大家来找错，关于放火墙规则问题！

gugengen

我导入了下面的防火墙规则，出现了以下几个问题，

1>使用以后内网的管理无发打开,就是http://192.168.0.1打不开了,Winbox可以正常连接
2>内部网映射的WEB服务器，外网能打开,局域网打不开,

望高手告诉我哪个规则导致了上面所提的问题

#使用方法：将此文本文件扩展名改为 .rsc
#登录你的ＲＯＳ的ＦＴＰ，上传此文件
#在控制台（可用winbox 里的New Terminal）执行命令：
# /import rosofficial.rsc

#注意这里的设置中假定你的外网网卡的名字是 wan
#需要视情况修改（查找 / 替换）。

#关于ＴＣＰ连接的一些设置，主要是减少连接的存活时间
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m \
  tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
  tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
  tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
  udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m


#删除已有的防火墙(如果有的话)
:foreach i in [/ip firewall filter find] do {/ip firewall filter remove $i}

#导入 routeros 官方防火墙脚本,这是神仙在bbs.router.net.cn上看到的。
#http://www.router.net.cn/softrouter/RouterOS/200602/3807.html
#参考manual.pdf   P383/615 ,  396/628
# TCP/UDP packets with different destination ports coming from the same host would be treated as port scan sequence
#在短时间内从同一地址用不断变化的端口向本机发送大量数据包，视为端口扫描
#短时间内同时建立大量TCP连接(超过10) ,视为 DoS 拒绝服务攻击, 进黑名单一天!
#黑名单上的只能建立三个并发连接,　tarpit，是不是打太极　:-)
#内网的数据包不转发
#禁止从路由主机ping外网


/ ip firewall filter

#针对路由主机的，input
add chain=input connection-state=established action=accept comment="accept established connection packets" disabled=no
add chain=input connection-state=related action=accept comment="accept related  connection packets" disabled=no
add chain=input connection-state=invalid action=drop comment="drop invalid packets" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and  drop port scan connections" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit comment="suppress DoS attack" disabled=no
add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list address-list-timeout=1d comment="detect DoS attack" disabled=no
add chain=input dst-address-type=!local action=drop comment="drop all that is  not to local" disabled=no
add chain=input src-address-type=!unicast action=drop comment="drop all that is not from unicast" disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to chain ICMP" disabled=no
add chain=input action=jump jump-target=services comment="jump to chain services" disabled=no
add chain=input action=log log-prefix="input" comment="log everything else" disabled=yes
add chain=input action=drop comment="drop everything else" disabled=no

#针对ICMP数据包
add chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept comment="0:0 allow ping and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5 action=accept comment="3:3 allow trace and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5 action=accept comment="3:4 allow MTU discovery and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept comment="8:0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept comment="11:0 allow TTL exceeded and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp action=drop comment="Drop everything else" disabled=no

#路由主机上开启的一些端口，用于路由器上的网络服务。默认没有启用几个
add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept comment="accept localhost" disabled=no
add chain=services protocol=tcp dst-port=20-21 action=accept comment="allow ftp" disabled=no
add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, ssh" disabled=no
add chain=services protocol=tcp dst-port=23 action=accept comment="allow telnet" disabled=no
add chain=services protocol=tcp dst-port=80 action=accept comment="allow http, webbox" disabled=no
add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow winbox" disabled=no
add chain=services protocol=udp dst-port=20561 action=accept comment="allow MACwinbox " disabled=no
add chain=services src-address=159.148.172.205 protocol=tcp dst-port=7828 action=accept comment="..." disabled=no
#
add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth server" disabled=yes
add chain=services protocol=udp dst-port=5678 action=accept comment=" MT Discovery Protocol" disabled=yes
add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS request" disabled=yes
add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS request" disabled=yes
add chain=services protocol=udp dst-port=1701 action=accept comment="allow L2TP" disabled=yes
add chain=services protocol=tcp dst-port=1723 action=accept comment="allow PPTP" disabled=yes
add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" disabled=yes
add chain=services protocol=ipencap action=accept comment="allow IPIP" disabled=yes
add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" disabled=yes
add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" disabled=yes
add chain=services protocol=udp dst-port=67-68 action=accept comment="allow DHCP" disabled=yes
add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web Proxy" disabled=yes
add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" disabled=yes
add chain=services protocol=tcp dst-port=161 action=accept comment="allow SNMP" disabled=yes
add chain=services protocol=tcp dst-port=443 action=accept comment="allow https for Hotspot" disabled=yes
add chain=services protocol=tcp dst-port=1080 action=accept comment="allow Socks for Hotspot" disabled=yes
add chain=services protocol=udp dst-port=500 action=accept comment="allow IPSec connections" disabled=yes
add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" disabled=yes
add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" disabled=yes
add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" disabled=yes
add chain=services protocol=udp dst-port=520-521 action=accept comment="allow RIP" disabled=yes
add chain=services protocol=ospf action=accept comment="allow OSPF" disabled=yes
add chain=services protocol=udp dst-port=5000-5100 action=accept comment="allow BGP" disabled=yes
add chain=services protocol=tcp dst-port=1720 action=accept comment="allow Telephony" disabled=yes
add chain=services protocol=udp dst-port=1719 action=accept comment="allow Telephony" disabled=yes
add chain=services protocol=vrrp action=accept comment="allow VRRP " disabled=yes

#丢弃已知的病毒特征包 virus
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop Blaster Worm" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop Messenger Worm" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster Worm" disabled=no
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster Worm" disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="________"   disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" disabled=no
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" disabled=no
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" disabled=no
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" disabled=no
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop Beagle.C-K" disabled=no
add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop MyDoom" disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor OptixPro" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" disabled=no
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop Dabber.A-B" disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop Dumaru.Y" disabled=no
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop MyDoom.B" disabled=no
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" disabled=no
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop SubSeven" disabled=no
add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, Gaobot" disabled=no

#转发的数据包 forward
add chain=forward connection-state=established action=accept comment="accept  established packets" disabled=no
add chain=forward connection-state=related action=accept comment="accept related packets" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid packets" disabled=no
add chain=forward src-address-type=!unicast action=drop comment="drop all that is not from unicast" disabled=no
add chain=forward in-interface=wan src-address-list=not_in_wan action=drop comment="drop data from bogon IP's" disabled=no
add chain=forward in-interface=!wan dst-address-list=not_in_wan action=drop comment="drop data to bogon IP's" disabled=no
add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to chain ICMP" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to virus chain" disabled=no
add chain=forward action=accept comment="Accept everything else" disabled=no

#从路由主机访问外网的数据包　output
add chain=output connection-state=invalid action=drop comment="drop invalid packets" disabled=no
add chain=output connection-state=related action=accept comment="accept related packets" disabled=no
add chain=output connection-state=established action=accept comment="accept established packets" disabled=no
add chain=output action=drop comment="Drop all connections from this router" disabled=no

#定义内网特殊地址列表 bogon IP
/ ip firewall address-list
add list=not_in_wan address=0.0.0.0/8 comment="" disabled=no
add list=not_in_wan address=172.16.0.0/12 comment="" disabled=no
add list=not_in_wan address=192.168.0.0/16 comment="" disabled=no
add list=not_in_wan address=10.0.0.0/8 comment="" disabled=no
add list=not_in_wan address=169.254.0.0/16 comment="" disabled=no
add list=not_in_wan address=127.0.0.0/8 comment="" disabled=no
add list=not_in_wan address=224.0.0.0/3 comment="" disabled=no

#默认设置，没什么改变　 connection helper
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=no
set irc ports=6667 disabled=no
set h323 disabled=yes
set quake3 disabled=no
set mms disabled=no
set gre disabled=yes
set pptp disabled=yes

hangzhoucong

add chain=services protocol=tcp dst-port=80 action=accept comment="allow http, webbox" disabled=no

把80改为别的，如8180，然后用http://192.168.0.1:8180就可以进去了

g1325

我也来贴个
200用户10M流量下Load10-16%
里面有几位大侠的内容

# nov/10/2006 10:12:01 by RouterOS 2.9.6
# software id =
#
#使用时将内网网卡名称改成Lan,将外网网卡名称改为Wan,注意大小写;也可以将Lan,Wan全部替换成你网卡对应的名称
#将些文件上传到ftp里，执行im wall.rsc导入
#
#减少连接有效时间 提高效率
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m \
  tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
  tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
  tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
  udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m
#以下防火墙
/ ip firewall filter
add chain=input src-address-list="port scanners" action=drop comment="dropping \
    port scanners" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=1d comment="Port \
    scanners to list " disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=1d comment="NMAP FIN Stealth scan" disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=1d comment="SYN/FIN \
    scan" disabled=no
add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=1d comment="SYN/RST \
    scan" disabled=no
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=1d comment="FIN/PSH/URG scan" disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=1d comment="ALL/ALL scan" disabled=no
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=1d comment="NMAP NULL scan" disabled=no
add chain=input src-address-list=black_list action=drop comment="drop black \
    list" disabled=no
add chain=input connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=input connection-state=established action=accept comment="accept \
    established connection packets" disabled=no
add chain=input connection-state=related action=accept comment="accept related \
    connection packets" disabled=no
add chain=input connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and  \
    drop port scan connections" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
    action=tarpit comment="suppress DoS attack" disabled=no
add chain=input protocol=tcp connection-limit=10,32 \
    action=add-src-to-address-list address-list=black_list \
    address-list-timeout=1d comment="detect DoS attack" disabled=no
add chain=input dst-address-type=!local action=drop comment="drop all that is  \
    not to local" disabled=no
add chain=input src-address-type=!unicast action=drop comment="drop all that \
    is not from unicast" disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to \
    chain ICMP" disabled=no
add chain=input action=jump jump-target=services comment="jump to chain \
    services" disabled=no
add chain=input action=jump jump-target=virus comment="jump to virus" \
    disabled=no
add chain=input action=log log-prefix="input" comment="log everything else" \
    disabled=yes
add chain=input action=drop comment="drop everything else" disabled=no
add chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept \
    comment="0:0 allow ping and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5 action=accept \
    comment="3:3 allow trace and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5 action=accept \
    comment="3:4 allow MTU discovery and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept \
    comment="8:0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept \
    comment="11:0 allow TTL exceeded and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp action=drop comment="Drop everything else" \
    disabled=no
add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept \
    comment="accept localhost" disabled=no
add chain=services protocol=tcp dst-port=21 action=accept comment="allow ftp" \
    disabled=no
add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, \
    ssh" disabled=yes
add chain=services protocol=tcp dst-port=23 action=accept comment="allow \
    telnet" disabled=yes
add chain=services protocol=tcp dst-port=80 action=accept comment="allow http, \
    webbox" disabled=yes
add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow \
    winbox" disabled=no
add chain=services protocol=udp dst-port=20561 action=accept comment="allow \
    MACwinbox " disabled=no
add chain=services src-address=159.148.172.205 protocol=tcp dst-port=7828 \
    action=accept comment="..." disabled=yes
add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth \
    server" disabled=yes
add chain=services protocol=udp dst-port=5678 action=accept comment=" MT \
    Discovery Protocol" disabled=yes
add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS \
    request" disabled=no
add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS \
    request" disabled=no
add chain=services protocol=udp dst-port=1701 action=accept comment="allow \
    L2TP" disabled=yes
add chain=services protocol=tcp dst-port=1723 action=accept comment="allow \
    PPTP" disabled=yes
add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" \
    disabled=yes
add chain=services protocol=ipencap action=accept comment="allow IPIP" \
    disabled=yes
add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" \
    disabled=yes
add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" \
    disabled=yes
add chain=services protocol=udp dst-port=67-68 action=accept comment="allow \
    DHCP" disabled=yes
add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web \
    Proxy" disabled=yes
add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" \
    disabled=yes
add chain=services protocol=tcp dst-port=161 action=accept comment="allow \
    SNMP" disabled=yes
add chain=services protocol=tcp dst-port=443 action=accept comment="allow \
    https for Hotspot" disabled=yes
add chain=services protocol=tcp dst-port=1080 action=accept comment="allow \
    Socks for Hotspot" disabled=yes
add chain=services protocol=udp dst-port=500 action=accept comment="allow \
    IPSec connections" disabled=yes
add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" \
    disabled=yes
add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" \
    disabled=yes
add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" \
    disabled=yes
add chain=services protocol=udp dst-port=520-521 action=accept comment="allow \
    RIP" disabled=yes
add chain=services protocol=ospf action=accept comment="allow OSPF" \
    disabled=yes
add chain=services protocol=udp dst-port=5000-5100 action=accept \
    comment="allow BGP" disabled=yes
add chain=services protocol=tcp dst-port=1720 action=accept comment="allow \
    Telephony" disabled=yes
add chain=services protocol=udp dst-port=1719 action=accept comment="allow \
    Telephony" disabled=yes
add chain=services protocol=vrrp action=accept comment="allow VRRP " \
    disabled=yes
add chain=output connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=output connection-state=related action=accept comment="accept \
    related packets" disabled=no
add chain=output connection-state=established action=accept comment="accept \
    established packets" disabled=no
add chain=output action=jump jump-target=services comment="jump to services" \
    disabled=no
add chain=output action=drop comment="Drop all connections from this router" \
    disabled=no
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="drop share" \
    disabled=no
add chain=virus protocol=tcp dst-port=82 action=drop \
    comment="Worm.NetSky.Y@mm" disabled=no
add chain=virus protocol=tcp dst-port=113 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-1" disabled=no
add chain=virus protocol=tcp dst-port=2041 action=drop \
    comment="W33.Korgo.A/B/C/D/E/F-2" disabled=no
add chain=virus protocol=tcp dst-port=3067 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-3" disabled=no
add chain=virus protocol=tcp dst-port=6667 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-4" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-5" disabled=no
add chain=virus protocol=tcp dst-port=1000-1001 action=drop \
    comment="Backdoor.Nibu.B-1" disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop \
    comment="Backdoor.Nibu.B-2" disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop \
    comment="Backdoor.Nibu.E/G/H" disabled=no
add chain=virus protocol=tcp dst-port=3422 action=drop \
    comment="Backdoor.IRC.Aladinz.R-1" disabled=no
add chain=virus protocol=tcp dst-port=43958 action=drop \
    comment="Backdoor.IRC.Aladinz.R-2" disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop \
    comment="W32.Dabber.A/B-1" disabled=no
add chain=virus protocol=tcp dst-port=8967 action=drop \
    comment="W32.Dabber.A/B-2" disabled=no
add chain=virus protocol=tcp dst-port=6789 action=drop \
    comment="Worm.NetSky.S/T/U@mm" disabled=no
add chain=virus protocol=tcp dst-port=8787 action=drop \
    comment="Back.Orifice.2000.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=8879 action=drop \
    comment="Back.Orifice.2000.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=31666 action=drop \
    comment="Back.Orifice.2000.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=31337-31338 action=drop \
    comment="Back.Orifice.2000.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=54320-54321 action=drop \
    comment="Back.Orifice.2000.Trojan-5" disabled=no
add chain=virus protocol=tcp dst-port=12345-12346 action=drop \
    comment="Block.NetBus.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=20034 action=drop \
    comment="Block.NetBus.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=21554 action=drop \
    comment="GirlFriend.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=41 action=drop \
    comment="DeepThroat.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3150 action=drop \
    comment="DeepThroat.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=999 action=drop \
    comment="DeepThroat.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=6670 action=drop \
    comment="DeepThroat.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=6771 action=drop \
    comment="DeepThroat.Trojan-5" disabled=no
add chain=virus protocol=tcp dst-port=60000 action=drop \
    comment="DeepThroat.Trojan-6" disabled=no
add chain=virus protocol=tcp dst-port=2140 action=drop \
    comment="DeepThroat.Trojan-7" disabled=no
add chain=virus protocol=tcp dst-port=10067 action=drop \
    comment="Portal.of.Doom.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=10167 action=drop \
    comment="Portal.of.Doom.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=3700 action=drop \
    comment="Portal.of.Doom.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=9872-9875 action=drop \
    comment="Portal.of.Doom.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=6883 action=drop \
    comment="Delta.Source.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=26274 action=drop \
    comment="Delta.Source.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop \
    comment="Delta.Source.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=47262 action=drop \
    comment="Delta.Source.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=3791 action=drop \
    comment="Eclypse.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3801 action=drop \
    comment="Eclypse.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=65390 action=drop \
    comment="Eclypse.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=5880-5882 action=drop \
    comment="Y3K.RAT.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5888-5889 action=drop \
    comment="Y3K.RAT.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=30100-30103 action=drop \
    comment="NetSphere.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=30133 action=drop \
    comment="NetSphere.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=7300-7301 action=drop \
    comment="NetMonitor.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=7306-7308 action=drop \
    comment="NetMonitor.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=79 action=drop \
    comment="FireHotcker.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5031 action=drop \
    comment="FireHotcker.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=5321 action=drop \
    comment="FireHotcker.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=6400 action=drop \
    comment="TheThing.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=1047 action=drop \
    comment="GateCrasher.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=6969-6970 action=drop \
    comment="GateCrasher.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=2774 action=drop comment="SubSeven-1" \
    disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="SubSeven-2" \
    disabled=no
add chain=virus protocol=tcp dst-port=1243 action=drop comment="SubSeven-3" \
    disabled=no
add chain=virus protocol=tcp dst-port=1234 action=drop comment="SubSeven-4" \
    disabled=no
add chain=virus protocol=tcp dst-port=6711-6713 action=drop \
    comment="SubSeven-5" disabled=no
add chain=virus protocol=tcp dst-port=16959 action=drop comment="SubSeven-7" \
    disabled=no
add chain=virus protocol=tcp dst-port=11000 action=drop \
    comment="Senna.Spy.Trojan-1 洛奇" disabled=no
add chain=virus protocol=tcp dst-port=25685-25686 action=drop \
    comment="Moonpie.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=25982 action=drop \
    comment="Moonpie.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop \
    comment="NetSpy.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=1033 action=drop \
    comment="NetSpy.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=31337-31339 action=drop \
    comment="NetSpy.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=8102 action=drop comment="Trojan" \
    disabled=no
add chain=virus protocol=tcp dst-port=7306 action=drop \
    comment="Netspy3.0Trojan" disabled=no
add chain=virus protocol=tcp dst-port=8011 action=drop comment="WAY.Trojan" \
    disabled=no
add chain=virus protocol=tcp dst-port=7626 action=drop comment="Trojan.BingHe" \
    disabled=no
add chain=virus protocol=tcp dst-port=19191 action=drop \
    comment="Trojan.NianSeHoYian" disabled=no
add chain=virus protocol=tcp dst-port=23444-23445 action=drop \
    comment="NetBull.Trojan" disabled=no
add chain=virus protocol=tcp dst-port=2583 action=drop \
    comment="WinCrash.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3024 action=drop \
    comment="WinCrash.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=4092 action=drop \
    comment="WinCrash.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=5714 action=drop \
    comment="WinCrash.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=1010-1012 action=drop \
    comment="Doly1.0/1.35/1.5trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=1015 action=drop \
    comment="Doly1.0/1.35/1.5trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=1999 action=drop \
    comment="TransScout.Trojan-1 " disabled=no
add chain=virus protocol=tcp dst-port=9878 action=drop \
    comment="TransScout.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=2773 action=drop \
    comment="Backdoor.YAI..Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=7215 action=drop \
    comment="Backdoor.YAI.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=54283 action=drop \
    comment="Backdoor.YAI.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=1003 action=drop \
    comment="BackDoorTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5598 action=drop \
    comment="BackDoorTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=5698 action=drop \
    comment="BackDoorTrojan-3" disabled=no
add chain=virus protocol=tcp dst-port=2716 action=drop \
    comment="PrayerTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=21544 action=drop \
    comment="SchwindlerTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=31554 action=drop \
    comment="SchwindlerTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=18753 action=drop \
    comment="Shaft.DDoS.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=20432 action=drop \
    comment="Shaft.DDoS.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=65000 action=drop \
    comment="Devil.DDoS.Trojan" disabled=no
add chain=virus protocol=tcp dst-port=11831 action=drop \
    comment="LatinusTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=29559 action=drop \
    comment="LatinusTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=1784 action=drop \
    comment="Snid.X2Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3586 action=drop \
    comment="Snid.X2Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=7609 action=drop \
    comment="Snid.X2Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=12348-12349 action=drop \
    comment="BionetTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=12478 action=drop \
    comment="BionetTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=57922 action=drop \
    comment="BionetTrojan-3" disabled=no
add chain=virus protocol=tcp dst-port=3127-3198 action=drop \
    comment="Worm.Novarg.a.Mydoom.a.-1" disabled=no
add chain=virus protocol=tcp dst-port=6777 action=drop \
    comment="Worm.BBeagle.a.Bagle.a." disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop \
    comment="Worm.BBeagle.b" disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop \
    comment="Worm.BBeagle.c-g/j-l" disabled=no
add chain=virus protocol=tcp dst-port=2556 action=drop \
    comment="Worm.BBeagle.p/q/r/n" disabled=no
add chain=virus protocol=tcp dst-port=20742 action=drop \
    comment="Worm.BBEagle.m-2" disabled=no
add chain=virus protocol=tcp dst-port=4751 action=drop \
    comment="Worm.BBeagle.s/t/u/v" disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop \
    comment="Worm.BBeagle.aa/ab/w/x-z-2" disabled=no
add chain=virus protocol=tcp dst-port=5238 action=drop \
    comment="Worm.LovGate.r.RpcExploit" disabled=no
add chain=virus protocol=tcp dst-port=1068 action=drop comment="Worm.Sasser.a" \
    disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop \
    comment="Worm.Sasser.b/c/f" disabled=no
add chain=virus protocol=tcp dst-port=9996 action=drop \
    comment="Worm.Sasser.b/c/f" disabled=no
add chain=virus protocol=tcp dst-port=9995 action=drop comment="Worm.Sasser.d" \
    disabled=no
add chain=virus protocol=tcp dst-port=10168 action=drop \
    comment="Worm.Lovgate.a/b/c/d" disabled=no
add chain=virus protocol=tcp dst-port=20808 action=drop \
    comment="Worm.Lovgate.v.QQ" disabled=no
add chain=virus protocol=tcp dst-port=1092 action=drop \
    comment="Worm.Lovgate.f/g" disabled=no
add chain=virus protocol=tcp dst-port=20168 action=drop \
    comment="Worm.Lovgate.f/g" disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="" disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="" disabled=no
add chain=virus protocol=tcp dst-port=1363-1364 action=drop \
    comment="ndm.requester" disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen.cast" \
    disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
    disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" \
    disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop \
    comment="Backdoor.OptixPro" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="" \
    disabled=no
add chain=virus protocol=udp dst-port=8787 action=drop \
    comment="Back.Orifice.2000.Trojan-6" disabled=no
add chain=virus protocol=udp dst-port=8879 action=drop \
    comment="Back.Orifice.2000.Trojan-7" disabled=no
add chain=virus protocol=udp dst-port=31666 action=drop \
    comment="Back.Orifice.2000.Trojan-8" disabled=no
add chain=virus protocol=udp dst-port=31337-31338 action=drop \
    comment="Back.Orifice.2000.Trojan-9" disabled=no
add chain=virus protocol=udp dst-port=54320-54321 action=drop \
    comment="Back.Orifice.2000.Trojan-10" disabled=no
add chain=virus protocol=udp dst-port=12345-12346 action=drop \
    comment="Block.NetBus.Trojan-3" disabled=no
add chain=virus protocol=udp dst-port=20034 action=drop \
    comment="Block.NetBus.Trojan-4" disabled=no
add chain=virus protocol=udp dst-port=21554 action=drop \
    comment="GirlFriend.Trojan-2" disabled=no
add chain=virus protocol=udp dst-port=41 action=drop \
    comment="DeepThroat.Trojan-8" disabled=no
add chain=virus protocol=udp dst-port=3150 action=drop \
    comment="DeepThroat.Trojan-9" disabled=no
add chain=virus protocol=udp dst-port=999 action=drop \
    comment="DeepThroat.Trojan-10" disabled=no
add chain=virus protocol=udp dst-port=6670 action=drop \
    comment="DeepThroat.Trojan-11" disabled=no
add chain=virus protocol=udp dst-port=6771 action=drop \
    comment="DeepThroat.Trojan-12" disabled=no
add chain=virus protocol=udp dst-port=60000 action=drop \
    comment="DeepThroat.Trojan-13" disabled=no
add chain=virus protocol=udp dst-port=10067 action=drop \
    comment="Portal.of.Doom.Trojan-5" disabled=no
add chain=virus protocol=udp dst-port=10167 action=drop \
    comment="Portal.of.Doom.Trojan-6" disabled=no
add chain=virus protocol=udp dst-port=3700 action=drop \
    comment="Portal.of.Doom.Trojan-7" disabled=no
add chain=virus protocol=udp dst-port=9872-9875 action=drop \
    comment="Portal.of.Doom.Trojan-8" disabled=no
add chain=virus protocol=udp dst-port=6883 action=drop \
    comment="Delta.Source.Trojan-5" disabled=no
add chain=virus protocol=udp dst-port=26274 action=drop \
    comment="Delta.Source.Trojan-6" disabled=no
add chain=virus protocol=udp dst-port=44444 action=drop \
    comment="Delta.Source.Trojan-7" disabled=no
add chain=virus protocol=udp dst-port=47262 action=drop \
    comment="Delta.Source.Trojan-8" disabled=no
add chain=virus protocol=udp dst-port=3791 action=drop \
    comment="Eclypse.Trojan-1" disabled=no
add chain=virus protocol=udp dst-port=3801 action=drop \
    comment="Eclypse.Trojan-2" disabled=no
add chain=virus protocol=udp dst-port=5880-5882 action=drop \
    comment="Eclypse.Trojan-3" disabled=no
add chain=virus protocol=udp dst-port=5888-5889 action=drop \
    comment="Eclypse.Trojan-4" disabled=no
add chain=virus protocol=udp dst-port=34555 action=drop \
    comment="Trin00.DDoS.Trojan-1" disabled=no
add chain=virus protocol=udp dst-port=35555 action=drop \
    comment="Trin00.DDoS.Trojan-2" disabled=no
add chain=virus protocol=udp dst-port=31338 action=drop \
    comment="NetSpy.DK.Trojan-1" disabled=no
add chain=virus protocol=udp dst-port=69 action=drop \
    comment="Worm.MsBlaster-2" disabled=no
add chain=virus protocol=udp dst-port=123 action=drop comment="Worm.Sobig.f-1" \
    disabled=no
add chain=virus protocol=udp dst-port=995-998 action=drop \
    comment="Worm.Sobig.f-2" disabled=no
add chain=forward connection-state=established action=accept comment="accept  \
    established packets" disabled=no
add chain=forward connection-state=related action=accept comment="accept \
    related packets" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid \
    packets" disabled=no
add chain=forward src-address-type=!unicast action=drop comment="drop all that \
    is not from unicast" disabled=no
add chain=forward in-interface=Wan src-address-list=not_in_Wan action=drop \
    comment="drop data from bogon IP's" disabled=no
add chain=forward in-interface=!Wan dst-address-list=not_in_Wan action=drop \
    comment="drop data to bogon IP's" disabled=no
add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to \
    chain ICMP" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to virus chain" \
    disabled=no
add chain=forward action=accept comment="Accept everything else" disabled=no
/ ip firewall address-list
add list=not_in_Wan address=0.0.0.0/8 comment="" disabled=no
add list=not_in_Wan address=172.16.0.0/12 comment="" disabled=no
add list=not_in_Wan address=192.168.0.0/16 comment="" disabled=no
add list=not_in_Wan address=10.0.0.0/8 comment="" disabled=no
add list=not_in_Wan address=169.254.0.0/16 comment="" disabled=no
add list=not_in_Wan address=127.0.0.0/8 comment="" disabled=no
add list=not_in_Wan address=224.0.0.0/3 comment="" disabled=no
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=no
set irc ports=6667 disabled=no
set h323 disabled=yes
set quake3 disabled=no
set mms disabled=no
set gre disabled=yes
set pptp disabled=yes