I have a lot of messages denied winbox/dude connect from ... in my logs. Connections to winbox are available only from some my ips. If I remove this rule and allow to connect from any ip to winbox this messages are disappearing. Also there are no logs like “login failure for user ** from ** via winbox”. What could it be? Any kind of brute? If somebody try to brute my mikrotik I should get messages “login failure for user ** from ** via winbox” but there is no one.
Hi
Doy you have any filter in ip-> services?
M.
Yes, connections to winbox allowed only from my ip. Other types of connections also allowed only from my ip.
This is normal , you see this logs in blue, I recomend you to filter winbox or other services via filter or raw
Yes, I know, but if I remove this filter I should get messages like “login failure for user *** from *** via winbox” (I tried to login with wrong data and I get this message). But I don’t get this messages instead “denied winbox/dude connect”. I would like to know which logins are using to connect to my mikrotik.
I would assume that on top of the firewall rule (which you have disabled), there is also an address field set in the /ip service table, and the request comes from an address which is not on this list. This is just a rewording of what @markos222 originally suggested.
No, there is no such rule.