I'm being DDoS'd

Sn@p said:
Ah I see, I use the router to serve DNS requests to clients,

So I've just added rules to accept TCP/UDP 53 from LAN and drop anywhere else.

I'll check if that helps.
Click to expand...

Block DNS from outside LAN is the first thing I do with a new Mikrotik. Hackers always DDOS your DNS because they can do amplification attacks cheaply.
 
netcruiser said:
Block DNS from outside LAN is the first thing I do with a new Mikrotik. Hackers always DDOS your DNS because they can do amplification attacks cheaply.
Click to expand...
yeah, normally on other routers everything is blocked on your WAN interface by default, I realise now with Mikrotik it's a different story, but hey, so we learn :)
 
Thanks for the pm.

We are investigating.

We have been battling huge amounts of multicast traffic directed at clients on the Vuma Villages vlans which are degrading performance. It's currently affecting clients in Gauteng on the old SADV now Vuma Villages network.

We are working with everyone involved to pin point the source of the traffic and stop it.
 
Sn@p said:
yeah, normally on other routers everything is blocked on your WAN interface by default, I realise now with Mikrotik it's a different story, but hey, so we learn :)
Click to expand...
I also learned this the hard way. Now it's one of the first rules being added when a Mikrotik device gets reset in my house.
 
AfriNatic said:
Thanks for the pm.

We are investigating.

We have been battling huge amounts of multicast traffic directed at clients on the Vuma Villages vlans which are degrading performance. It's currently affecting clients in Gauteng on the old SADV now Vuma Villages network.

We are working with everyone involved to pin point the source of the traffic and stop it.
Click to expand...
Im blocking an excessive amount of ICMP and UDP ipv6 traffic, more than usual. But still getting timeouts sporadically on AH DNS servers.
 
Peon said:
OpenServe - Hartbeespoort
Click to expand...

Okay you should be able to get a new IP by dropping the pppoe session for a while.

Unfortunately the internet is full of malware constantly scanning IP subnets to find exploits.
 
AfriNatic said:
Okay you should be able to get a new IP by dropping the pppoe session for a while.

Unfortunately the internet is full of malware constantly scanning IP subnets to find exploits.
Click to expand...
Acutely aware. Managing to get by with Quad9.
 
AfriNatic said:
Thanks for the pm.

We are investigating.

We have been battling huge amounts of multicast traffic directed at clients on the Vuma Villages vlans which are degrading performance. It's currently affecting clients in Gauteng on the old SADV now Vuma Villages network.

We are working with everyone involved to pin point the source of the traffic and stop it.
Click to expand...
I told SADV about that problem around 4 years ago already, a lot of RFC1918 and RFC6761 traffic was hitting my firewall, and I even received DHCP requests. They never did anything about it.
 
Sn@p said:
So for the last few days, I've been having heavy packet drops on my fibre line,
After logging several calls with my ISP and them just doing the normal port reset etc, I decided to check my router to see what is going on.
Upon investigation I found this:

View attachment 1221936

I'm getting bombed with 86k packets/second, I then torched the interface and I can see that I'm being hit by ICMP packets.

View attachment 1221938
My question is aren't ISPs supposed to have some kind of DDoS protection in place to avoid attacks like this?
Click to expand...
We do, but to block it all is crazy. We get heavy attacks it's all about what ports are open and what sort of protection you have in the end. Have you tried to do some firewall protocols on your Mikrotik under IP>Firewall>Filter rules?

The Wiki can give you a good start and some digging can get you rather a great enterprise-level firewall to stop any type of port sniffer or reject connection all together
 
HartsockZA said:
We do, but to block it all is crazy. We get heavy attacks it's all about what ports are open and what sort of protection you have in the end. Have you tried to do some firewall protocols on your Mikrotik under IP>Firewall>Filter rules?

The Wiki can give you a good start and some digging can get you rather a great enterprise-level firewall to stop any type of port sniffer or reject connection all together
Click to expand...
You can put all the firewalling you like at the end of your line, but if you're being hit by a volume-based attack, that traffic still has to go down your line to be rejected, with the result that your line is overwhelmed.
 
Sinbad said:
You can put all the firewalling you like at the end of your line, but if you're being hit by a volume-based attack, that traffic still has to go down your line to be rejected, with the result that your line is overwhelmed.
Click to expand...
Of course, I'd do a IP reset when you do otherwise it looks like a IP pool that might be compromised, currently deflecting a huge attack ourselves. Request a static IP from a totally new range could help otherwise someone has got your number baby ;)
 
AfriNatic said:
Thanks for the pm.

We are investigating.

We have been battling huge amounts of multicast traffic directed at clients on the Vuma Villages vlans which are degrading performance. It's currently affecting clients in Gauteng on the old SADV now Vuma Villages network.

We are working with everyone involved to pin point the source of the traffic and stop it.
Click to expand...
LOL our engineers reckon it's another network storm Vuma has created somehow again...
 
HartsockZA said:
We do, but to block it all is crazy. We get heavy attacks it's all about what ports are open and what sort of protection you have in the end. Have you tried to do some firewall protocols on your Mikrotik under IP>Firewall>Filter rules?

The Wiki can give you a good start and some digging can get you rather a great enterprise-level firewall to stop any type of port sniffer or reject connection all together
Click to expand...
I did exactly that today, not going to brag but I think it's a pretty solid config. :ROFL:

I just missed a few things that Mikrotik does differently than other vendors.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X