Hi All,
Having trouble dropping a bruce force attack from this IP 61.178.88.106 via ftp.
Done drop input anything not from our address lists
Done the way shown in wiki

thx guys!

just to show a few lines of log: (it comes almost every second! quite annoying)
07:35:51 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:52 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:53 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:55 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:56 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:57 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:35:58 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:36:00 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:36:01 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:36:02 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp
07:36:04 system,error,critical login failure for user Administrator from 61.178.88.106 via ftp

Emm... What kind of help do you need?

Done drop input anything not from our address lists

is 61.178.88.106 in your address list? why?

the help i need here is how to stop this fxxxer's IP not entering the router... and trying to login or whatever it's doing ... it filled up my syslog files

no the IP is not in the allow address list ...



-- Finally done it with drop rules in ip route
3 dst-address=61.178.88.106/32 action=drop

China, why am I NOT surprised. You might consider input rules that drop any traffic from outside your network, except for protocols you actually need the router to respond to. Otherwise every worm, compromised PC and idiot on the planet is going to try and break into your router.