Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MikroTik routers are forwarding owners’ traffic to unknown attackers

blog.netlab.360.com

Post reply on HN
Print view View original

111–120 of 151 posts

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#111

Post by jms703 »

technofiend wrote: post #107
Fnoord wrote: post #80

Earlier quoted context omitted.

I didn't know that, wow. I found some resources on this [1] [2] [3] but it seems like everything is working? Have you tried WireGuard on OpenBSD/octeon? [1] https://www.openbsd.org/octeon.html [2] https://news.ycombinator.com/item?id=10079210 [3] https://an.undulating.space/post/180411-erl-openbsd-upgrade/

Not yet... I bought a brand new one just for testing with OpenBSD vs Vyatta because I'd like to benchmark performance of each.

Are you planning to post your benchmarks? Also, any helpful info on getting OpenBSD running on one of these is welcome!

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#112

Post by mrsteveman1 »

ajayh wrote: post #17
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

Maybe something like the PC Engines apu2? http://www.pcengines.ch/apu2.htm x86, can run OpenWRT.

I have an APU2 and it's really the perfect router for any small office or house. Intel NICs, plenty of ram and an mSATA port make it quite capable. I have pfSense on it at the moment, which works very well.

At one point I had an 802.11n card in my older ALIX2D router, but there were stability and performance issues so now I always use a separate access point, most recently a Unifi AC-PRO which has some quirks but works well in general.

I've been happy enough with the x86 routing strategy that when it came time to replace my older Cisco 100mbps switch, I decided to do that with x86 hardware as well. All of the smaller/cheaper gigabit switches either didn't support VLANs, made way too much heat, or had reliability issues, and the ones that were suitable were quite expensive and had reliability issues of their own.

So, I found a Supermicro Atom C2000 board (A1SRM-LN7F[1]) on sale for $90, which has 7 Intel NIC gigabit ports built-in and supports ECC ram. I put it in a Supermicro 1U[2] enclosure along with an Intel PCIe 4x gigabit NIC, for a total of 11 gigabit ports on the switch. I installed Debian on it and set up open-vswitch, which worked but was soon replaced by "vlan-aware" Linux bridging.

It's easily capable of switching gigabit traffic between multiple machines at the same time, ping shows an average latency of 0.310ms, has very low power usage and makes very little heat.

Note that those C2000 Atoms do have a "sudden death" hardware flaw, but Supermicro should have fixed it on more recent inventory, and they will send a "patched" board to replace any that are affected before they fail. The Atom C3000 doesn't have that issue, but I don't think Supermicro (or anyone, really) make any C3000 boards with that many built-in gigabit ports.

[1] http://www.supermicro.com/products/motherboard/Atom/X10/A1SR...

[2] http://www.supermicro.com/products/chassis/1U/510/SC510T-203...

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#113

Post by godzillabrennus »

arminiusreturns wrote: post #41
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even f…

I am a big fan of PFSense. Not a huge fan of Netgate as a company and the direction they are taking the product.

In any case, you can load it onto some fairly low cost hardware for your typical home user. It's fantastic.

I am not a huge fan of the Ubiquiti routers. They required loading a config onto them just to get DHCP enabled and NAT setup for a typical 1 WAN and 1 LAN environment. Why on earth they would ship without that config on them when 99.9999% of environments are like that is bewildering to me.

Don't know if it's changed since then but I haven't gone back to mess with them since.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#114

Post by Kadin »

larkost wrote: post #108
Bluecobra wrote: post #62

Earlier quoted context omitted.

Interesting that the more expensive router has this problem. I've been really happy with my ER-X, it works great with my internet service (500Mbs up/500Mbs down). I had some speed issues at first but this was solved by upgrading to the latest firmware and making sure hardware offloading was enabled.

I was a bit annoyed that hardware routing is not automatically enabled for setups that can use it. It is not hard, but you have to stumble upon the fact that that setting exists (only on the command line).

My recollection is that it's not enabled by default because there were (are?) some features that don't work once you enable it. I assume it's the Deep Packet Inspection and advanced routing type stuff.

(Sadly my home internet connection is too slow to make hardware offloading on the edge router matter...)

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#115

Post by prplhaz4 »

nvarsj wrote: post #82
tolien wrote: post #71

Earlier quoted context omitted.

> There is a longstanding firmware issue that introduces packet loss for routed packets Interesting, do you have any more about this? Got an ER-PoE that intermittently loses packets and have never got to the bottom of why (I gave up and bought a non-Ubnt router, just haven’t got around to configuring it yet).

https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-... I was one of the people involved in some of the measurements on there. I avoid ubnt networking gear in general after that experience (although ER-X seems good and I use one at home as a smart switch). Their specialty is in APs, which work really great.

The last update of the first post says that this was fixed in v1.10.0, and the release notes concur: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E...

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#116

Post by isostatic »

lucb1e wrote: post #110
isostatic wrote: post #6

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=accept chain=input dst-port=5000 protocol=udp add action=accept chain=input dst-port=6000 protocol=udp add action=accept chain=input dst-port=6001 protocol=udp add action=accept chain=input protocol=icmp add action=accept chain=input dst-port…

What OS or software is that? Is that a Mikrotik router with default firmware that accepts such rules as you posted?

Yes, vanilla mikrotik (on the latest firmware -- interface-list is pretty new)

The concept isn't hard -- block non-established incoming traffic from everywhere except where you want management to happen from. I have a few extra rules.

Generally if you leave yourself wide open don't expect to be immune from zero-days.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#117

Post by discreditable »

sokoloff wrote: post #38
discreditable wrote: post #30

Earlier quoted context omitted.

Same case for me. I had an AC88U. I got tired of it because the 5GHz 802.11ac radio seemed like it'd be forever broken in OSS firmwares. I felt asuswrt was pretty crappy too. I went ubiquiti. Their management is nice, and they actually seem interested in fixing bugs in their firmware.

On the AC66U, 5GHz radio seemed to work well and I got consistent 105-ish Mbps in the same room as the AP. (I'm not disputing your experience, but don't want other readers to conclude that 5GHz doesn't work on any of them.)

I could be wrong or things may have changed. I think the core issue was the 88u used a different broadcom wireless chipset which has very poor Linux support.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#118

Post by squarefoot »

godzillabrennus wrote: post #113
arminiusreturns wrote: post #41

Earlier quoted context omitted.

Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even f…

I am a big fan of PFSense. Not a huge fan of Netgate as a company and the direction they are taking the product. In any case, you can load it onto some fairly low cost hardware for your typical home user. It's fantastic. I am not a huge fan of the Ubiquiti routers. They required loading a config onto them just to get DHCP enabled and NAT setup for a typical 1 WAN and 1 LAN environment. Why on earth they would ship wi…

I couldn't recommend PFSense more. Setting up my home firewall years ago using it on a pcengines.ch board was really easy and fun. I used a (now long discontinued) WRAP board back in the day, then when broadband became faster I had to remove it because the slow processor would bottleneck my connection, but I'm looking forward to get faster hardware to have it working again. One day, well over 10 years ago, while I was moving from the old ISP to a new one, they screwed up something and I spent some weeks cut off from the Internet. The WRAP board had a mini-pci connector I already had fitted with a powerful WiFi card, so I connected a high gain directional antenna in place of the low gain one and started monitoring the channels. Back in the day there still were weak WEP encrypted connections, but I was even more lucky because a local ISP which delivered their routers with no default encryption had no less than 3 customers in my neighborhood, one of which, probably an office with no traffic at least since the evening, allowed me to surf a lot faster than my previous connection. PFSense was a godsend because all I had to do was set the rules so that the WLAN interface became a slave seen as the WAN, so I got back online all my cabled home network in a matter of minutes.

As a Linux guy I have to admit PFSense and similar products (NAS4Free etc) interface is the best I have ever seen around wrt functionality and ease of use, sadly OpenWRT web interface simply doesn't stand a chance, and I'm not referring to aesthetics as I'm aware OpenWRT is aimed at hardware with orders of magnitude less resources, but pure functionality - in fact I have never been able to configure a small tp-link mr3020 router to use it as a WiFi bridge for my networked but not wireless printer. Yes it can be done and there is a HOWTO on that task, but it doesn't work and low level iptables scripts aren't exactly my strong point. It would be trivial doing that with PFSense, but sadly it cannot fit into that device. /Rant

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#119

Post by pibefision »

stordoff wrote: post #94
sokoloff wrote: post #19

Earlier quoted context omitted.

I just last weekend retired a pair of Asus RT-AC66U routers/access points. They ran stable for years on Tomato (version tomato-RT-AC66U_AT-RT-AC6x-3.4-140-AIO-64K.trx) and I think all the hardware revisions work, but confirm that yourself. I retired them mostly because the Ubiquiti management is much easier and that hardware also affordable (though the software is not open, so not a fit for your use case).

I've been running a RT-AC68U for a while. Rock solid stable on Asuswrt-Merlin[1] (204 days uptime last I checked, and the last reboot was due to a power cut, and easily get 50MB/s to my file server over wireless). The Asuswrt interface is a little clunky, but once it's set up it works fine. I've recently changed to Tomato (needed VLAN tagging for wireless), which seems just as solid (55-60MB/s to file server), but I…

Same experience here. RT-AC68U flashed with AsusWRT Merlin works great, and I'm using a lot of things: VPN, DNS filters, DNS per mac adddress, etc.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#120

Post by nvarsj »

prplhaz4 wrote: post #115
nvarsj wrote: post #82

Earlier quoted context omitted.

https://community.ubnt.com/t5/EdgeRouter/UDP-packet-loss-on-... I was one of the people involved in some of the measurements on there. I avoid ubnt networking gear in general after that experience (although ER-X seems good and I use one at home as a smart switch). Their specialty is in APs, which work really great.

The last update of the first post says that this was fixed in v1.10.0, and the release notes concur: https://community.ubnt.com/t5/EdgeMAX-Updates-Blog/EdgeMAX-E...

I knew I should have checked the release notes before commenting. No idea if it works but that would be a great improvement.
Post reply on HN