Tell me what's going on on mikrotik?

Question

Mikrotik

Tell me what's going on on my Mikrotik and in which direction to look? On the WAN port, the speed goes off scale, but on the LAN there. With all this, my Internet falls off. This happens periodically every 2-3 months. From 20 minutes to an hour, then it lets go and again everything works smoothly.

Answer 1

Update the firmware to the latest one.
Block incoming on port 53 over UDP from WAN

Answer 2

Alternatively, you can get ideas from here https://www.youtube.com/watch?v=wGDTWaDL8jc

Answer 3

Show the firewall - very similar to DDoS on the DNS port (53), as they actually write above)

Answer 4

Ddos

Answer 5

Is there no protection against this? What to do in such cases?

Answer 6

In the connection tracker, you can see where they are clinging.
There is a tarpit action in the firewall. It is he who saves well from ddos. He hangs the attacker.
Also, the usual drop in the ravine according to the list
The load will drop, it will end in a few days

Answer 7

Close port 53. A better default firewall pull. Everything is closed there.

Answer 8

Set at least the stock firewall settings (not a panacea)
In the same way, cut the traffic on the incoming interface on port 53.
Further, using a torch with jackdaws for the protocol and port, see who is shitting on the network via the interface. And either block the traffic, or look for someone who is shitting on the network and eliminate him for what he is shitting on.
And Vobshche correctly configured fayervol is necessary. Preferably closed, that is, everything that is not allowed is prohibited.