MikroTik

webix

Hello Folks! I have in this moment several IP ranges that I am announcing via BGP. On my facility, I have a router with 2 upstream providers: - NOS: 10Gbit - Meo: 500Mbit I have also a router connected on a IXP where I peer with many other providers and also Meo. I have set a GRE tunnel between my I...

webix

Hello folks. Lately, i noticed some Layer7 attacks to FiveM servers. After checking the wireshark logs, most of the requests have malformed user-agent: User-Agent: \r\n User-Agent: k\r\n And some others. I set the following rule to be matched and reject everything else: /ip firewall layer7-protocol ...

webix

I noticed that these problems that were corrected on last version are back again: *) system - improved system stability when forwarding traffic from switch chip to CPU (introduced in v6.43); *) system - improved system stability when receiving/sending TCP traffic on multicore devices; If i downgrade...

webix

Hello folks. I am requesting some help has i am being struggling with this since some weeks now and i am near to loose my mind... So, here's my cenario: - I have a router CS1036-12G-4S with 2 uplinks (500Mbits on ETH2 and 100Mbits on ETH1) to different providers. - I am running BGP to announce my IP...

webix

Hello folks. I have a router with several upstream connections on it and connected to 3 switches. I am running VLANs on my network and i would like a little help to do a simple setup. So, in this moment, i am applying a limitation (simple queues on vlan interfaces) of 100Mbit/s on VLan IDs from 100-...

webix

Hello Cha0s. Yes, i understand that. It's the default behavior i used. But this is my problem: I have: - ISP1 - ISP2 - ISP3 - AntiDDoS ISP I want to send all traffic from ISP2 to AntiDDoS ISP. Only that one. If i stop the announcement on ISP2, it goes by default to ISP1, and i don't want that. I tri...

webix

Hello Folks. Here's the config i have: - Mikrotik router @ my home with 2 ISPs. - Mikrotik router @ a IX. - MikrotikOS router @ a worldwide ISP. My Home router connects to: - ISP 1 with BGP session. - ISP 2 (no BGP here). - Mikrotik router @ IX by GRE and BGP session. - Mikrotik router @ worldwide I...

webix

Yes, that's exactly what I was talking about. But I don't think you need limit matcher on the first jump rule. The logic is like that: 1) all packets non in your "secured" list enter the chain. 2) some of them a filtered by port numbers and added to "infractor" list. 3) all othe...

webix

You can use Dst-limit matcher. But as it performs desired action when under the limit, then applies passthrough, and that behaviour is not reversible (like with Limit matcher), you will need a custom chain for it. Can you please provide an example? I am using custom chains ;) This is what i have in...

webix

Hello Folks. I would like to limit the packets per second from a source IP to a destination IP. I know that this has already been approached, but the solutions given are old and don't work very well. So, i would like to add a source IP to a address list if that IP passes the limit of 100K PPS to a d...

webix

Yes. I know. But most of the servers I have are unmanaged by us. They are rented to our clients.

So, I have 2 solutions:

Configure firewall rules to limit the SMTP connections.

Redirect SMTP ports on router to a transparent SMTP filtering.

Any idea on how to do this out on the router?

webix

So... what do you suggest?
I don't have mail clients inside my network. Only mail servers.

Regards

webix

Hello sindy. Thank you for informing that. If i am not mistaken, "connection-state=new" means that take into account only the new connections, not the related or established connections. Right? The "connection-limit=50,32" means that is a limit of 49 connections from same IP, no?...

webix

Hello folks. In this moment, i have the following firewall rules: chain=forward action=add-src-to-address-list connection-state=new connection-limit=5000,32 protocol=tcp address-list=3rdAlertSPAM address-list-timeout=none-static out-interface=ETH1 dst-port=25,587 limit=5k/12h,0:packet log=no log-pre...

webix

Hello folks. I wanted to know if there is a way to setup a firewall rule to add a destination ip address to a list if he is receiving more than 20 Mbit/s on TCP. I tested this rule, but i can't get it working: add action=add-dst-to-address-list address-list=HighTrafficIP address-list-timeout=10m cha...

webix

Ok. I've tested like you said, to put the IP address instead of the interface... It doesn't work. I loose full connection if i put the ip instead of the interface. Also... what IP should i put? If i put the interface IP, MK tells me that the subnet is unreachable. If i put the server IP, MK tells me...

webix

I got it working. The problem was in my firewall rules. For your info: gateway=SRV01 is not a valid configuration on broadcast network. This configuration works perfectly well because SRV01 is the interface. MK already configure SRV01 has gateway when i add the ip address to that interface. You can ...

webix

That gateway is the vlan interface.
I should put the vlan router ip?

webix

Hello Folks. I have a MK with a /22 subnet announced. Bellow that MK, i have several servers, each one on his own vlan. Each vlan have a /30 configured has follows (This is a example, my IPs are all public): - 10.0.0.0: Subnet - 10.0.0.1: Router IP - 10.0.0.2: Server IP - 10.0.0.3: Broadcast IP. Eve...

webix

I have that problem too when the default route is not configured and i am accessing from outside.
Check the routes.

webix

Hello Folks. I recently installed a Mikrotik router on a IX (Identified by MK_IX) to do traffic interchange with my router on my facility (Identified by MK_local). - I have configured the BGP sessions on the MK_IX like the IX provided me and the sessions are up and running. I receive ~200 routes. - ...

webix

Hello Folks. For info, i have read and tested this setup before i ask here my question: https://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ_Examples This is how i have my network (note that i work with public ips only, so the ips shown here are representative only): ETH1: Connected to UpStream Provid...

webix

The no-export seems cannot be set on update. At least mikrotik doesn't assume it. The alternative I found was to set it with the 32bit version of no-export: /routing filter set [find chain="BGP-IPv4-Out"] bgp-communities=65535:65281 I don't know if this is a bug or not, but the mikrotik te...

webix

Doesn't work.

webix

Hello. I have the following BGP filter: chain=BGP-IPv4-Out prefix=xxx.xxx.xxx.xxx/xx prefix-length=xx-xx bgp-communities="" invert-match=no action=accept set-bgp-prepend-path="" append-bgp-communities="" How do i update it to add no-export? : set-bgp-communities=no-expo...

webix

ok... when i run the script, i get this: /system script> /tool fetch mode=https url="https://bl.mikrotikfilters.com/secureFetch.php\?priority=$priority" http-met hod=post http-data="$sn" dst-path="$destPath" output=file; /import file-name=$destPath; /file remove $destPa...

webix

Hello Folks. I am not a script coder and it's why i am asking here for some help on my request. So... I have this: GRE Tunnel to a provider A. ETH Connection to a provider B. BGP Session with provider A. BGP Session with provider B with "Set BGP Communities" to "no advertise". I ...

webix

Hello everyone. I've been making a lot of searches on internet and here on forum and i can't find a solution or a reason for my problem. This is my setup: Mikrotik Router CCR1036-12G-4S with the latest RouterOS version installed. 2 BGP sessions to 2 providers (one is ethernet with VLan and the other...

webix

That worked out perfectly.

Thank you very much!

webix

Hello all I have the following set of commands inside a script: :global counter /interface monitor-traffic ether1 once do={:set $counter (rx-packets-per-second)} :put $counter However, when i run the script, instead of getting only the $counter variable i get the full echo of the once command. How c...

webix

Hey. Ddos protection topic is more complicated than bgp communities. And i dont think, that you can solve it buy splitting traffic on national for unfiltered and international filtered. More to say, this ddos international traffic can be originated in your country but with spoofed sources. Do you u...

webix

Splitting traffic on national and international does not make sense for me, cos your national networks coud come to your network from international sources. Using gre for border routing does not make sense for me too. There are some specific cases, when you have to do so, but should not be used on ...

webix

Hello all. Before i start describing my problem, i will try to explain the better i can the configuration i have (picture bellow for a better view). - I have my own range of IP addresses that i am announcing with my own ASN. - I have only one internet provider wich i connect to directly. - The above...

Search found 33 matches

BGP load balancing on a multi-homed with IXP

Block malformed user-agents

Re: v6.46.6 [stable] is released!

Traffic Shapping Scheduler

Different speeds between VLans

Re: BGP/Routing question

BGP/Routing question

Re: Firewall: Limit PPS on per IP basis

Re: Firewall: Limit PPS on per IP basis

Firewall: Limit PPS on per IP basis

Re: Firewall question

Re: Firewall question

Re: Firewall question

Firewall question

Firewall: How-to match if connection reaches X Mbit/s?

Re: How to make use of /32 ips?

Re: How to make use of /32 ips?

Re: How to make use of /32 ips?

How to make use of /32 ips?

Re: Winbox stuck logging in

Active BGP Routes not working

Configure queue types with different upstreams

Re: how-to update a BGP filter?

Re: how-to update a BGP filter?

how-to update a BGP filter?

Re: Blacklist Filter (Development Topic)

BGP Detection script

HTTPS Download stuck after connected on lan side [SOLVED]

Re: How to hide output of "once"

How to hide output of "once"

Re: Creating Communities to apply to BGP

Re: Creating Communities to apply to BGP

Creating Communities to apply to BGP