Community discussions

MikroTik App
 
foffa
newbie
Topic Author
Posts: 32
Joined: Fri Aug 17, 2007 1:23 am

need to block host (dont know where it come from)

Sat Jun 21, 2008 3:40 pm

hello all

lately i saw a host appear in the hosts with dynamic ip address

i dont know how external ip come into my private network

the ip is 163.121.94.2

i dont know where it come form also it tries to log in by mac ?????!!!! also dont know why

cant trace cant ping

cant block from my routers

i tried aloot and aloot

how to block that mac and ip from trying to log in by mac
and remove that ip from hosts
thanks in advance
 
BuccaNET
newbie
Posts: 40
Joined: Fri Mar 28, 2008 4:30 pm

Re: need to block host (dont know where it come from)

Sat Jun 21, 2008 5:58 pm

To drop all packets coming to your router from that address:

/ip firewall filter add chain=input src-address=163.121.94.2 action=drop

However, that perso can just change their IP and try again from a new IP. I don't think there is a way to blck by MAC address. If not, that is a good suggestion.

If you are not using mac-telnet you can disable it.
/tool mac-server print
/tool mac-server disable 0 or /tool mac-server remove 0

If you don't use static IP's on your network and only use dhcp, you can disable arp queries, but be sure to add add arp to your dhcp.
/ip dhcp-server set <dhcp> add-arp=yes
/interface ethernet set Local arp=reply-only

You can also restrict connecting to the router from only your IP
/ip firewall filter add chain=input src-address=<yourIP> action=accept
/ip firewall filter add chain=input action=drop
Be careful not to lock yourself out though, and you might want to set up a static MAC address mapping for your computer.

Cory
 
User avatar
meconet
Trainer
Trainer
Posts: 101
Joined: Wed Mar 23, 2005 12:02 pm
Location: Germany
Contact:

Re: need to block host (dont know where it come from)

Sun Jun 22, 2008 11:01 am

You can block mac-addresses in the bridge firewall ruleset.


Regards
Lutz
meconet - consulting . distribution . service
http://www.meconet.de - info[at]meconet.de
Tel.: +49 (0)271 703087 0 Fax: +49 (0)271 703087 99
Seelbacher Weg 7 . 57072 Siegen . Germany
 
foffa
newbie
Topic Author
Posts: 32
Joined: Fri Aug 17, 2007 1:23 am

Re: need to block host (dont know where it come from)

Sun Jun 22, 2008 7:14 pm

13:37:20 hotspot,info,debug 00:1D:0F:E2:E3:D0 (10.0.0.7): login failed:
invalid username or password
13:38:03 hotspot,info,debug 00:1D:0F:E2:E3:D0 (10.0.0.20): trying to log in
by mac
13:38:03 hotspot,info,debug 00:1D:0F:E2:E3:D0 (10.0.0.20): login failed:
invalid username or password

here is what i see in the log

also that mac add in the hosts window appear also with the ip 163.121.94.2

i do the rules you mentioned guyes and also i am still having this issue ??!!!!!
HEEEEEEEEEELP
 
User avatar
meconet
Trainer
Trainer
Posts: 101
Joined: Wed Mar 23, 2005 12:02 pm
Location: Germany
Contact:

Re: need to block host (dont know where it come from)

Sun Jun 22, 2008 7:46 pm

Hm, first of all, this is the way, a open HotSpot work. It's an open WLAN but at the end you need credentials to use the infrastructure. So where is the problem. Because of missing username/password, this user can't log in and use your HotSpot for internet access.

I belive if you execlude this mac, he will try login with an offer wlan card / mac.

Their are different possibilities to secure this environment, but first of all you should think of all the changes if you secure the wlan. You will find How tos in the manual.


Regards
Lutz
meconet - consulting . distribution . service
http://www.meconet.de - info[at]meconet.de
Tel.: +49 (0)271 703087 0 Fax: +49 (0)271 703087 99
Seelbacher Weg 7 . 57072 Siegen . Germany
 
foffa
newbie
Topic Author
Posts: 32
Joined: Fri Aug 17, 2007 1:23 am

Re: need to block host (dont know where it come from)

Sun Jun 22, 2008 8:23 pm

this is not wireless network at all

this network have 2 routers and 1 network and hotspot active that is only

the Maine problem that this mac always try to log in by mac

some time it use other users ip !!!!!

this cause the user to hang :S

any suggestions
 
BuccaNET
newbie
Posts: 40
Joined: Fri Mar 28, 2008 4:30 pm

Re: need to block host (dont know where it come from)

Mon Jun 23, 2008 5:24 pm

OK I think I found it. If you really want to drop this user's MAC.

/ip firewall filter chain=input action=drop src-mac-address=00:1D:0F:E2:E3:D0 \
comment="Drop conections to the router"

/ip firewall filter chain=forward action=drop src-mac-address=00:1D:0F:E2:E3:D0 \ comment="Drop connections through the router"

Bt then he can just spoof another MAC address (if he knows how) and keep trying.

Who is online

Users browsing this forum: sid5632 and 132 guests