Community discussions

MikroTik App
 
norocel
newbie
Topic Author
Posts: 29
Joined: Mon Sep 04, 2006 12:03 am

my clients is virused, help me plees

Wed Oct 10, 2007 10:31 pm

Helo ,
I have mikrotik ros 2.9.27, and 400 windows-xp clients.
A lot of clients are virused and make flood to dns provider servers (udp port 53).
How can i make a filter for this virused clients?

10x in advanced
 
User avatar
gmsmstr
Trainer
Trainer
Posts: 942
Joined: Fri Jun 04, 2004 2:22 am
Location: St. Louis, MO
Contact:

Re: my clients is virused, help me plees

Thu Oct 11, 2007 12:01 am

either block the entire DNS port, or add a rule to add SRC-ADDRESS to any IP that has too many DNS requests.
Dennis Burgess, MCTCE, MTCNA, MCTCTE, MTCWE, MTCNIE, A+, N+, MCP, MTCSE Mikrotik Certified Consultant / Trainer
Need Mikrotik Support: http://www.linktechs.net -- Link Technologies, Inc.
-- Author of "Learn RouterOS: Second Edition"
 
norocel
newbie
Topic Author
Posts: 29
Joined: Mon Sep 04, 2006 12:03 am

Re: my clients is virused, help me plees

Thu Oct 11, 2007 12:09 am

either block the entire DNS port, or add a rule to add SRC-ADDRESS to any IP that has too many DNS requests.
u can be more specific, pleez?
 
GuJack20
Trainer
Trainer
Posts: 328
Joined: Sat Jun 12, 2004 9:44 pm
Location: Tirana
Contact:

Re: my clients is virused, help me plees

Thu Oct 11, 2007 12:32 am

400 PC virused?? U got a nasty neigborhood :(:(:(
My solution would be to desinfect the clients!!
--Do you remember that guy who gave up? Neither does anybody else!
 
User avatar
Chupaka
Forum Guru
Forum Guru
Posts: 8394
Joined: Mon Jun 19, 2006 11:15 pm
Location: Minsk, Belarus
Contact:

Re: my clients is virused, help me plees

Thu Oct 11, 2007 2:10 am

m.b. New Firewall Rule -> Extra -> Limit
Russian-speaking forum: https://forum.mikrotik.by/. Welcome!

For every complex problem, there is a solution that is simple, neat, and wrong.

MikroTik. Your life. Your routing.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24609
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: my clients is virused, help me plees

Thu Oct 11, 2007 1:19 pm

unplug their cable, and if they call to complain - suggest to remove the virus and then internet will be back. i've seen this and it actually works
No answer to your question? How to write posts
 
GuJack20
Trainer
Trainer
Posts: 328
Joined: Sat Jun 12, 2004 9:44 pm
Location: Tirana
Contact:

Re: my clients is virused, help me plees

Thu Oct 11, 2007 1:28 pm

:wink: :D :wink:
--Do you remember that guy who gave up? Neither does anybody else!
 
User avatar
jorj
Member
Member
Posts: 398
Joined: Mon Mar 12, 2007 4:34 pm
Location: /dev/null

Re: my clients is virused, help me plees

Mon Oct 15, 2007 10:38 am

Esti din RO ? Daca da, lasa un ym, si te pot ajuta.

You can block the ip of each client suspected of a virus, and they will call you. Just use torch to find out what's happening, and then add a firewall rule with "drop" on a "virused" src-address list. Wich you make by adding the infected ip's to it.
 
norocel
newbie
Topic Author
Posts: 29
Joined: Mon Sep 04, 2006 12:03 am

Re: my clients is virused, help me plees

Mon Oct 15, 2007 1:18 pm

Esti din RO ? Daca da, lasa un ym, si te pot ajuta.

You can block the ip of each client suspected of a virus, and they will call you. Just use torch to find out what's happening, and then add a firewall rule with "drop" on a "virused" src-address list. Wich you make by adding the infected ip's to it.

Salut, sunt din ro
Am rezolvat ceva ceva dar nu e foarte bine.
ym: cccblue_suport@yahoo.com

Poate ne sincronizam pe messenger intr-o seara

Multumesc,
 
User avatar
jorj
Member
Member
Posts: 398
Joined: Mon Mar 12, 2007 4:34 pm
Location: /dev/null

Re: my clients is virused, help me plees

Tue Oct 16, 2007 1:05 pm

k.
You're on my list.

Who is online

Users browsing this forum: anav, VanceG and 78 guests