Community discussions

MikroTik App
 
Simonej
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 56
Joined: Sun Aug 22, 2021 3:34 am

How to check if router is alive?

Mon Jul 04, 2022 12:55 pm

Hello, using RouterOS from a few years without any critical problem, recently had some issues and I was thinking for an easy way to make sure that the router in online;
MikroTiks's Building Advanced Firewall guide is suggesting to accept ICMP, this way it's possible to ping the public IP or DDNS.
/ip firewall filter
  add action=accept chain=input comment="defconf: accept ICMP after RAW" protocol=icmp
Is a great solution? Should I limit the packets to 1 / 1 sec?

Thanks
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to check if router is alive?

Mon Jul 04, 2022 4:12 pm

Let me suppose we talk about a router with no VPN tunnel, as if there was one, monitoring its state would be the most straightforward solution.

If so, monitoring the router state by just pinging it may lead to false positives - responses to ICMP echo requests are provided at quite a low level of the networking stack, so when the router "freezes", it may still be able to respond to pings. So in my personal opinion it is better to use some SNMP or DNS queries, as if the router responds these, you know that the application software is running too. Don't get me wrong, I don't suggest to make the router respond SNMP or DNS coming from anywhere on its public address, but allowing DNS requests from the IP address of the device you use to monitor the state of the router is more or less safe in terms that the router can be only used as a zombie in a DDoS attack against the addresses from which it is allowed to respond DNS queries, not against other targets.
 
Simonej
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 56
Joined: Sun Aug 22, 2021 3:34 am

Re: How to check if router is alive?

Mon Jul 04, 2022 10:19 pm

All clear @sindy, appreciated the detailed answer as always!
SNMP from a static IP is not an option in this case, it's just a rudimental solution for home device, ping or any check will be operated from casual location or mobile phone.

Was looking for a rule that can limit the pings to the router like:
/ip firewall filter add action=drop chain=input comment="defconf: accept ICMP after RAW" dst-limit=1,1,src-address/10ms protocol=icmp
should work?
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: How to check if router is alive?

Mon Jul 04, 2022 10:46 pm

It may if you fix the 10 ms expiration time (you specify at most 1 packet per second but let the flow be forgotten in 10 ms, that doesn't seem to play well together). Also, this kind of filtering doesn't save that much resources on the router itself, you rather protect the rest of the internet from someone spoofing the echo requests sent to you from a victim address so that you would send the responses there.

In any case, you should apply the limit only to echo requests in particular (icmp-options=8/0) - limiting other types of ICMP messages may cause problems.
 
Simonej
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 56
Joined: Sun Aug 22, 2021 3:34 am

Re: How to check if router is alive?

Thu Jul 07, 2022 12:04 pm

After some tests, without reinvent the wheel, the https://help.mikrotik.com/docs/display/ ... v4RAWRules Building Advanced Firewall is an appropriate solution.
Limit ICMP or block IP can cause some problems with Wireguard.

Who is online

Users browsing this forum: Google [Bot] and 35 guests