Mikrotik feedback please?

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › Mikrotik feedback please?

1 | 2 | 3

MichaelNZ

1594 posts

Uber Geek
+1 received by user: 485

Trusted

Net Trust Ltd

#2017864 17-May-2018 19:14

sbiddle:

And most importantly remember to firewall off the PPPoE client. If you don't you'll be own3d within hours by a DNS amplification attack.

I have done a quick Google and can't find any info on this exploit. Do you have a link please? Thinking about this in terms of the OSI model, I can't get my head around what you are saying.

I'm hoping someone will send me a complete config which I can study.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET

chevrolux

4962 posts

Uber Geek
+1 received by user: 2638
Inactive user

#2017865 17-May-2018 19:18

The DNS forwarder listens on all interfaces, so if you don't firewall off the WAN interface, your router can be used as a DNS forwarder. I put this to the test one day and within the hour it started being smashed.

Will flick you a PM with a link to a config.

Also, the default config that gets loaded on startup is a pretty good guide too.

MichaelNZ

1594 posts

Uber Geek
+1 received by user: 485

Trusted

Net Trust Ltd

#2017866 17-May-2018 19:22

chevrolux:

The DNS forwarder listens on all interfaces, so if you don't firewall off the WAN interface, your router can be used as a DNS forwarder. I put this to the test one day and within the hour it started being smashed.

Ah, ok. I'm with you now.

So can I simply just turn this off?

Do what I have always done which is a combination of running local DNS, DNS server IP by DHCP and manual config.

WFH Linux Systems and Networks Engineer in the Internet industry | Specialising in Mikrotik | APNIC member | Open to job offers | ZL2NET

chevrolux

4962 posts

Uber Geek
+1 received by user: 2638
Inactive user

#2017878 17-May-2018 19:47

MichaelNZ:

chevrolux:

The DNS forwarder listens on all interfaces, so if you don't firewall off the WAN interface, your router can be used as a DNS forwarder. I put this to the test one day and within the hour it started being smashed.

Ah, ok. I'm with you now.

So can I simply just turn this off?

Do what I have always done which is a combination of running local DNS, DNS server IP by DHCP and manual config.

Yea thats fine too...

/ip dns set allow-remote-requests=no

RunningMan

9186 posts

Uber Geek
+1 received by user: 4840

#2018876 19-May-2018 11:34

hio77:
RunningMan:

No way of config for modem parameters then? VPI/VCI etc?

Looks to me like they don't do atm.

To answer my own question, looks like there is some limited support for ATM built in - a number of default configs accessed by VLAN. VPI/VCI 0/100 is amongst them, but no VC-MUX.

Source.

1 | 2 | 3