If it's not a DNS server for clients just go to IP -> DNS and uncheck "Allow Remote Requests" ... and add firewall rules.
-Rob On Tue, Sep 6, 2016 at 10:17 AM, Jason McKemie < [email protected]> wrote: > Yeah, admittedly I haven't done much other than mess around with some > blacklists on this one. > > On Tue, Sep 6, 2016 at 12:16 PM, Mike Hammett <[email protected]> wrote: > >> Instill some basic network security. I block input to potentially harmful >> ports, but a better way is to only allow input on ports you want. >> >> >> >> ----- >> Mike Hammett >> Intelligent Computing Solutions <http://www.ics-il.com/> >> <https://www.facebook.com/ICSIL> >> <https://plus.google.com/+IntelligentComputingSolutionsDeKalb> >> <https://www.linkedin.com/company/intelligent-computing-solutions> >> <https://twitter.com/ICSIL> >> Midwest Internet Exchange <http://www.midwest-ix.com/> >> <https://www.facebook.com/mdwestix> >> <https://www.linkedin.com/company/midwest-internet-exchange> >> <https://twitter.com/mdwestix> >> The Brothers WISP <http://www.thebrotherswisp.com/> >> <https://www.facebook.com/thebrotherswisp> >> >> >> <https://www.youtube.com/channel/UCXSdfxQv7SpoRQYNyLwntZg> >> ------------------------------ >> *From: *"Jason McKemie" <[email protected]> >> *To: *[email protected] >> *Sent: *Tuesday, September 6, 2016 12:14:31 PM >> *Subject: *Re: [AFMUG] Mikrotik Possibly Compromised >> >> Well, disabling remote requests dropped it off steeply. I'll have to >> look into that. Is that enabled by default? >> >> On Tue, Sep 6, 2016 at 12:13 PM, Bruce Robertson <[email protected]> wrote: >> >>> Good point. >>> >>> On 09/06/2016 10:11 AM, Jason McKemie wrote: >>> >>> I'd think that I would see some internal network activity if this were >>> the case though. Also, the source IPs appear to be from all over the world. >>> >>> On Tue, Sep 6, 2016 at 12:09 PM, Bruce Robertson <[email protected]> wrote: >>> >>>> In my experience, that's usually your mobile devices nattering with >>>> the mother ship, like doing backups and uploading recent pictures. iPhones >>>> are especially bad about this. >>>> >>>> On 09/06/2016 09:57 AM, Jason McKemie wrote: >>>> >>>>> So I've noticed some strange behavior on my home connection >>>>> (Comcast). The Mikrotik that I am using shows a constant Tx on the WAN >>>>> port of around 3-5Mbps and between 200-300pps, Rx is just a few kbps. >>>>> This >>>>> activity appears to be strictly on the WAN port. If I disable a firewall >>>>> rule that accepts input, the activity ceases - but devices behind the >>>>> router lose connectivity. >>>>> >>>>> Any ideas? I've got all IP services disabled except winbox, which is >>>>> restricted to my local network. >>>>> wbr>8! >>>>> >>>> >>>> >>> !DSPAM:2,57cef8d652678869110723! >>> >>> >>> >> >> >
