Community discussions

MikroTik App
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

6.3 firmware possible firewall issues

Mon Jul 13, 2015 12:39 pm

the following command prevents internet access on RB2011UASRM

/ip firewall filter
chain=input action=drop protocol=icmp log=no log-prefix=""

I would expect this rule to just block pings.
 
jarda
Forum Guru
Forum Guru
Posts: 7756
Joined: Mon Oct 22, 2012 4:46 pm

Mon Jul 13, 2015 6:28 pm

Maybe your isp is checking your router presence before he opens an access.... Just guessing.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10195
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.3 firmware possible firewall issues

Mon Jul 13, 2015 6:53 pm

ICMP is not just PING! Blocking all ICMP is an extremely bad idea, and may inhibit communication when the
MTU of your link is less than that of your local network.
At the very least put such a rule later in the chain than permit ESTABLISHED and RELATED rules.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: 6.3 firmware possible firewall issues

Mon Jul 13, 2015 10:41 pm

ICMP is not just PING! Blocking all ICMP is an extremely bad idea, and may inhibit communication when the
MTU of your link is less than that of your local network.
At the very least put such a rule later in the chain than permit ESTABLISHED and RELATED rules.
I will try it in the middle of the night when it as gone quiet.

This is a new 1:1 Fibre Cable that I have connected my spare 2011 with latest firmware installed connected it direct to NTE, this is temporary until I can get my main router off the old connection which is a 30Mbps wireless backhaul connected to a 1:1 private fibre.

I have that command in my RB1100AHx2 ( Connected to old Backhaul ) in exactly the same location and it works fine, when I put command in the 2011 it blocks internet.

***Something else I am getting that I do not get on RB1100 is that I cannot communicate with any devices that have public IP's ether static or PPPoE server assigned even though they are on the same network segment.

I am also getting drop out of some PPPoE server Assigned IP's customer routers, but not all of them, again when I route them via the 110AHx2 they stay up.

I have manually copied configuration ( Except for IP addresses ) from the 1100AHx2 even renaming the interfaces to match as far as I can see the only difference is the IP addresses and the firmware.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10195
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.3 firmware possible firewall issues

Tue Jul 14, 2015 11:53 am

When you are in an environment using PPPoE (and thus issues with different MTU) then blocking all ICMP is a perfect recipe for big trouble.
Don't do it...
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: 6.3 firmware possible firewall issues

Tue Jul 14, 2015 12:00 pm

When you are in an environment using PPPoE (and thus issues with different MTU) then blocking all ICMP is a perfect recipe for big trouble.
Don't do it...
I have been blocking all incoming pings on the WAN port for 4 and 1/2 years now and not had any problems at all, until I started using the 2011UAS with the latest firmware.

I need someone who can help solve the problem not someone telling to leave my WAN port open to abuse.
 
pe1chl
Forum Guru
Forum Guru
Posts: 10195
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.3 firmware possible firewall issues

Tue Jul 14, 2015 8:24 pm

Blocking ICMP is not the same as blocking PING!
ICMP is much more than PING!
Many firewall operators do not understand that and cut themselves in the thumb.

ICMP = Internet Control Message Protocol. This is also used for things like determining the MTU of the next hop.
As you are using PPPoE, your next hop will not have the same MTU and by blocking ICMP you cause yourself to
be locked out.
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: 6.3 firmware possible firewall issues

Tue Jul 14, 2015 8:26 pm

Blocking ICMP is not the same as blocking PING!
ICMP is much more than PING!
Many firewall operators do not understand that and cut themselves in the thumb.

ICMP = Internet Control Message Protocol. This is also used for things like determining the MTU of the next hop.
As you are using PPPoE, your next hop will not have the same MTU and by blocking ICMP you cause yourself to
be locked out.
I block incoming not outgoing and have had no problems even with PPPoE
 
pe1chl
Forum Guru
Forum Guru
Posts: 10195
Joined: Mon Jun 08, 2015 12:09 pm

Re: 6.3 firmware possible firewall issues

Wed Jul 15, 2015 11:39 am

Ok, I thought you had a problem. And I think it is caused by misunderstanding, not by
possible firewall issues. But when all is OK, good for you!
 
opalit
Member Candidate
Member Candidate
Topic Author
Posts: 242
Joined: Wed Aug 24, 2011 10:15 pm

Re: 6.3 firmware possible firewall issues

Wed Jul 15, 2015 11:41 am

Ok, I thought you had a problem. And I think it is caused by misunderstanding, not by
possible firewall issues. But when all is OK, good for you!
I have a problem with the new firmware not the old firmware I have been using for the past 4 1/2 years

Who is online

Users browsing this forum: Amazon [Bot], biomesh, GuJack20, korg, mogiretony and 84 guests