Mikrotik router, traffic is leaking. How to find the reason?

Question

Mikrotik

Good evening! There is Mikrotik 951G in the house as a home router. Began to notice a traffic leak, and outgoing! I noticed from the graphs of using the l2tp interface.

Even at night, it is present when all computers, phones, tablets are turned off 100%. For check pulled out a cable to the computer - the traffic flows away. Through a computer that is connected with a cord, turn off wifi - traffic flows. As soon as I turn on the l2tp interface, it immediately leaks. Moreover, the resources are dynamically changing and simply prohibiting outgoing to a specific address will not work. Addresses of any hosters or providers.
Please, help with advice on how to find the cause of this.

Answer 1

There was a similar case, the DNS service turned out to be open from the outside and it was actively used.
Calculated using /tool ​​torch and /tool ​​profile. Closed port 53 on the external interface and everything became normal.

ip firewall filter add chain=input dst-address=1.2.3.4 protocol=udp dst-port=53 action=drop

Answer 2

Why are you so chopping off the shoulder? Too brutal, you need a more elegant colleague, more elegant!

/ip firewall filter
add action=add-src-to-address-list address-list="dns flood" address-list-timeout=1h chain=input dst-port=53 in-interface=ether1 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp src-address-list="dns flood"