Ive run into on at least two occasions where a customer has reched my tcp connection limit and the connections to them never drop. they stay active in the the firewall connections area.
right now i have the action set to reject-tcp reset. is that incorrect? should i be using drop instead? the default timeout values place a drop @ 60 seconds the tcp-reset should be instintainous shouldnt it?
Re: mikrotik tcp connection limit reject or drop
here is the rule in all its printed glory:
2 ;;; tcp connection limit
chain=forward action=reject reject-with=tcp-reset protocol=tcp connection-limit=60,32
2 ;;; tcp connection limit
chain=forward action=reject reject-with=tcp-reset protocol=tcp connection-limit=60,32
Re: mikrotik tcp connection limit reject or drop
try action=reject, but reject-with=icmp-something
Re: mikrotik tcp connection limit reject or drop
so in theory, the connection should die immediatly since it was rejected. ill try it with icmp port unreachable.
Re: mikrotik tcp connection limit reject or drop
so it looks like the connections are still sticking in the firewall even tho the host has long since been turned off.
I was using reject icmp: host unreachable.
The wierd thing im noticing... howcome these tcp connections have a 24 hour timeout? thats not normal is it?
should i try using drop instead of reset?
I was using reject icmp: host unreachable.
The wierd thing im noticing... howcome these tcp connections have a 24 hour timeout? thats not normal is it?
should i try using drop instead of reset?
Re: mikrotik tcp connection limit reject or drop
The difference between reject and drop is whether the requesting ip is notified about the failure. I use drop if there is a chance the source ip has bad intentions. If you feel that is the case, use action=drop. If it is a trusted network, then use action=reject.
Re: mikrotik tcp connection limit reject or drop
typically filesharing or viral. next time i see it ill try changing the rule to drop and see what happens.
Re: mikrotik tcp connection limit reject or drop
According to some texts it is better to use reject instead of drop in case of failure....because DROP could kill your router....and make it unreachable
Re: mikrotik tcp connection limit reject or drop
under attack tarpit made my router unresponsive and internet went down....for local users, not for attacker....
-
-
hossain2004a
Member Candidate
- Posts: 247
- Joined:
- Location: Iran
Re: mikrotik tcp connection limit reject or drop
what kind of attack? brute? DDOS?under attack tarpit made my router unresponsive and internet went down....for local users, not for attacker....
limiting may not be so usefull for DDOS. as i saw in one of thread before
Re: mikrotik tcp connection limit reject or drop
I am not sure, but seemed like DDOS...