Manual:IP/Firewall/Connection tracking: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
← Older edit
 
(22 intermediate revisions by 4 users not shown)
Line 24: Line 24:


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=seen reply
|arg=assured
|type=yes {{!}} no
|type=yes {{!}} no
|desc=
|desc=Indicates that this connection is assured and that it will not be erased if maximum possible tracked connection count is reached.
}}
}}


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=assured
|arg=confirmed
|type=yes {{!}} no
|type=yes {{!}} no
|desc="assured" flag indicates that this connection is assured and that it will not be erased if maximum possible tracked connection count is reached.
|desc=Connection is confirmed and a packet is sent out from the device.
}}
}}


Line 38: Line 38:
|arg=connection-mark
|arg=connection-mark
|type=string
|type=string
|desc=connection mark set by [[M:IP/Firewall/Mangle | mangle]] rule.
|desc=Connection mark that was set by [[M:IP/Firewall/Mangle | mangle]] rule.
}}
}}


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=connection-type
|arg=connection-type
|type=pptp {{!}} ftp {{!}} p2p
|type=pptp {{!}} ftp
|desc=Type of connection, property is empty if connection tracking is unable to determine predefined connection type.
|desc=Type of connection, property is empty if connection tracking is unable to determine predefined connection type.
}}  
}}  
Line 51: Line 51:
|type=ip[:port]
|type=ip[:port]
|desc=Destination address and port (if protocol is port based).
|desc=Destination address and port (if protocol is port based).
}}
{{Mr-arg-ro-table
|arg=dstnat
|type=yes {{!}} no
|desc=Connection has gone through DST-NAT (for example, port forwarding).
}}
{{Mr-arg-ro-table
|arg=dying
|type=yes {{!}} no
|desc=Connection is dying due to connection timeout.
}}
{{Mr-arg-ro-table
|arg=expected
|type=yes {{!}} no
|desc=Connection is setup using connection helpers (pre-defined service rules).
}}
{{Mr-arg-ro-table
|arg=fasttrack
|type=yes {{!}} no
|desc=Whether the connection is FastTracked.
}}
}}


Line 56: Line 80:
|arg=gre-key
|arg=gre-key
|type=integer
|type=integer
|desc=
|desc=Contents of the GRE Key field.
}}
 
{{Mr-arg-ro-table
|arg=gre-protocol
|type=string
|desc=Protocol of the encapsulated payload.
}}
}}


Line 62: Line 92:
|arg=gre-version
|arg=gre-version
|type=string
|type=string
|desc=
|desc=Version of GRE protocol used in the connection.
}}
}}


Line 68: Line 98:
|arg=icmp-code
|arg=icmp-code
|type=string
|type=string
|desc=
|desc=ICMP Code Field
}}
}}


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=icmp-id
|arg=icmp-id
|type=string
|type=integer
|desc=
|desc=Contains the ICMP ID
}}
}}


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=icmp-type
|arg=icmp-type
|type=string
|type=integer
|desc=
|desc=ICMP Type Number
}}
 
{{Mr-arg-ro-table
|arg=orig-bytes
|type=integer
|desc=Amount of bytes sent out from the source address using the specific connection.
}}
 
{{Mr-arg-ro-table
|arg=orig-fasttrack-bytes
|type=integer
|desc=Amount of FastTracked bytes sent out from the source address using the specific connection.
}}
 
{{Mr-arg-ro-table
|arg=orig-fasttrack-packets
|type=integer
|desc=Amount of FastTracked packets sent out from the source address using the specific connection.
}}
 
{{Mr-arg-ro-table
|arg=orig-packets
|type=integer
|desc=Amount of packets sent out from the source address using the specific connection.
}}
}}


{{Mr-arg-ro-table
{{Mr-arg-ro-table
|arg=p2p
|arg=orig-rate
|type=yes {{!}} no
|type=integer
|desc=Shows if connection is identified as p2p by firewall p2p matcher.
|desc=Data rate at which packets are sent out from the source address using the specific connection.
}}
}}


Line 93: Line 147:
|type=string
|type=string
|desc=IP protocol type
|desc=IP protocol type
}}
{{Mr-arg-ro-table
|arg=repl-bytes
|type=integer
|desc=Amount of bytes received from the destination address using the specific connection.
}}
{{Mr-arg-ro-table
|arg=repl-fasttrack-bytes
|type=string
|desc=Amount of FastTracked bytes received from the destination address using the specific connection.
}}
{{Mr-arg-ro-table
|arg=repl-fasttrack-packets
|type=integer
|desc=Amount of FastTracked packets received from the destination address using the specific connection.
}}
{{Mr-arg-ro-table
|arg=repl-packets
|type=integer
|desc=Amount of packets received from the destination address using the specific connection.
}}
{{Mr-arg-ro-table
|arg=repl-rate
|type=string
|desc=Data rate at which packets are received from the destination address using the specific connection.
}}
}}


Line 105: Line 189:
|type=ip[:port]
|type=ip[:port]
|desc=Source address (and port) expected of return packets. Usually the same as "dst-address:port"
|desc=Source address (and port) expected of return packets. Usually the same as "dst-address:port"
}}
{{Mr-arg-ro-table
|arg=seen-reply
|type=yes {{!}} no
|desc=Destination address has replied to the source address.
}}
}}


Line 111: Line 201:
|type=ip[:port]
|type=ip[:port]
|desc=Source address and port (if protocol is port based).
|desc=Source address and port (if protocol is port based).
}}
{{Mr-arg-ro-table
|arg=srcnat
|type=yes {{!}} no
|desc=Connection is going through SRC-NAT, including packets that were masqueraded through NAT.
}}
}}


Line 116: Line 212:
|arg=tcp-state
|arg=tcp-state
|type=string
|type=string
|desc=Current state of TCP connection ( for exampe "established", "time-wait", "close", etc)
|desc=Current state of TCP connection :
* "established"
* "time-wait"
* "close"
* "syn-sent"
* "syn-received"
}}
}}


Line 138: Line 239:
{{Mr-arg-table
{{Mr-arg-table
|arg=enabled
|arg=enabled
|type=yes {{!}} no
|type=yes {{!}} no {{!}} auto
|default=auto
|desc=Allows to disable or enable connection tracking. Disabling connection tracking will cause several firewall features to stop working. See the [[#Features affected by connection tracking | list]] of affected features. Starting from v6.0rc2 default value is auto. Which means that connection tracing is disabled until at least one firewall rule is added.
}}
 
{{Mr-arg-table
|arg=loose-tcp-tracking
|type=yes | no
|default=yes
|default=yes
|desc=Allows to disable or enable connection tracking. Disabling connection tracking will cause several firewall features to stop working. See the [[#Features affected by connection tracking | list]] of affected features.
|desc=Disable picking up already established connections
}}
}}


Line 203: Line 311:
|type=time
|type=time
|default=10s
|default=10s
|desc=
|desc=Specifies the timeout for udp connections that has seen packets in one direction
}}
}}


Line 210: Line 318:
|type=time
|type=time
|default=3m
|default=3m
|desc=
|desc=Specifies the timeout of udp connections that has seen packets in both directions
}}
}}


Line 217: Line 325:
|type=time
|type=time
|default=10s
|default=10s
|desc=
|desc=ICMP connection timeout
}}
}}


{{Mr-arg-table
{{Mr-arg-table-end
|arg=generic-timeout
|arg=generic-timeout
|type=time
|type=time
|default=10m
|default=10m
|desc=Timeout for all other connection entries
|desc=Timeout for all other connection entries
}}
{{Mr-arg-table-end
|arg=tcp-syncookie
|type=yes {{!}} no
|default=no
|desc=
}}
}}


Line 244: Line 345:
|arg=max-entries
|arg=max-entries
|type=integer
|type=integer
|desc=Max amount of entries that connection tracking table can hold. This value depends on installed amount of RAM.
|desc=Max amount of entries that connection tracking table can hold. This value depends on installed amount of RAM. Note that system does not create maximum size connection tracking table when it starts, maximum entry amount can increase if situation demands it and router still has free ram left.
}}
}}


Line 264: Line 365:
** connection-rate
** connection-rate
** layer7-protocol
** layer7-protocol
** p2p
** new-connection-mark
** new-connection-mark
** tarpit
** tarpit
* p2p matching in simple queues


[[Category:Manual|Connection tracking]]
[[Category:Manual|Connection tracking]]
[[Category:IP|Connection tracking]]
[[Category:IP|Connection tracking]]
[[Category:Firewall|Connection tracking]]
[[Category:Firewall|Connection tracking]]
[[Category:Case Studies|Connection tracking]]

Latest revision as of 11:09, 12 April 2019

Connection tracking entries

Sub-menu: /ip firewall connection


There are several ways to see what connections are making their way though the router.

In the Winbox Firewall window, you can switch to the Connections tab, to see current connections to/from/through your router. It looks like this:


Properties

All properties in connection list are read-only

Property Description
assured (yes | no) Indicates that this connection is assured and that it will not be erased if maximum possible tracked connection count is reached.
confirmed (yes | no) Connection is confirmed and a packet is sent out from the device.
connection-mark (string) Connection mark that was set by mangle rule.
connection-type (pptp | ftp) Type of connection, property is empty if connection tracking is unable to determine predefined connection type.
dst-address (ip[:port]) Destination address and port (if protocol is port based).
dstnat (yes | no) Connection has gone through DST-NAT (for example, port forwarding).
dying (yes | no) Connection is dying due to connection timeout.
expected (yes | no) Connection is setup using connection helpers (pre-defined service rules).
fasttrack (yes | no) Whether the connection is FastTracked.
gre-key (integer) Contents of the GRE Key field.
gre-protocol (string) Protocol of the encapsulated payload.
gre-version (string) Version of GRE protocol used in the connection.
icmp-code (string) ICMP Code Field
icmp-id (integer) Contains the ICMP ID
icmp-type (integer) ICMP Type Number
orig-bytes (integer) Amount of bytes sent out from the source address using the specific connection.
orig-fasttrack-bytes (integer) Amount of FastTracked bytes sent out from the source address using the specific connection.
orig-fasttrack-packets (integer) Amount of FastTracked packets sent out from the source address using the specific connection.
orig-packets (integer) Amount of packets sent out from the source address using the specific connection.
orig-rate (integer) Data rate at which packets are sent out from the source address using the specific connection.
protocol (string) IP protocol type
repl-bytes (integer) Amount of bytes received from the destination address using the specific connection.
repl-fasttrack-bytes (string) Amount of FastTracked bytes received from the destination address using the specific connection.
repl-fasttrack-packets (integer) Amount of FastTracked packets received from the destination address using the specific connection.
repl-packets (integer) Amount of packets received from the destination address using the specific connection.
repl-rate (string) Data rate at which packets are received from the destination address using the specific connection.
reply-dst-address (ip[:port]) Destination address (and port) expected of return packets. Usually the same as "src-address:port"
reply-src-address (ip[:port]) Source address (and port) expected of return packets. Usually the same as "dst-address:port"
seen-reply (yes | no) Destination address has replied to the source address.
src-address (ip[:port]) Source address and port (if protocol is port based).
srcnat (yes | no) Connection is going through SRC-NAT, including packets that were masqueraded through NAT.
tcp-state (string) Current state of TCP connection :
  • "established"
  • "time-wait"
  • "close"
  • "syn-sent"
  • "syn-received"
timeout (time) Time after connection will be removed from connection list.

Connection tracking settings

Sub-menu: /ip firewall connection tracking

Properties

Property Description
enabled (yes | no | auto; Default: auto) Allows to disable or enable connection tracking. Disabling connection tracking will cause several firewall features to stop working. See the list of affected features. Starting from v6.0rc2 default value is auto. Which means that connection tracing is disabled until at least one firewall rule is added.
loose-tcp-tracking (yes; Default: yes) Disable picking up already established connections
tcp-syn-sent-timeout (time; Default: 5s) TCP SYN timeout.
tcp-syn-received-timeout (time; Default: 5s) TCP SYN timeout.
tcp-established-timeout (time; Default: 1d) Time when established TCP connection times out.
tcp-fin-wait-timeout (time; Default: 10s)
tcp-close-wait-timeout (time; Default: 10s)
tcp-last-ack-timeout (time; Default: 10s)
tcp-time-wait-timeout (time; Default: 10s)
tcp-close-timeout (time; Default: 10s)
udp-timeout (time; Default: 10s) Specifies the timeout for udp connections that has seen packets in one direction
udp-stream-timeout (time; Default: 3m) Specifies the timeout of udp connections that has seen packets in both directions
icmp-timeout (time; Default: 10s) ICMP connection timeout
generic-timeout (time; Default: 10m) Timeout for all other connection entries


Read-only properties

Property Description
max-entries (integer) Max amount of entries that connection tracking table can hold. This value depends on installed amount of RAM. Note that system does not create maximum size connection tracking table when it starts, maximum entry amount can increase if situation demands it and router still has free ram left.
total-entries (integer) Amount of connections that currently connection table holds.

Features affected by connection tracking

  • NAT
  • firewall:
    • connection-bytes
    • connection-mark
    • connection-type
    • connection-state
    • connection-limit
    • connection-rate
    • layer7-protocol
    • new-connection-mark
    • tarpit
Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:IP/Firewall/Connection_tracking&oldid=33104"