Page 1 of 1

i think i am hacked, my NAT goes down automatically

Posted: Fri Aug 15, 2014 7:56 pm
by Ximi87
Hello friends.

i have a small network with SXT, OmniTIk and some UBNT antennas.

before 1 week my network it was down. when i entered with winbox i saw that PPPOE client or server was disable..
and NAT (masquarade) too.

this situation was in all my antenas, SXT, and OmniTik.(pppoe and nat was disable)

i changed the password because i thought it was a hacking.

I am right or it is something wrong with my network.

my antenas is 3 years old so i just updated some times nothing change or edit..

Thanks mate

Re: i think i am hacked, my NAT goes down automatically

Posted: Fri Aug 15, 2014 9:57 pm
by CelticComms
Look in the log and see if somebody has accessed the system.

Re: i think i am hacked, my NAT goes down automatically

Posted: Sat Aug 16, 2014 12:11 am
by rextended
Look also:
1) if someone has added scheduled jobs or netwatch event to disable something, reset password, add users, etc.

2) if you have some radius on radius list and on routerboard users "use radius" is active... (nothing to do to hotspot or ppp users)

3) if on system / users are present other users than your administrative accout.

Re: i think i am hacked, my NAT goes down automatically

Posted: Wed Aug 20, 2014 11:02 pm
by Ximi87
CelticComms

I can not see my log because when i saw that problem it wat 7:30 AM and in 4:00 my antenas automatically reboot.(scheduler) and it was clear all my logs.

Do you know how to save logs and before reboot send them by email or IP (lan)...

Thanks

Re: i think i am hacked, my NAT goes down automatically

Posted: Wed Aug 20, 2014 11:05 pm
by Ximi87
rextended

i didn't change anything from 2011 year.
i just updated some times and anything else. i have changed my pass and i made it 12 irregular text...

i am looking now to save my logs and my activity on my antennas and send them by email or IP(lan) but till now nothing...

Do you know how to do that..

Thanks mate :)

Re: i think i am hacked, my NAT goes down automatically

Posted: Wed Aug 27, 2014 2:26 am
by jarda
Set logging to disk. Then you can send log files easily.

Re: i think i am hacked, my NAT goes down automatically

Posted: Wed Sep 24, 2014 5:19 am
by nonac
disable other services

Re: i think i am hacked, my NAT goes down automatically

Posted: Wed Sep 24, 2014 7:46 am
by jarda
You can also log online to remote syslog server or to local disk. Then the logs survive reboot.