Community discussions

MikroTik App
 
User avatar
spippan
Member Candidate
Member Candidate
Topic Author
Posts: 100
Joined: Wed Nov 12, 2014 1:00 pm

Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 3:45 pm

hi

i need to find a solution to get all active LAN clients (ip-address) which connect from LAN to WAN
so every connection which is established from "192.168.0.x" to external IP addresses

we have troubles in our LAN with one or more hosts which randomly tries to establish 16k+ connections LAN->WAN
yeah i know, the client needs to be fixed. we are on it (but it's a bit complicated because it's the CEOs laptop ... oh the irony...)

so i want to check every 5s if there are more than, let's say, 16.000 connections in the firewall and IF this is the case, i would like to find out from which host IP in the LAN these are comming and to add that host-IP to a address-list "lock".

the firewall rule is yet in place:
[spippan@RP-AT-Hivemind] /ip firewall address-list> print where list="lock"
Flags: X - disabled, D - dynamic 
 #   LIST                                          ADDRESS                                                            CREATION-TIME        TIMEOUT             
 0   ;;; dummy list entry for LOCK
     lock                                          192.168.254.254                                                    feb/10/2017 12:25:15


[spippan@router] /ip firewall filter> print where chain~"forward"
;;; Lock-Clients in ADDR.List "lock"
chain=forward action=drop src-address-list=lock dst-address-list=!local_nets log=no log-prefix=""
can someone please help me getting a script ready for this...
i'm not quite sure how to best realize those steps with a script which can be applied to all LAN clients.

i have a script which is applied for ONE host (so only ONE IP address) but i would like to get it working more dynamically and adaptive.

current script which blocks all forwarding for that particular host:

:local ipHostIP [/tostr "192.168.0.33"];
:local cHostDHCPname [/ip dhcp-server lease get [find where address="$ipHostIP"] host-name];
:local iCurConn [/ip firewall connection print count-only where src-address~"$ipHostIP"];

:if ( $iCurConn != 0 ) do={
    :if ( $iCurConn > 16100 ) do={
        log warning "AntiFlood Info ---> RPPC0016 over 16k OUTBOUND connections!!!";
        /ip firewall filter enable [/ip firewall filter find where comment="Lock-RPPC0016"];
        
            /tool e-mail send \
                    from=router@*** \
                    user=user@domain \
                    password=***** \
                    server=192.168.0.248 \
                    port=25 \
                    to=recipient@domain \
                    start-tls=yes \
                    subject="PC \"$cHostDHCPname\" BLOCKED!" \
                    body="$cHostDHCPname - $ipHostIP --> has been BLOCKED! was over 16k OUTBOUND connections" ;
                    
        
    }
}

cheers
---
raiffeisen data center infrastructure and security
...stay curious
 
ditonet
Forum Veteran
Forum Veteran
Posts: 841
Joined: Mon Oct 19, 2009 12:52 am
Location: Europe/Poland/Konstancin-Jeziorna
Contact:

Re: Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 3:54 pm

Use firewall/mangle 'connection-limit' matcher to add host to address list.

HTH,
Grzegorz | MTCNA, MTCRE, MTCSE | konsultacje MikroTik Warszawa
It is a book about a Spanish guy called Manual. You should read it. - Dilbert
 
User avatar
spippan
Member Candidate
Member Candidate
Topic Author
Posts: 100
Joined: Wed Nov 12, 2014 1:00 pm

Re: Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 4:55 pm

Use firewall/mangle 'connection-limit' matcher to add host to address list.

HTH,
thanks for the hint
i never used that function, so did not think of it
i'll try it and i guess HERE then i also found results in the forum after searching for that firewall function

http://forum.mikrotik.com/viewtopic.php?t=55213
---
raiffeisen data center infrastructure and security
...stay curious
 
Larsa
Member Candidate
Member Candidate
Posts: 123
Joined: Sat Aug 29, 2015 7:40 pm

Re: Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 5:09 pm

. . .
we have troubles in our LAN with one or more hosts which randomly tries to establish 16k+ connections LAN->WAN yeah i know, the client needs to be fixed. we are on it (but it's a bit complicated because it's the CEOs laptop ... oh the irony...)
. . .
Trojan or/and backdoor perhaps? I would be very nervous before I found out what's actually is going on ;-)
 
User avatar
spippan
Member Candidate
Member Candidate
Topic Author
Posts: 100
Joined: Wed Nov 12, 2014 1:00 pm

Re: Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 5:28 pm

Use firewall/mangle 'connection-limit' matcher to add host to address list.

HTH,
saved my day :)
thank you very much

does the job perfectly fine:
add action=add-src-to-address-list address-list=lock address-list-timeout=1m chain=forward comment="Lock-Clients in ADDR.List \"lock\"" connection-limit=\
    256,32 connection-state=new dst-address-list=!local_nets in-interface=LAN-Bridge protocol=tcp src-address-list=local_nets tcp-flags=syn
add action=log chain=forward comment="Log-LOCKED clients" dst-address-list=!local_nets log=yes log-prefix=LOCKED>>>out src-address-list=lock
add action=drop chain=forward comment="Lock-Clients in ADDR.List \"lock\"" dst-address-list=!local_nets src-address-list=lock
---
raiffeisen data center infrastructure and security
...stay curious
 
ditonet
Forum Veteran
Forum Veteran
Posts: 841
Joined: Mon Oct 19, 2009 12:52 am
Location: Europe/Poland/Konstancin-Jeziorna
Contact:

Re: Check Connections per Host (src-address) for firewall rule/address list

Fri Feb 10, 2017 11:32 pm

saved my day :)
I'm glad that I helped.

Regards,
Grzegorz | MTCNA, MTCRE, MTCSE | konsultacje MikroTik Warszawa
It is a book about a Spanish guy called Manual. You should read it. - Dilbert
 
rftnon
newbie
Posts: 29
Joined: Fri Feb 28, 2014 6:34 pm

Re: Check Connections per Host (src-address) for firewall rule/address list

Sun Feb 12, 2017 9:17 pm

Thanks ...
This is useful and good ...
 
User avatar
spippan
Member Candidate
Member Candidate
Topic Author
Posts: 100
Joined: Wed Nov 12, 2014 1:00 pm

Re: Check Connections per Host (src-address) for firewall rule/address list

Mon Feb 13, 2017 9:32 am

. . .
we have troubles in our LAN with one or more hosts which randomly tries to establish 16k+ connections LAN->WAN yeah i know, the client needs to be fixed. we are on it (but it's a bit complicated because it's the CEOs laptop ... oh the irony...)
. . .
Trojan or/and backdoor perhaps? I would be very nervous before I found out what's actually is going on ;-)
that's what my first thought was and i still think his laptop has some serious issue with one or more pieces of unwanted software.
i prepared a kaspersky rescue disk on a usb flash for him, explained what to do and told him, i will always "re-lock" his network connectivity until he fixes his "stuff".

problem is, he thinks he knows everything about security/networking/"common-computer-sense" ... so ... hope he sacrifices a night leaving his laptop scanning the whole HDD.
(if i'd be in charge, this piece would get a fresh install of linux and would never see a w10 again...)

thanks for all the help and input though ;)
it's always nice to see how the community here cares!
---
raiffeisen data center infrastructure and security
...stay curious

Who is online

Users browsing this forum: No registered users and 21 guests