Hello I am new to Mikrotik and Routerboard, I recently purchased an RB2011UiAS-IN around 2 months ago, my setup was working fine as of about 3 days ago, I noticed browsing the internet was very slow, a regular speed test would give me 15.50 down and 7 upload, all of a sudden I'm getting about 1.50 download and 0.40 upload. i noticed on the screen of the RB2011UiAS-IN that it was basically using all my upload speed to upload someting and download speed. I then disconnected the asus router and any other devices just leaving the pppoe on and still the same thing, I factory reset the device, upgraded to the latest firmware still nothing, I was using NAT masquerading, I even set up NAT manually, and even used no NAT, still nothing, basically right now its using a constant 2.5 upload but my download is fine.

When creating a pppoe connection from my laptop or directly from my asus, everything is normal and I do not have this unkown traffic.



I purchased the mikrotik to do my routing for my /30subnet I still use my asus ac66u for my entire personal home network which runs my wifi/wireless security camera's and my media server.



Does anyone know what could cause this?

Hi,

I have a similar problem on a rb750. I noticed all my upload bandwidth was being hammered. I ran torch on my ppoe out interface and found way too many requests on dns into the router and it was killing it, I put a rule in place to block all dns requests into the router and it stopped instantly.

I wish that was my problem solved. I still have no upload bandwidth, I was getting 3-4 mb when i first installed now 0.46mb .

Reading up I could have an mtu issue. I am going to put my old modem/router back in to run a test on the isp just to check its not a line error.

Run Torch and see what is happening. You will have more of an idea then and if its malicious sort it with firewall rules.

p.s have you put any firewall rules in. I thought that the default config was enough. After reading on here I discovered I was wrong.

I hope this points you in the correct direction. New to it myself.

Matt

Hey thanks for your reply..

Originally I didn't choose the default config, although I did use the default config the very first time just to take a look at the way things were setup..
I originally didnt use any firewall rule's just used a NAT masquerade, eventually I looked up how to secure the router online and found a few simple rules to use.. I disabled all the services and ports etc.
I reverted back to my old setup for now I've been doing testing every night though switching it back over.. I obviously dont have this issue when my asus ac66u is doing pppoe connection, I read up recently from many different forums etc. and have tried many different firewall combo's people suggested would stop the ddos attack.. great news.. yes it does stop... the bad news I loose internet connection to all pc's connected to my asus which is plugged into the mikrotik (I gave the asus ip(WAN) from the mikrotik's network 192.168.88.10 for instance) I believe I need to put another rule to make that happen.. I did run torch and it seems to be UDP and on different ports coming from different IP Addresses.. changing your external ip should stop these attacks shouldnt it? I phoned ISP and had them change my static IP.. no luck..

I also verified my mtu settings are exactly the same on the asus.. I'm going to give that stopping all dns request a try and let you know what happens..


again I really appreciate the help!