交流 › RouterOS › ROS3.30 网吧防火墙脚本 大家测试一下 免费

sony1208 发表于 2011-12-14 08:26:52

ROS3.30 网吧防火墙脚本 大家测试一下 免费

本帖最后由 sony1208 于 2011-12-15 08:22 编辑

一个网吧防火墙脚本 大家测试一下 据说不错

viyin 发表于 2011-12-14 11:38:02

不太敢用。

txally 发表于 2011-12-14 11:48:30

谁敢试？

等待结果中。。。

twinsandme3 发表于 2011-12-14 14:19:46

:L
叫人试还要钱？

47771885 发表于 2011-12-14 16:12:03

呵呵 呵呵 楼主最近手头紧。。。。什么都搬出来了。。。防火墙？防火墙？:lol

sony1208 发表于 2011-12-15 08:23:12

免费了~ 大家实验下~

839551876 发表于 2011-12-28 16:03:34

防火墙？防火墙？

839551876 发表于 2011-12-28 16:04:35

/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=30s \
    tcp-established-timeout=5d tcp-fin-wait-timeout=2m \
    tcp-close-wait-timeout=1m tcp-last-ack-timeout=30s \
    tcp-time-wait-timeout=2m tcp-close-timeout=10s udp-timeout=30s \
    udp-stream-timeout=3m icmp-timeout=30s generic-timeout=10m
/ ip firewall filter
add chain=input connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=input connection-state=related action=accept comment="accept related \
    packets" disabled=no
add chain=input connection-state=established action=accept comment="accept \
    established packets" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and \
    drop port scan connections" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
    action=tarpit comment="suppress DoS attack" disabled=no
add chain=input protocol=tcp connection-limit=10,32 \
    action=add-src-to-address-list address-list=black_list \
    address-list-timeout=1d comment="detect DoS attack" disabled=no
add chain=input dst-address-type=!local action=drop comment="drop all that is \
    not to local" disabled=no
add chain=input src-address-type=!unicast action=drop comment="drom all that \
    is not from unicast" disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to \
    chain ICMP" disabled=no
add chain=input action=jump jump-target=services comment="jump to chain \
    services" disabled=no
add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS \
    request" disabled=no
add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS \
    request" disabled=no
add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept \
    comment="accept localhost" disabled=no
add chain=services protocol=tcp dst-port=20-21 action=accept comment="allow \
    ftp" disabled=no
add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, \
    ssh" disabled=no
add chain=services protocol=tcp dst-port=23 action=accept comment="allow \
    telnet" disabled=no
add chain=services protocol=tcp dst-port=80 action=accept comment="allow http, \
    webbox" disabled=no
add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow \
    winbox" disabled=no
add chain=services protocol=udp dst-port=20561 action=accept comment="allow \
    MACwinbox " disabled=no
add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth \
    server" disabled=no
add chain=services protocol=udp dst-port=5678 action=accept comment=" MT \
    Discovery Protocol" disabled=no
add chain=services protocol=udp dst-port=1701 action=accept comment="allow \
    L2TP" disabled=no
add chain=services protocol=tcp dst-port=1723 action=accept comment="allow \
    PPTP" disabled=no
add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" \
    disabled=no
add chain=services protocol=ipencap action=accept comment="allow IPIP" \
    disabled=no
add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" \
    disabled=no
add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" \
    disabled=no
add chain=services protocol=udp dst-port=67-68 action=accept comment="allow \
    DHCP" disabled=no
add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web \
    Proxy" disabled=no
add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" \
    disabled=no
add chain=services protocol=tcp dst-port=161 action=accept comment="allow \
    SNMP" disabled=no
add chain=services protocol=tcp dst-port=443 action=accept comment="allow \
    https for Hotspot" disabled=no
add chain=services protocol=tcp dst-port=1080 action=accept comment="allow \
    Socks for Hotspot" disabled=no
add chain=services protocol=udp dst-port=500 action=accept comment="allow \
    IPSec connections" disabled=no
add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" \
    disabled=no
add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" \
    disabled=no
add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" \
    disabled=no
add chain=services protocol=udp dst-port=520-521 action=accept comment="allow \
    RIP" disabled=no
add chain=services protocol=ospf action=accept comment="allow OSPF" \
    disabled=no
add chain=services protocol=udp dst-port=5000-5100 action=accept \
    comment="allow BGP" disabled=no
add chain=services protocol=tcp dst-port=1720 action=accept comment="allow \
    Telephony" disabled=no
add chain=services protocol=udp dst-port=1719 action=accept comment="allow \
    Telephony" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=forward connection-state=related action=accept comment="accept \
    related packets" disabled=no
add chain=forward connection-state=established action=accept comment="accept \
    established packets" disabled=no
add chain=forward src-address-type=!unicast action=drop comment="drop all that \
    is not from unicast" disabled=no
add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to \
    chain ICMP" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to virus chain" \
    disabled=no
add chain=forward action=accept comment="Accept everything else" disabled=no
add chain=output protocol=tcp dst-port=53 action=accept comment="allow DNS \
    request" disabled=no
add chain=output protocol=udp dst-port=53 action=accept comment="Allow DNS \
    request" disabled=no
add chain=output connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=output connection-state=related action=accept comment="accept \
    related packets" disabled=no
add chain=output connection-state=established action=accept comment="accept \
    established packets" disabled=no
add chain=output protocol=icmp action=accept comment="" disabled=no
add chain=output action=drop comment="Drop all connections from this router" \
    disabled=no
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop \
    Blaster Worm" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop \
    Messenger Worm" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster \
    Worm" disabled=no
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster \
    Worm" disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="________" \
    disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \
    disabled=no
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \
    disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \
    disabled=no
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \
    disabled=no
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \
    disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \
    disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
    disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" \
    disabled=no
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \
    disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \
    disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \
    disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \
    disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop \
    Beagle.C-K" disabled=no
add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop \
    MyDoom" disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \
    OptixPro" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" \
    disabled=no
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" \
    disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \
    disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \
    disabled=no
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop \
    Dabber.A-B" disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop \
    Dumaru.Y" disabled=no
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop \
    MyDoom.B" disabled=no
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \
    disabled=no
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \
    disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop \
    SubSeven" disabled=no
add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \
    Gaobot" disabled=no

839551876 发表于 2011-12-28 16:05:10

看不明。看看能不能解释下

zlw8677 发表于 2012-7-12 15:20:06

看看呢!!!!!!!!!!

查看完整版本: ROS3.30 网吧防火墙脚本 大家测试一下 免费