I’m setting up a RB951-2n as a router with Ether1 as the WAN port and each of the other Ethernet ports as separate LANS (i.e. Ether2 is 192.168.2.0/24, Ether3 is 192.168.3.0/24 and so on). Separate DHCP servers are defined for each ethernet port. Have configured NAT and set up standard firewall rules.
It seems to work ok (have only tested Ethernet2 net so far.
There is, however, a lot of traffic on the router’s WAN-port (Ether1) - even if nothing is connected to any of the other ports.
Any ideas what this is, and what is causing it (and how to stop it)?
The WAN ip in the log is greyed out in order to not disclose the real address.
srcnat occurs in postrouting chain, therefore is applied to both forwarding and output chains (unless your rule specify otherwise)
From this log, it is impossible to make sure, where the data comes from. by looking at stats of each interface, torch results or packet sniffer results, you should be able to track down what is causing this traffic.
If you want other’s to tell you possible causes, you will need to share your config (/export hide-sensitive). It is recommended to find+replace all personal data (public IP, passwords etc…)
Without knowing your config, it is just completely wild guessing.
Thanks for the info.
Did an export from the router and have included it below.
Seems like some strange stuff in there - things I've never entered, like the /ip socks access
Also, at the end of the config - the /system scheduler.
There was also a file on the router - 7wmp0b4swouv - that I have no knowledge of.
May seem like an infection?
Router is now disconnected from the internet....
Before starting the config, the router was set to factory default.
It’s fairly obvious that things you didn’t enter have been entered by someone else, is it not?
6.34.2 is ancient and insecure, which is why it happened. Did you search the forum or look in Announcements?
Upgrade to a modern version, clear out all the junk, and set up a proper firewall (or preferably restore to default configuration and go from there re-entering the required bits of your config.)
Good that this was only a test setup (and I didn’ check the OS version).
All other Mikrotiks in my system are on OS 6.42 or higher.
Changing all passwords now…
-O-
