[Snap] High Latency @ Night

Forums › 2degrees (including Slingshot, Orcon, Flip, Stuff Fibre, MyRepublic, 2talk and Vocus) › [Snap] High Latency @ Night

1 | 2

chevrolux

4962 posts

Uber Geek
+1 received by user: 2634
Inactive user

#1343442 15-Jul-2015 07:49

The best thing about Mikrotik is that they come as a blank canvas. No assumptions are made in terms of what configuration is required.
And yea, if you are using it as a local dns server it will listen on ALL interfaces.
First thing to do would be create a 'drop all from wan' rule and then build the required 'accept' rules above that.

sbiddle

30853 posts

Uber Geek
+1 received by user: 10000

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1343447 15-Jul-2015 08:09

Zeon: Thanks for the help Ralph, I think your suggestion was spot on.

For those interested it looks like our router was running an Open DNS resolver being used in a DNS amplification attack.

When I had got the router I only configured the PPP details and WLAN and presumed that the firewall must be preset but obviously not!

It's a Mikrotik RouterOS device. You could access the web control panel, SSH, telnet - pretty much everything over the WAN interface....

The default Mikrotik router configuration has a drop rule on the Ether1.

It's important if you configure a VLAN10 or use PPPoE that you replicate this rule on the VLAN10 or PPPoE inbound interface.

michaelmurfy

meow
13732 posts

Uber Geek
+1 received by user: 11151

Moderator

ID Verified

Trusted

Lifetime subscriber

#1343450 15-Jul-2015 08:17

Damn, I didn't ask that since I presumed you would firewall all the ports :)

I personally always run a port scan via GRC Shield's Up to confirm it is firewalled even if I know it is. With some routers it may surprise you.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup) | Starlink

NZ Politics 2026 Tracking & Quiz: https://nzpol.nz

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Zeon

3932 posts

Uber Geek
+1 received by user: 760

Trusted

#1344690 15-Jul-2015 14:00

Yea, my mistake on that presumption! I struggled to use the web-UI on Mikrotik to configure the firewall - it ended up being the command line was actually more user friendly :S

Speedtest 2019-10-14

1 | 2