How to properly configure Firewall on Mikrotik?

Question

Mikrotik

The office has Mikrotik RB4011iGS + 5HacQ2HnD ROS 6.45.6 (stable)
After going to a remote location, I set up OpenVPN on it to access work computers and services in the office.
Now he began to be stupid: periodically, but not often, some clients fall off and cannot enter back.
I found the following entries in the logs:
sent P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=a94ba0e3e11918b pid=0 DATA len=0
no more listening for incoming connections: too busy

And there are a lot of these hapises, and they are from a large number of IPs.
I found instructions on the net on how to set up firewall rules to block a link
. In a day, he has already blocked about a thousand addresses, but this log is still pouring.
Tell me how to set it up correctly?

Answer 1

For starters, you should upgrade to the current stable or long-term version. Looks like you've been scammed/pissed off.
Next, we somehow identify malware (brute-forcers) and enter their address list (here !! you need to be careful !!, so as not to shoot yourself in the foot). We create a rule in firewall raw and block everyone from this list there.

Answer 2

Well, too busy, as it were, hints that they are ddosing. If it is impossible to determine the IP range from which "honest" users go, then you can try changing the port on which openvpn listens

Answer 3

It’s not stupid for the connections, but for another reason, the connections and the firewall have nothing to do with it so that the asshole of the router needs to be sent tens of thousands of connections per minute

Answer 4

Don't forget to see how NOT to set up a firewall on MikroTik: https://mikrotik.wiki/wiki/Firewall:False...