<p dir="ltr">Hi Folarin,</p>
<p dir="ltr">The syntax provided to you by Tayeb combined with the URL shared by Dewole should be sufficient. Just to be clear, you did not get this issue due to the BGP (unless your provider in the past never assigned a public IP to your gateway), it must have been happening before on your router public interface. However you are probably experiencing more traffic consumption because now all your clients can be reached publicly by default. Below are some urls that could help:</p>
<p dir="ltr"><a href="http://wiki.mikrotik.com/wiki/Basic_universal_firewall_script">http://wiki.mikrotik.com/wiki/Basic_universal_firewall_script</a></p>
<p dir="ltr"><a href="http://wiki.mikrotik.com/wiki/Securing_New_RouterOs_Router">http://wiki.mikrotik.com/wiki/Securing_New_RouterOs_Router</a></p>
<p dir="ltr">Finally in case you are based in Nigeria, do note that there is significant local experience on the use of mikrotik ROS, so you may subscribe to the list shared by Dewole if you have any further challenge as there are some local folks in there who may not be on the afnog list</p>
<p dir="ltr">Regards</p>
<p dir="ltr">Sent from my LG G4<br>
Kindly excuse brevity and typos</p>
<div class="gmail_quote">On 25 Feb 2016 11:34, "Folarin Oluwafemi" <<a href="mailto:folarin077@gmail.com">folarin077@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><br></div><div>I was able to run Unix OPENBGPD platform and Snort IDS to highly supress the attack.</div><div><br></div><div>Meanwhile i will take note of the contributions mentioned earlier and try it out.</div><div><br></div><div>Also, my ISP said I should get a perimeter firewall like the Cisco ASA 5500 series.</div><div><br></div><div>Thanks to everyone.<br></div><div><br></div><div>Warm Regards.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 25, 2016 at 10:44 AM, Dewole Ajao <span dir="ltr"><<a href="mailto:dewole@tinitop.com" target="_blank">dewole@tinitop.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
Sorry, we're 4 days late to the rescue... Dropping the incoming DNS
traffic will fix it but tomorrow it will be some other service so
ideally you should filter out access to all local services from your
WAN interfaces. Wrote
<a href="http://dewoleajao.com/blog2/remote-rogues-spoiling-your-web-experience" target="_blank">http://dewoleajao.com/blog2/remote-rogues-spoiling-your-web-experience</a>
last year after seeing same at many Mikrotik all-in-one router
sites.<br>
<br>
And you should join
<a href="http://abuja.forum.org.ng/mailman/listinfo/ngnog-discuss" target="_blank">http://abuja.forum.org.ng/mailman/listinfo/ngnog-discuss</a> too ;-)<br>
<br>
All the best!<span><font color="#888888"><br>
Dewole. <br></font></span><div><div>
<br>
<div>On 2/21/2016 11:24 PM, Folarin
Oluwafemi wrote:<br>
</div>
</div></div><blockquote type="cite"><div><div>
<div dir="ltr">
<div style="font-size:12.8px">Hello Group Members,</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">I recently did BGP peering with my
upstream provider and everything was fine until a few days </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">time when i observe strange
traffic from the interface of my WAN.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">What i saw using torch tool
(network real-time monitor) on Mikrotik was traffic hitting my
WAN</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">interface from IP prefix from
unknown locations hitting my router for DNS service that i
can't </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">explain..</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">I disabled my LAN Public IP block
of <a href="http://196.13.111.0/24" target="_blank">196.13.111.0/24</a> and observed keenly the
scenario and still </div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">observed high traffic coming in.</div>
<div style="font-size:12.8px"> </div>
<div style="font-size:12.8px">Because of this act, i have not
been able to enjoy good internet service from my provider.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">Any filtering mechanism that can
be used or how this attack can be mitigated.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px">Attached is the snapshot of what
am refering to.</div>
<div style="font-size:12.8px"><br>
</div>
<div style="font-size:12.8px"><b>ETHER 5 is the interface facing
my ISP </b></div>
<div style="font-size:12.8px"><b><br>
</b></div>
<div style="font-size:12.8px"><b>ETHER 3 is my LAN interface <a href="http://196.13.111.0/24" target="_blank">196.13.111.0/24</a> disabled<br clear="all">
</b>
<div><br>
</div>
</div>
<div><span style="font-size:12.8px">I need assistance from the
group in helping out.</span><br>
</div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">Regards.</span></div>
-- <br>
<div><font style="color:rgb(0,0,0)" size="2"><span style="font-family:Tahoma;font-weight:bold">I
am what God says I am<br>
</span></font></div>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><span><pre>_______________________________________________
afnog mailing list
<a href="https://www.afnog.org/mailman/listinfo/afnog" target="_blank">https://www.afnog.org/mailman/listinfo/afnog</a></pre>
</span></blockquote>
<br>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div><font style="color:rgb(0,0,0)" size="2"><span style="font-family:Tahoma;font-weight:bold">I am what God says I am<br></span></font></div>
</div>
<br>_______________________________________________<br>
afnog mailing list<br>
<a href="https://www.afnog.org/mailman/listinfo/afnog" rel="noreferrer" target="_blank">https://www.afnog.org/mailman/listinfo/afnog</a><br></blockquote></div>