strange icmp traffic and some connection

RouterOS General
1

Hello

I have following topology: ISP — RB1 --ubnt1 ----wireless link---- ubnt2 – RB2 – clients

Today I have big strange problem. Clients have no Internet.
I can connect with RB1 and ubnt1-AP, but I cannot reach ubnt2 and RB2 in basic manner.

I can ping ubnt1 and ubnt2, but I cannot open ubnt2 with web browser to the configuration.
I can open webbrowser for ubnt1.

I cannot connect to RB2 by winbox! Reboot of this routerboard doesn’t help.

What can I notice on RB1?

I see connection beetwen RB1 (source) and RB2 (dest) by icmp and it is mark in the beggining of line by U.

I see connection from one client to some public address. It is a lot of the same connections!
I have not seen it to this time.

How can I solve this problem? It is new virus?? I create filter firewall rules and I see a growing traffic.
But I cannot still connect to RB2 and ubnt2.

Why RB1 output interface generates icmp traffic to RB2 input interface??? I cannot close it!

I have just catched “virus” traffic on tcp ports 445 and 1433-1434. But I still cannot connect to my RB2.

Please help if you have had similar experiences.

All the best

2

Anyone does not know what can generate icmp traffic from router to router??
I cannot reach RB2 and clients have no Internet, why? Until yesterday everything was good.

Today RB2 was manually rebooted but still the same.

Please help. How rules can I run on RB1 in order to find and get rid of problems?

3

In Firewall Connections I see a lot of DNS 53 udp connections with status A which are generated by clients border routers.

4

Are you using hotspot?
Are you using any DROP rule?

From where are you trying to connect?

Is everything configured with a correct gateway?

Are you using routing/bridging/wds or what?

Bring IP address of everything.

5

Thank you for you interest.

Yestarday I have solve the problem by changing IP address of RB2 router on interface connected with UBNT Nanobridge. LAN became the same settings. I have two customers in this LAN.

And today this RB2 crash again!! Symptoms ware as follows:

  1. Customer called me that he tried connect by rapidshare or upload or something like that.
  2. After some time he lost connection and called me.
  3. I connected with RB2 and after some seconds I lost connection with this routerboard.
  4. From RB1 I tried ping RB2 and first I received “timeout” and after few second “packet rejected”.
  5. Now I cannot connect with RB2. Customer disconnected his devices from cable and he disconnected RB2 from the power supply. But it does not help. Still the same.

Now LAN behind RB2 is unreachable. I can try change IP address on RB2 again. But always I will change this adress??

How can I deal with?? Maybe some clever firewall rule is needed? It is possible that today I will have to bound connection limit for this customer?

Wireless connection is implemented with UBNT bridge with very good signals. It is the same as it was half year ago. It is not problem. I use WDS bridge on wireless. Routing on RB1 and RB2.

I am using DROP rules for different goals. Do you think that it could be problem? Network some amount of time work perfectly.

I ask you very much about help.

6

I have connected laptop instead of RB2 and I have Internet!
It means that problem is located on RB2.
Half a year this network segment was working perfectly!

I am convinced that Mikrotik support knows reason of this problem…

Please help, because I have lost two routerboards :frowning: