MikroTik routers are forwarding owners’ traffic to unknown attackers

Article link is down on my end.

My home router has the following

  /ip firewall filter
  add action=accept chain=input connection-state=established
  add action=accept chain=input connection-state=related
  add action=accept chain=input dst-port=5000 protocol=udp
  add action=accept chain=input dst-port=6000 protocol=udp
  add action=accept chain=input dst-port=6001 protocol=udp
  add action=accept chain=input protocol=icmp
  add action=accept chain=input dst-port=22 protocol=tcp src-address-list=Mgmt
  add action=accept chain=input dst-port=179 in-interface-list=LAN protocol=tcp
  add action=drop chain=input in-interface=btopenreach
  add action=drop chain=input

Clearly it's possible that an attacker could come in from the back door (desktop, XSS etc), I could lock down the BGP more, and tighen up Mgmt beyond it's current fairly wide subnets (a /16 owned by work and my wired range), but it becomes a hassle, which leads to more disabling of the "action=drop" while debugging. My backup script emails me when the configuration changes

To check if your proxy is enabled (probably shouldn't be)

  /ip proxy print 
  enabled: no

Also change the winbox port if you need it to be enabled.

Just yesterday updated my Mikrotik to latest current. And now read that news. Great!