Community discussions

MikroTik App
  4. RouterOS
  5. General

[SOLVED] Too much firewall connections!?! WTF?

Post Reply
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

[SOLVED] Too much firewall connections!?! WTF?

Mon May 21, 2007 6:35 am

OK, firstly am noob in Mikrotik.
Used this config http://www.mikrotik.com/testdocs/ros/2. ... p#6.54.6.3
and added:
Code: Select all
/ip firewall nat add chain=srcnat src-address=192.168.2.0/24 
/ip dns set allow-remote-requests=yes action=masquerade

For now it work but i have been looking /ip firewall connection
Code: Select all
/ip firewall connection print 
Flags: S - seen reply, A - assured 
 #    PR.. SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
 0    udp  192.168.1.2:1978      255.255.255.255:20561             10s        
 1    udp  192.168.2.20:138      192.168.2.255:138                 1s         
 2    udp  192.168.1.3:5678      255.255.255.255:5678              3s         
 3    udp  192.168.2.100:5678    255.255.255.255:5678              3s         
 4    tcp  192.168.2.20:2721     192.168.249.223:135   syn-sent    2s         
 5    tcp  192.168.2.20:2722     192.168.249.224:135   syn-sent    2s         
 6    tcp  192.168.2.20:2723     192.168.249.225:135   syn-sent    2s         
 7    tcp  192.168.2.20:2724     192.168.249.221:135   syn-sent    2s         
 8    tcp  192.168.2.20:2725     192.168.249.222:135   syn-sent    2s         
 9    tcp  192.168.2.20:2726     192.168.249.226:135   syn-sent    2s         
10    tcp  192.168.2.20:2727     192.168.249.227:135   syn-sent    2s         
11    tcp  192.168.2.20:2728     192.168.249.228:135   syn-sent    2s         
12    tcp  192.168.2.20:2729     192.168.249.229:135   syn-sent    2s         
13    tcp  192.168.2.20:2730     192.168.249.230:135   syn-sent    2s         
14    tcp  192.168.2.20:2731     192.168.249.231:135   syn-sent    2s         
15    tcp  192.168.2.20:2732     192.168.92.68:139     syn-sent    2s         
16    tcp  192.168.2.20:2733     192.168.92.96:445     syn-sent    3s         
17    tcp  192.168.2.20:2734     192.168.249.192:445   syn-sent    3s         
18    tcp  192.168.2.20:2735     192.168.249.191:445   syn-sent    3s         
19    tcp  192.168.2.20:2736     192.168.249.232:135   syn-sent    3s         
20    tcp  192.168.2.20:2737     192.168.249.193:445   syn-sent    3s         
21    tcp  192.168.2.20:2738     192.168.249.194:445   syn-sent    3s         
22    tcp  192.168.2.20:2739     192.168.249.233:135   syn-sent    3s         
23    tcp  192.168.2.20:2740     192.168.249.234:135   syn-sent    3s         
24    tcp  192.168.2.20:2741     192.168.92.105:135    syn-sent    4s         
25    tcp  192.168.2.20:2742     192.168.92.104:135    syn-sent    4s         
26    tcp  192.168.2.20:2743     192.168.92.80:80      syn-sent    4s         
27    tcp  192.168.2.20:2744     192.168.92.81:80      syn-sent    4s         
28    tcp  192.168.2.20:2688     192.168.92.92:445     syn-sent    1s         
29    tcp  192.168.2.20:2687     192.168.92.60:139     syn-sent    1s         
30    tcp  192.168.2.20:2686     192.168.92.59:139     syn-sent    1s         
31    tcp  192.168.2.20:2685     192.168.249.202:135   syn-sent    1s         
32    tcp  192.168.2.20:2684     192.168.249.201:135   syn-sent    1s         
33    tcp  192.168.2.20:2683     192.168.249.200:135   syn-sent    1s         
34    tcp  192.168.2.20:2682     192.168.249.199:135   syn-sent    1s         
35    tcp  192.168.2.20:2681     192.168.92.61:139     syn-sent    1s         
36    tcp  192.168.2.20:2745     192.168.92.69:139     syn-sent    4s         
37    tcp  192.168.2.20:2746     192.168.92.70:139     syn-sent    4s         
38    tcp  192.168.2.20:2690     192.168.249.204:135   syn-sent    2s         
39    tcp  192.168.2.20:2689     192.168.249.203:135   syn-sent    2s         
-- [Q quit|D dump|down]
Public (to ADSL router) is 192.168.1.1/24 and using DHCP client
Local (to users) IP is 192.168.2.100/24

All users have ip 192.168.2.x , subnet 255.255.255.0, Default Gateway: 192.168.2.100, DNS: 192.168.2.100.


Did i do something wrong maybe? Thanks
Last edited by sebac on Thu May 24, 2007 6:46 pm, edited 2 times in total.
Top
 
sten
Forum Veteran
Forum Veteran
Posts: 919
Joined: Tue Jun 01, 2004 12:10 pm

Re: Too much firewall connections!?! WTF?

Mon May 21, 2007 6:05 pm

Code: Select all
/ip firewall nat add chain=srcnat src-address=192.168.2.0/24 action=masquerade
nat chain is wrong.
Code: Select all
/ ip firewall nat add chain=src-nat src-address=192.168.2.0/24 out-interface=ether1 action=masquerade
change "ether1" to your public interface.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Mon May 21, 2007 10:40 pm

i will go mad with this... NO, it does not help :(

Net is slow as shit, and nobody is downloading...
What would you do in this case? Or how did you setup you bandwidth sharing/limiting?

ummm all user have dafault gateway pointed to my MT box as Gateway... is this ok?
Top
 
R1CH
Forum Guru
Forum Guru
Posts: 1101
Joined: Sun Oct 01, 2006 11:44 pm

Tue May 22, 2007 12:37 am

User 192.168.2.20 is infected with virus/worm that is trying to spread at high speed using thousands of connections.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Tue May 22, 2007 12:47 am

User 192.168.2.20 is infected with virus/worm that is trying to spread at high speed using thousands of connections.
ok... will tell users to install or update antivirus and I post progression.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Tue May 22, 2007 8:18 pm

User 192.168.2.20 is infected with virus/worm that is trying to spread at high speed using thousands of connections.
ok... will tell users to install or update antivirus and I post progression.
quote on quote :D


Anyway NOPE! I have tryed single user with my laptop... My laptop is creating connections! Scaned my sistem with AVG and NOD32, nothing FOUND!
Top
 
sten
Forum Veteran
Forum Veteran
Posts: 919
Joined: Tue Jun 01, 2004 12:10 pm

Tue May 22, 2007 9:09 pm

It really does look like a worm. Try Avast! or something similar.
*or* just turn off your laptop and let your other users through.

Just out of curiosity, what kind of hardware is the router?
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Tue May 22, 2007 10:28 pm

It really does look like a worm. Try Avast! or something similar.
*or* just turn off your laptop and let your other users through.

Just out of curiosity, what kind of hardware is the router?
2 x 3Com 3C905C-TX
DISABLED 2 x TP-Link WLAN, ATHEROS chipset

It's a P2, 500MHz, 256MB of RAM...
Top
 
GotNet
Member
Member
Posts: 434
Joined: Fri May 28, 2004 7:52 pm
Location: Florida

Tue May 22, 2007 11:39 pm

Those ports should really be dropped in the input and forward chains anyway. It's fun to tarpit the really bad ones - the infected PC will sometimes crash.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Wed May 23, 2007 10:32 am

Those ports should really be dropped in the input and forward chains anyway. It's fun to tarpit the really bad ones - the infected PC will sometimes crash.
True, omg that was lol...
I didnt tarpid i did simple drop (while lap was connected)... PUF! BSOD! Lol!

I did this:
Code: Select all
/ip firewall filter add chain=input dst-port=6 protocol=tcp in-interface=Local action=drop
mmm, how do i do tarpit? plz teach me.... the real solution is to clean all infected PC's (what am doing wright now).
Worm is MSetus and few others :D

BTW. noticed that i now know something thanks 2 you guys! Thanks!
Top
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26376
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Wed May 23, 2007 11:15 am

use action 'tarpit' instead of 'drop'.

in case of 'drop', the evil machine will try to make a new connection. in this case, the router will be dropping the tons of incoming connections, and will slow down.

action 'tarpit' captures and holds the connections, if you have a powerful router, you can kill the attacker with this action.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Wed May 23, 2007 1:05 pm

use action 'tarpit' instead of 'drop'.

in case of 'drop', the evil machine will try to make a new connection. in this case, the router will be dropping the tons of incoming connections, and will slow down.

action 'tarpit' captures and holds the connections, if you have a powerful router, you can kill the attacker with this action.
sorry, it dont work... when i connect my laptop number of connections jump to 800+ connections...
Top
 
cmit
Forum Guru
Forum Guru
Posts: 1547
Joined: Fri May 28, 2004 12:49 pm
Location: Germany

Wed May 23, 2007 1:59 pm

Well tarpit should do just that: Accept and hold the incoming connection...

Best regards,
Christian Meis
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Thu May 24, 2007 12:43 am

mmm ok...
Nice.
Anyway i have told my users to download antivirus from local ftp...
Btw i solved this with RemoveIT pro http://www.majorgeeks.com/download.php?det=5205 and it rox!!!
Best thing ever and it's from my own contry ! yey!
Anyways fixed; MSetus, EraseME and few other Viruses/Worms over network...
Correnty am connected via Mikrotik. Few user download some stuff and am going to try playing WoW over this config...

BTW all users have default gateway pointed to MT box.
Does all trafic comes to MT or?

BIGGGGG Thanks to all, it works 4 now!
Top
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26376
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Thu May 24, 2007 4:01 pm

mmm ok...
Nice.
Anyway i have told my users to download antivirus from local ftp...
Btw i solved this with RemoveIT pro http://www.majorgeeks.com/download.php?det=5205 and it rox!!!
Best thing ever and it's from my own contry ! yey!
Anyways fixed; MSetus, EraseME and few other Viruses/Worms over network...
Correnty am connected via Mikrotik. Few user download some stuff and am going to try playing WoW over this config...

BTW all users have default gateway pointed to MT box.
Does all trafic comes to MT or?

BIGGGGG Thanks to all, it works 4 now!
if your users are ethernet users (not wireless) and are connected to the switch, then no, they are connecting to each other directly.
Top
 
sebac
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 63
Joined: Thu Aug 10, 2006 2:16 am

Thu May 24, 2007 6:46 pm

mmm nice! Thanks!

OK THIS IS SOLVED!
BIG 10X to all!

You have made my life better.
Top
Post Reply

Who is online

Users browsing this forum: No registered users and 79 guests
  4. RouterOS
  5. General