Hi, I am issuing problem with bandwidth consumption on CHR -v6.40.50.
I installed CHR and left it online, without using it as VPN server or any activity att all.
After tree weeks I see ether1 interface generated over 1.2 TB off bandwidth.

I have only one interface on VPS server.

You maybe have left it unsecured so someone succeeded to find it. Normal thing...

I changed all ports and disabled all service, I only left possibility to connect on it via Winbox on port 1463. Only service/script that I installed and it was active is blacklist. According to the log, there was attempt to connect via pptp but without success.

Ok. If there is still another traffic, see the torch.
If you detect attacking ip address, you can drop it in the raw firewall table. It will vanish in the time when you will not be sending responses back...

Maybe, DNS attack, torch, port 53 udp.