Community discussions

MikroTik App
 
Ximi87
just joined
Topic Author
Posts: 22
Joined: Sun Aug 25, 2013 1:29 pm
Location: Tirana Albania
Contact:

i think i am hacked, my NAT goes down automatically

Fri Aug 15, 2014 7:56 pm

Hello friends.

i have a small network with SXT, OmniTIk and some UBNT antennas.

before 1 week my network it was down. when i entered with winbox i saw that PPPOE client or server was disable..
and NAT (masquarade) too.

this situation was in all my antenas, SXT, and OmniTik.(pppoe and nat was disable)

i changed the password because i thought it was a hacking.

I am right or it is something wrong with my network.

my antenas is 3 years old so i just updated some times nothing change or edit..

Thanks mate
 
CelticComms
Forum Guru
Forum Guru
Posts: 1766
Joined: Wed May 02, 2012 5:48 am

Re: i think i am hacked, my NAT goes down automatically

Fri Aug 15, 2014 9:57 pm

Look in the log and see if somebody has accessed the system.
Interlynx | Networking and Information Security Consultants & Trainers | Email: routerlynx@gmail.com
BGP | EIGRP | OSPF | MPLS | Firewall | VPN | IPsec | Multicast | QOS | IPv4/6 | STP | VLAN | PON | AE | M2M | and more!

 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 2950
Joined: Tue Feb 25, 2014 12:49 pm
Location: Capalbio, Tuscany, Italy

Re: i think i am hacked, my NAT goes down automatically

Sat Aug 16, 2014 12:11 am

Look also:
1) if someone has added scheduled jobs or netwatch event to disable something, reset password, add users, etc.

2) if you have some radius on radius list and on routerboard users "use radius" is active... (nothing to do to hotspot or ppp users)

3) if on system / users are present other users than your administrative accout.
I'm Italian, not English. Sorry for my imperfect grammar.
 
Ximi87
just joined
Topic Author
Posts: 22
Joined: Sun Aug 25, 2013 1:29 pm
Location: Tirana Albania
Contact:

Re: i think i am hacked, my NAT goes down automatically

Wed Aug 20, 2014 11:02 pm

CelticComms

I can not see my log because when i saw that problem it wat 7:30 AM and in 4:00 my antenas automatically reboot.(scheduler) and it was clear all my logs.

Do you know how to save logs and before reboot send them by email or IP (lan)...

Thanks
 
Ximi87
just joined
Topic Author
Posts: 22
Joined: Sun Aug 25, 2013 1:29 pm
Location: Tirana Albania
Contact:

Re: i think i am hacked, my NAT goes down automatically

Wed Aug 20, 2014 11:05 pm

rextended

i didn't change anything from 2011 year.
i just updated some times and anything else. i have changed my pass and i made it 12 irregular text...

i am looking now to save my logs and my activity on my antennas and send them by email or IP(lan) but till now nothing...

Do you know how to do that..

Thanks mate :)
 
jarda
Forum Guru
Forum Guru
Posts: 7602
Joined: Mon Oct 22, 2012 4:46 pm

Re: i think i am hacked, my NAT goes down automatically

Wed Aug 27, 2014 2:26 am

Set logging to disk. Then you can send log files easily.
 
nonac
newbie
Posts: 27
Joined: Tue Sep 02, 2014 7:36 pm

Re: i think i am hacked, my NAT goes down automatically

Wed Sep 24, 2014 5:19 am

disable other services
 
jarda
Forum Guru
Forum Guru
Posts: 7602
Joined: Mon Oct 22, 2012 4:46 pm

Re: i think i am hacked, my NAT goes down automatically

Wed Sep 24, 2014 7:46 am

You can also log online to remote syslog server or to local disk. Then the logs survive reboot.

Who is online

Users browsing this forum: Majestic-12 [Bot] and 48 guests