type=blocked
from
/ip firewall address-list
???
no help so far
the only thing i was able to do
{
:local x [/ip firewall address-list find list=“doser” get $j address]
ip hotspot ip-binding add address=$x type=blocked
}
On rule detect the flood and add the address to the list detected. Then your script moves the IP to the list to block if is serious enough.
An other rule uses the block address list to block the flooders.
how to move the ip from firewall address list and store it in a variable then block it in ip hotspot ip-binding ??
goooooooooooot it
{
:local x
:foreach i in=[/ip firewall address-list find list=“flooder-list”] do={
:set x [/ip firewall address-list get value-name=address $i]
ip hotspot ip-binding add address=$x type=blocked
}}
firewall rule for detection
add action=add-src-to-address-list address-list=flooder-list
address-list-timeout=5m chain=pre-hs-input comment=“flood detect”
connection-limit=300,32 log=yes log-prefix=flooder protocol=tcp
THANKS YOU ALL
I have the following situation:
Hotspot> walled garden> allow facebook
Client connects to the network and checks in
There are cases that do not checkin and you can use the
Facebook normally.
I created the script:
/ Ip hotspot host [find authorized = no]
Which removes unauthorized customers, only that they return
then.
I want to put these users on an address list
With time blocking, does anyone have something like this or a tip?