Strange bandwidth usage on MikroTik router

blunt

blunt

Expert Member
Joined
May 1, 2006
Messages
4,170
Reaction score
818
Location
Cape Town
So about a month ago I upgraded my MikroTik router to RouterOS 6.5, not sure if this is related to my issue, but just FYI.

I've been away overseas for 3 weeks but while I was away I was told the internet was acting up, very slow etc.

So I logged in and I found that the line was being maxed out, around 3.1mbps solidly, but the strange thing is, while I could see the PPPoE & WAN sitting @ 3.1mbps, there was no equivalent port on the router that was requesting that amount of bandwidth (usually you can see the specific port that is doing most of the data requests, or that a combo of all ports are using the total on the dsl/wan connection) - but nothing.

This morning it happened again, 3.1mbps but barely any traffic reported on any of the ports, I have a separate wifi router plugged into one of the ports and it wasnt that either. I disabled each port one by one to see if it would change the 3.1mbps flat usage but nothing did.

If I go to Torch on the WAN interface it says the traffic requested is on 0.0.0.0 on the "PPPoE" port.

I rebooted the MikroTik and it has since stopped.

Any idea how I can track this down or what it could be?
 
Next time when you run the Torch tool, stop it, select protocol and port, start again after and see what protocol/ports are in use.
I bet someone is using an open port on your mikrotik to spoof traffic on the interwebs.
 
Eskomisaloser said:
So you're the bugger that stopped my downloads midway :mad: :p :D

P.S. Seriously, change your wireless password
Click to expand...

Wifi password changed though my neighbours are an old lady and then a catholic priest so I'm not too sure it was that.
 
Tinuva said:
Next time when you run the Torch tool, stop it, select protocol and port, start again after and see what protocol/ports are in use.
I bet someone is using an open port on your mikrotik to spoof traffic on the interwebs.
Click to expand...

Will do.

I've gone to "Services" and disabled everything except for "www" (I only use WebFig), which was already on a non standard port, but I've also switched it to another port to be safe.
 
blunt said:
Wifi password changed though my neighbours are an old lady and then a catholic priest so I'm not too sure it was that.
Click to expand...

There's your problem, he's backing up the internet collection of kiddie porn to his pc! :D
 
ponder said:
There's your problem, he's backing up the internet collection of kiddie porn to his pc! :D
Click to expand...

:/ he is direct from Rome so you never know.. cant be a legit catholic priest without some kiddy pron
 
If you are using the DNS service on your Mikrotik and "Allow Remote Requests" is enabled, you need to add lines to your firewall section to block incomming DNS requests on your PPPoE interface only (udp and tcp port 53). There is a stupid DNS bounce attack used at the moment that gives the same result as you describe.
 
Limpo77 said:
If you are using the DNS service on your Mikrotik and "Allow Remote Requests" is enabled, you need to add lines to your firewall section to block incomming DNS requests on your PPPoE interface only (udp and tcp port 53). There is a stupid DNS bounce attack used at the moment that gives the same result as you describe.
Click to expand...

Thanks - I assume "Allow Remote Requests" can be un-ticked if I am only using the DNS server within the LAN?
 
Rather setup your firewall properly on your Mikrotik, by denying all new incoming connections.

A simple fix for the DNS issue would be to add the following rules (by changing the ether5 with your WAN/PPPoE connection):
Code: 
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=tcp

The basic firewall rules that I would suggest you use, instead of the specific DNS rules above, is:
Code: 
#Router and internal network protection, no internal servers, LAN is friendly
/ip firewall filter
add chain=input   action=drop   connection-state=invalid                         comment="Disallow weird packets"
add chain=input   action=accept connection-state=new         in-interface=LAN    comment="Allow LAN access to router and Internet"
add chain=input   action=accept connection-state=established                     comment="Allow connections that originated from LAN"
add chain=input   action=accept connection-state=related                         comment="Allow connections that originated from LAN"
add chain=input   action=accept protocol=icmp                                    comment="Allow ping ICMP from anywhere"
add chain=input   action=drop                                                    comment="Disallow anything from anywhere on any interface"
add chain=forward action=drop   connection-state=invalid                         comment="Disallow weird packets"
add chain=forward action=accept connection-state=new         in-interface=LAN    comment="Allow LAN access to router and Internet"
add chain=forward action=accept connection-state=established                     comment="Allow connections that originated from LAN"
add chain=forward action=accept connection-state=related                         comment="Allow connections that originated from LAN"
add chain=forward action=drop
* Also change the LAN interface with your actual LAN interface's name.

I would suggest that you add these rules while the MikroTik router is in Safe Mode, by opening a New Terminal session on your MikroTik and pressing CTRL+X.
Once everything is working with the new rules, press CTRL-X in the Terminal session again to exit Safe Mode and persist those changes.
 
Pada said:
Rather setup your firewall properly on your Mikrotik, by denying all new incoming connections.

A simple fix for the DNS issue would be to add the following rules (by changing the ether5 with your WAN/PPPoE connection):
Code: 
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=tcp

The basic firewall rules that I would suggest you use, instead of the specific DNS rules above, is:
Code: 
#Router and internal network protection, no internal servers, LAN is friendly
/ip firewall filter
add chain=input   action=drop   connection-state=invalid                         comment="Disallow weird packets"
add chain=input   action=accept connection-state=new         in-interface=LAN    comment="Allow LAN access to router and Internet"
add chain=input   action=accept connection-state=established                     comment="Allow connections that originated from LAN"
add chain=input   action=accept connection-state=related                         comment="Allow connections that originated from LAN"
add chain=input   action=accept protocol=icmp                                    comment="Allow ping ICMP from anywhere"
add chain=input   action=drop                                                    comment="Disallow anything from anywhere on any interface"
add chain=forward action=drop   connection-state=invalid                         comment="Disallow weird packets"
add chain=forward action=accept connection-state=new         in-interface=LAN    comment="Allow LAN access to router and Internet"
add chain=forward action=accept connection-state=established                     comment="Allow connections that originated from LAN"
add chain=forward action=accept connection-state=related                         comment="Allow connections that originated from LAN"
add chain=forward action=drop
* Also change the LAN interface with your actual LAN interface's name.

I would suggest that you add these rules while the MikroTik router is in Safe Mode, by opening a New Terminal session on your MikroTik and pressing CTRL+X.
Once everything is working with the new rules, press CTRL-X in the Terminal session again to exit Safe Mode and persist those changes.
Click to expand...

Thanks, have added the two basic rules while I'm not at home, will do the rest when I am at home just in case something freaks out and I kill the dsl connection.

The last line of your second paste is just
add chain=forward action=drop
Click to expand...
Is that right, or did your paste get cut off?

I have port forward rules and I do enable the webfig service for remote connections .. will these effect my other port forwards?
 
The topic where I copied it from didn't comment that line, which would've been like
Code: 
add chain=forward action=drop comment="Disallow anything from anywhere on any interface"

Those rules will affect your webfig and port forward rules.

For the port forwarding, simply add a rule above the "add chain=forward action=drop" that says something like:
Code: 
add chain=forward action=accept protocol=tcp dst-port=1234,1235 comment="Allow port forward for Game XY"

For the webfig, you'll need to add a rule above the "add chain=input action=drop" that says something like the following:
Code: 
add chain=input action=accept protocol=tcp dst-port=80 comment="Allow all connections to webfig"

I would actually suggest that you host the webfig on a different (non-standard) port, like port 81 or 1081, so that port scanners won't detect it so easily.
Like at our office we had like a couple of hundred malicious SSH login attempts on our routers per week when we ran it on a standard SSH port. We then simply changed our SSH port and ever since we haven't had a single malicious login attempt.

What I like to do is to enable PPTP/IPSec VPN from the Internet and disable everything else. So then I first connect to my MikroTik's VPN before I can adjust anything. This way my webfig isn't exposed to the Internet on any port either.
 
Pada said:
The topic where I copied it from didn't comment that line, which would've been like
Code: 
add chain=forward action=drop comment="Disallow anything from anywhere on any interface"

Those rules will affect your webfig and port forward rules.

For the port forwarding, simply add a rule above the "add chain=forward action=drop" that says something like:
Code: 
add chain=forward action=accept protocol=tcp dst-port=1234,1235 comment="Allow port forward for Game XY"

For the webfig, you'll need to add a rule above the "add chain=input action=drop" that says something like the following:
Code: 
add chain=input action=accept protocol=tcp dst-port=80 comment="Allow all connections to webfig"

I would actually suggest that you host the webfig on a different (non-standard) port, like port 81 or 1081, so that port scanners won't detect it so easily.
Like at our office we had like a couple of hundred malicious SSH login attempts on our routers per week when we ran it on a standard SSH port. We then simply changed our SSH port and ever since we haven't had a single malicious login attempt.
Click to expand...

Ok thanks.

I have always had WebFig and all the default services (ssh etc) on non standard ports (3xxx), but to be safe after this recent "attack" I changed them again.
 
I have found that these rules as by Pada:

/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=udp (replace in-interface with your PPPoE connection name)
add action=drop chain=input dst-port=53 in-interface=ether5 protocol=tcp (replace in-interface with your PPPoE connection name)

does the job well enough on their own if you just want to nail this DNS problem. Im not close to my router to check my setup, but i think Pada covered all the importent bits. :)
 
In windows check Resource monitor then under the "Network" tab look there.
 
The Safe Mode is a very handy MikroTik feature, that allow you to make changes remotely and if you stuffed up, it will revert all those changes again.
Just be sure to test the settings properly before you exit Safe Mode, which will then persist those changes.

I often use it when I change:
- firewall rules
- IP addresses
- Bridge interfaces

So say you've added a filter rule that would block ALL traffic to/via your MikroTik while Safe Mode was on, then after a while your connection with Winbox/Terminal will close prematurely and then MikroTik will immediately revert those changes...
and then you can connect to it again :)

The Safe Mode thing was probably the coolest thing that I've learned during the Basic/Beginner MikroTik Training Course.
 
If you use wireless, set it to hidden and change the name, also change the password. I had someone recently around me on my network and seeing they used a static ip I could not pick up an entry on the DHCP log. yes there are tools to catch and block the MAC but if they are smart enough to already scan and get onto your password protected wifi then changing the mac address wont be a difficult task at all for them. What I will be setting up this weekend is a mac allow list instead on the wifi I only have a few devices that need access to it so it shouldn't take too long. Also I know this is obvious but pls ensure you do not use the default password of the router so many places I have been at the routers default admin interface passwords is being used.
 
PS: Must've been someone exploiting my DNS - since the firewall rules and password changes I haven't had another occurrence of this - I really doubt the wifi was the culprit, but those passwords were changed.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X