Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MikroTik routers are forwarding owners’ traffic to unknown attackers

blog.netlab.360.com

Post reply on HN
Print view View original

101–110 of 151 posts

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#101

Post by kbenson »

dang wrote: post #97
kbenson wrote: post #92

Earlier quoted context omitted.

> That requires you to assume the audience is both intellectually capable of understanding a complex proposition Being able to explain a complex topic simply is the point . Knowing how to distill the concept to essential points is useful, and if you can't identify the essential points, you probably don't really understand it. > and that it hasn't been sufficiently biased against or indoctrinated against an opposing v…

Can you please not do flamewars on HN? Such tedious tit-for-tat exchanges aren't of general interest, or even of individual interest once the heat dies down. https://news.ycombinator.com/newsguidelines.html

I didn't consider what I was doing a flame war. I originally honestly asking for more information, and then considered it a conversation on the merits of explaining a topic to a general audience.

That genuinely interests me, which is why I've gotten into conversations on this topic a few times in the past. I understand that others may be uninterested in that or find it tedious, so I'll try to refrain in the future. My apologies.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#102

Post by dang »

kbenson wrote: post #101
dang wrote: post #97

Earlier quoted context omitted.

Can you please not do flamewars on HN? Such tedious tit-for-tat exchanges aren't of general interest, or even of individual interest once the heat dies down. https://news.ycombinator.com/newsguidelines.html

I didn't consider what I was doing a flame war. I originally honestly asking for more information, and then considered it a conversation on the merits of explaining a topic to a general audience. That genuinely interests me, which is why I've gotten into conversations on this topic a few times in the past. I understand that others may be uninterested in that or find it tedious, so I'll try to refrain in the future. M…

Thank you for the polite reply. I admit I didn't read it closely enough to suss out the subtleties. In our experience, when people starting arguing "I didn't say that, I said this" with each other, the conversation is close to informationless and tends only to produce more heat.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#103

Post by LambdaComplex »

ajayh wrote: post #17
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

Maybe something like the PC Engines apu2? http://www.pcengines.ch/apu2.htm x86, can run OpenWRT.

I'm currently using an apu4b4 running OpenBSD as a router; it's been a good way to (as a Linux guy) dip my feet into the BSD ecosystem.

Later today (if all goes well) I'll be adding wifi to it!

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#104

Post by 4ad »

jessaustin wrote: post #95

I always disable winbox on installation. /ip service disable winbox Why would anyone want to use that? My theory is that it has something to do with how in many cases the MT sshd has to be told to figure out the terminal: $ ssh user+t@192.168.88.1 ...and this information is really hard to find. If the terminal settings aren't right and you can't fix them, ssh is unusable and you're stuck with either winbox or webfig.…

Afaik winbox is the only way to reconfigure the device in case of serious IP misconfiguration, or if layer 3 networking does not work for some reason (I just had to debug a switching loop...), as winbox can connect by MAC, rather than IP.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#105

Post by LeoPanthera »

yjftsjthsd-h wrote: post #22
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I know this doesn't help friends and non-technical folks, but I finally gave up and bought an APU[0], installed Debian, and configured dnsmasq+hostapd+iptables. With unattended updates, it was the most secure thing I could think of. Well, I suppose using openbsd would have been potentially more secure, but there were driver issues with the wireless card that I wanted. [0] https://pcengines.ch/apu2.htm

I'm running pfSense on an APU2. Works great. A good option if you don't want the effort of configuring things manually - pfSense has a nice web UI.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#106

Post by doctorpangloss »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

The Netgear Nighthawk series is almost always available on Amazon and is generally well supported by dd-wrt.

Specifically, the best deals can be had on the oldest model, the R6700v3, from an Amazon warehouse deal for $70. This is what I use, and it works without issue with dd-wrt. You'll need to flash it 3 times.

The best device is probably the R7800 model. It uses a very fast, non-Broadcom (OpenWRT-supported), modern chip. The only way this matters in practice is if (1) you have a gigabit Internet connection and (2) if you need QoS turned on for scoring an A+ in "bufferbloat" on speedtest.net--i.e., you play games.

If you don't use QoS, you will be able to serve 1 gigabit with dd-wrt's "Shortcut Forwarding Engine," which is an accelerated "in-Linux-kernel IP packet forwarding engine." If you don't have a gigabit connection, the typical Linux routing stuff that dd-wrt uses is fine.

With regards to model roulette, you can always buy it off eBay for the specific model. These routers are so common I see listing for them in Craigslist in the Bay Area right now.

I would argue the two main reasons to do this are for improved security/stability and QoS. If you're not interested in these features, buy something that Wirecutter recommends in your price range. But compared to $70, I believe a truly decent router can be had for $50 (the Archer series others have mentioned) that is also truly ancient.

The Apple Airport devices run ARM NetBSD and you can SSH into them. The last generation ran NetBSD 7 and executed binaries from NetBSD userspace when compiled statically.

OpenWRT does not ship closed-source Broadcom drivers, so it tends to have worse support across the board. I don't think their OSS-related reasons for doing so are material to you.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#107

Post by technofiend »

Fnoord wrote: post #80
technofiend wrote: post #61

Earlier quoted context omitted.

Sorry for the spam, I seem to post this regularly but the Ubiquiti EdgeRouter Lite will happily run OpenBSD. It supports the onboard packet accelerator with some extra configuration.

I didn't know that, wow. I found some resources on this [1] [2] [3] but it seems like everything is working? Have you tried WireGuard on OpenBSD/octeon? [1] https://www.openbsd.org/octeon.html [2] https://news.ycombinator.com/item?id=10079210 [3] https://an.undulating.space/post/180411-erl-openbsd-upgrade/

Not yet... I bought a brand new one just for testing with OpenBSD vs Vyatta because I'd like to benchmark performance of each.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#108

Post by larkost »

Bluecobra wrote: post #62
nvarsj wrote: post #57

Earlier quoted context omitted.

The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore. The best option in my opinion is something Intel base…

Interesting that the more expensive router has this problem. I've been really happy with my ER-X, it works great with my internet service (500Mbs up/500Mbs down). I had some speed issues at first but this was solved by upgrading to the latest firmware and making sure hardware offloading was enabled.

I was a bit annoyed that hardware routing is not automatically enabled for setups that can use it. It is not hard, but you have to stumble upon the fact that that setting exists (only on the command line).

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#109

Post by ptomato »

technofiend wrote: post #61
arminiusreturns wrote: post #41

Earlier quoted context omitted.

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even f…

Sorry for the spam, I seem to post this regularly but the Ubiquiti EdgeRouter Lite will happily run OpenBSD. It supports the onboard packet accelerator with some extra configuration.

Do you have any documentation on using the onboard packet accelerator with OpenBSD? I thought it was just binary linux blobs.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#110

Post by lucb1e »

isostatic wrote: post #6

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=accept chain=input dst-port=5000 protocol=udp add action=accept chain=input dst-port=6000 protocol=udp add action=accept chain=input dst-port=6001 protocol=udp add action=accept chain=input protocol=icmp add action=accept chain=input dst-port…

What OS or software is that? Is that a Mikrotik router with default firmware that accepts such rules as you posted?
Post reply on HN