pppoe方式性能困惑？

duckybsd

这两天正好别人有个routeros需要我帮忙调配一下，这哥们使用PPPoe方式（就是把ros作成了PPPoe Server），我没有在RouterOS下做NAT，仅仅是把它作为一个路由器，测试方法如下：不通过routeROS直接接交换机，下载内网的一台ftp服务器，下载可以达到8MB/S左右，接上ros后，下载居然只能到2MB/s，这哥们是一台P3 450Mhz、512M SDRAM、512M CF转成IDE接口，没有用NAT仅仅吧ros当作路由，居然损失这么多？还没有测试不用PPPoe直接连接网卡的方式，防火墙里面没有多少规则，有也是input链里面的，不在forward里面，应该不是瓶颈，大家遇到过这样的情况吗？有可能是什么原因呢？还是PPPoe确实效率低些？也不至于这样啊.

duckybsd

解决了，把input链里面的规则全部禁用之后，可以了，但是没有时间一条条测试到底哪些对性能影响最大，把规则贴一下。感觉都是些常见病毒的端口，不知道哪条影响了性能，还是规则太多影响了，不过说实话，把这些端口放在input链上面，感觉有点掩耳盗铃的味道，呵呵，放在forward里面可能更好些，目前我全部给这哥们禁用了，看来安全性和效率是很难同时兼顾的。

1. 
   
2. 
   
3. # jul/07/2007 23:03:26 by RouterOS 2.9.27
   
4. #
   
5. / ip firewall filter
   
6. add chain=input protocol=tcp dst-port=135-139 action=drop comment="" \
   
7.     disabled=yes
   
8. add chain=input protocol=tcp dst-port=82 action=drop \
   
9.     comment="Worm.NetSky.Y@mm" disabled=yes
   
10. add chain=input protocol=tcp dst-port=113 action=drop \
    
11.     comment="W32.Korgo.A/B/C/D/E/F-1" disabled=yes
    
12. add chain=input protocol=tcp dst-port=2041 action=drop \
    
13.     comment="W33.Korgo.A/B/C/D/E/F-2" disabled=yes
    
14. add chain=input protocol=tcp dst-port=3067 action=drop \
    
15.     comment="W32.Korgo.A/B/C/D/E/F-3" disabled=yes
    
16. add chain=input protocol=tcp dst-port=6667 action=drop \
    
17.     comment="W32.Korgo.A/B/C/D/E/F-4" disabled=yes
    
18. add chain=input protocol=tcp dst-port=445 action=drop \
    
19.     comment="W32.Korgo.A/B/C/D/E/F-5" disabled=yes
    
20. add chain=input protocol=tcp dst-port=1000-1001 action=drop \
    
21.     comment="Backdoor.Nibu.B-1" disabled=yes
    
22. add chain=input protocol=tcp dst-port=2283 action=drop \
    
23.     comment="Backdoor.Nibu.B-2" disabled=yes
    
24. add chain=input protocol=tcp dst-port=10000 action=drop \
    
25.     comment="Backdoor.Nibu.E/G/H" disabled=yes
    
26. add chain=input protocol=tcp dst-port=3422 action=drop \
    
27.     comment="Backdoor.IRC.Aladinz.R-1" disabled=yes
    
28. add chain=input protocol=tcp dst-port=43958 action=drop \
    
29.     comment="Backdoor.IRC.Aladinz.R-2" disabled=yes
    
30. add chain=input protocol=tcp dst-port=5554 action=drop \
    
31.     comment="W32.Dabber.A/B-1" disabled=yes
    
32. add chain=input protocol=tcp dst-port=8967 action=drop \
    
33.     comment="W32.Dabber.A/B-2" disabled=yes
    
34. add chain=input protocol=tcp dst-port=9898-9999 action=drop \
    
35.     comment="W32.Dabber.A/B-3" disabled=yes
    
36. add chain=input protocol=tcp dst-port=6789 action=drop \
    
37.     comment="Worm.NetSky.S/T/U@mm" disabled=yes
    
38. add chain=input protocol=tcp dst-port=8787 action=drop \
    
39.     comment="Back.Orifice.2000.Trojan-1" disabled=yes
    
40. add chain=input protocol=tcp dst-port=8879 action=drop \
    
41.     comment="Back.Orifice.2000.Trojan-2" disabled=yes
    
42. add chain=input protocol=tcp dst-port=31666 action=drop \
    
43.     comment="Back.Orifice.2000.Trojan-3" disabled=yes
    
44. add chain=input protocol=tcp dst-port=31337-31338 action=drop \
    
45.     comment="Back.Orifice.2000.Trojan-4" disabled=yes
    
46. add chain=input protocol=tcp dst-port=54320-54321 action=drop \
    
47.     comment="Back.Orifice.2000.Trojan-5" disabled=yes
    
48. add chain=input protocol=tcp dst-port=12345-12346 action=drop \
    
49.     comment="Block.NetBus.Trojan-1" disabled=yes
    
50. add chain=input protocol=tcp dst-port=20034 action=drop \
    
51.     comment="Block.NetBus.Trojan-2" disabled=yes
    
52. add chain=input protocol=tcp dst-port=21554 action=drop \
    
53.     comment="GirlFriend.Trojan-1" disabled=yes
    
54. add chain=input protocol=tcp dst-port=41 action=drop \
    
55.     comment="DeepThroat.Trojan-1" disabled=yes
    
56. add chain=input protocol=tcp dst-port=3150 action=drop \
    
57.     comment="DeepThroat.Trojan-2" disabled=yes
    
58. add chain=input protocol=tcp dst-port=999 action=drop \
    
59.     comment="DeepThroat.Trojan-3" disabled=yes
    
60. add chain=input protocol=tcp dst-port=6670 action=drop \
    
61.     comment="DeepThroat.Trojan-4" disabled=yes
    
62. add chain=input protocol=tcp dst-port=6771 action=drop \
    
63.     comment="DeepThroat.Trojan-5" disabled=yes
    
64. add chain=input protocol=tcp dst-port=60000 action=drop \
    
65.     comment="DeepThroat.Trojan-6" disabled=yes
    
66. add chain=input protocol=tcp dst-port=2140 action=drop \
    
67.     comment="DeepThroat.Trojan-7" disabled=yes
    
68. add chain=input protocol=tcp dst-port=10067 action=drop \
    
69.     comment="Portal.of.Doom.Trojan-1" disabled=yes
    
70. add chain=input protocol=tcp dst-port=10167 action=drop \
    
71.     comment="Portal.of.Doom.Trojan-2" disabled=yes
    
72. add chain=input protocol=tcp dst-port=3700 action=drop \
    
73.     comment="Portal.of.Doom.Trojan-3" disabled=yes
    
74. add chain=input protocol=tcp dst-port=9872-9875 action=drop \
    
75.     comment="Portal.of.Doom.Trojan-4" disabled=yes
    
76. add chain=input protocol=tcp dst-port=6883 action=drop \
    
77.     comment="Delta.Source.Trojan-1" disabled=yes
    
78. add chain=input protocol=tcp dst-port=26274 action=drop \
    
79.     comment="Delta.Source.Trojan-2" disabled=yes
    
80. add chain=input protocol=tcp dst-port=4444 action=drop \
    
81.     comment="Delta.Source.Trojan-3" disabled=yes
    
82. add chain=input protocol=tcp dst-port=47262 action=drop \
    
83.     comment="Delta.Source.Trojan-4" disabled=yes
    
84. add chain=input protocol=tcp dst-port=3791 action=drop \
    
85.     comment="Eclypse.Trojan-1" disabled=yes
    
86. add chain=input protocol=tcp dst-port=3801 action=drop \
    
87.     comment="Eclypse.Trojan-2" disabled=yes
    
88. add chain=input protocol=tcp dst-port=65390 action=drop \
    
89.     comment="Eclypse.Trojan-3" disabled=yes
    
90. add chain=input protocol=tcp dst-port=5880-5882 action=drop \
    
91.     comment="Y3K.RAT.Trojan-1" disabled=yes
    
92. add chain=input protocol=tcp dst-port=5888-5889 action=drop \
    
93.     comment="Y3K.RAT.Trojan-2" disabled=yes
    
94. add chain=input protocol=tcp dst-port=30100-30103 action=drop \
    
95.     comment="NetSphere.Trojan-1" disabled=yes
    
96. add chain=input protocol=tcp dst-port=30133 action=drop \
    
97.     comment="NetSphere.Trojan-2" disabled=yes
    
98. add chain=input protocol=tcp dst-port=7300-7301 action=drop \
    
99.     comment="NetMonitor.Trojan-1" disabled=yes
    
100. add chain=input protocol=tcp dst-port=7306-7308 action=drop \
     
101.     comment="NetMonitor.Trojan-2" disabled=yes
     
102. add chain=input protocol=tcp dst-port=79 action=drop \
     
103.     comment="FireHotcker.Trojan-1" disabled=yes
     
104. add chain=input protocol=tcp dst-port=5031 action=drop \
     
105.     comment="FireHotcker.Trojan-2" disabled=yes
     
106. add chain=input protocol=tcp dst-port=5321 action=drop \
     
107.     comment="FireHotcker.Trojan-3" disabled=yes
     
108. add chain=input protocol=tcp dst-port=6400 action=drop \
     
109.     comment="TheThing.Trojan-1" disabled=yes
     
110. add chain=input protocol=tcp dst-port=7777 action=drop \
     
111.     comment="TheThing.Trojan-2" disabled=yes
     
112. add chain=input protocol=tcp dst-port=1047 action=drop \
     
113.     comment="GateCrasher.Trojan-1" disabled=yes
     
114. add chain=input protocol=tcp dst-port=6969-6970 action=drop \
     
115.     comment="GateCrasher.Trojan-2" disabled=yes
     
116. add chain=input protocol=tcp dst-port=2774 action=drop comment="SubSeven-1" \
     
117.     disabled=yes
     
118. add chain=input protocol=tcp dst-port=27374 action=drop comment="SubSeven-2" \
     
119.     disabled=yes
     
120. add chain=input protocol=tcp dst-port=1243 action=drop comment="SubSeven-3" \
     
121.     disabled=yes
     
122. add chain=input protocol=tcp dst-port=1234 action=drop comment="SubSeven-4" \
     
123.     disabled=yes
     
124. add chain=input protocol=tcp dst-port=6711-6713 action=drop \
     
125.     comment="SubSeven-5" disabled=yes
     
126. add chain=input protocol=tcp dst-port=16959 action=drop comment="SubSeven-7" \
     
127.     disabled=yes
     
128. add chain=input protocol=tcp dst-port=11000 action=drop \
     
129.     comment="Senna.Spy.Trojan-1" disabled=yes
     
130. add chain=input protocol=tcp dst-port=13000 action=drop \
     
131.     comment="Senna.Spy.Trojan-2" disabled=yes
     
132. add chain=input protocol=tcp dst-port=25685-25686 action=drop \
     
133.     comment="Moonpie.Trojan-1" disabled=yes
     
134. add chain=input protocol=tcp dst-port=25982 action=drop \
     
135.     comment="Moonpie.Trojan-2" disabled=yes
     
136. add chain=input protocol=tcp dst-port=1024-1030 action=drop \
     
137.     comment="NetSpy.Trojan-1" disabled=yes
     
138. add chain=input protocol=tcp dst-port=1033 action=drop \
     
139.     comment="NetSpy.Trojan-2" disabled=yes
     
140. add chain=input protocol=tcp dst-port=31337-31339 action=drop \
     
141.     comment="NetSpy.Trojan-3" disabled=yes
     
142. add chain=input protocol=tcp dst-port=8102 action=drop comment="Trojan" \
     
143.     disabled=yes
     
144. add chain=input protocol=tcp dst-port=7306 action=drop \
     
145.     comment="Netspy3.0Trojan" disabled=yes
     
146. add chain=input protocol=tcp dst-port=8011 action=drop comment="WAY.Trojan" \
     
147.     disabled=yes
     
148. add chain=input protocol=tcp dst-port=7626 action=drop comment="Trojan.BingHe" \
     
149.     disabled=yes
     
150. add chain=input protocol=tcp dst-port=19191 action=drop \
     
151.     comment="Trojan.NianSeHoYian" disabled=yes
     
152. add chain=input protocol=tcp dst-port=23444-23445 action=drop \
     
153.     comment="NetBull.Trojan" disabled=yes
     
154. add chain=input protocol=tcp dst-port=2583 action=drop \
     
155.     comment="WinCrash.Trojan-1" disabled=yes
     
156. add chain=input protocol=tcp dst-port=3024 action=drop \
     
157.     comment="WinCrash.Trojan-2" disabled=yes
     
158. add chain=input protocol=tcp dst-port=4092 action=drop \
     
159.     comment="WinCrash.Trojan-3" disabled=yes
     
160. add chain=input protocol=tcp dst-port=5714 action=drop \
     
161.     comment="WinCrash.Trojan-4" disabled=yes
     
162. add chain=input protocol=tcp dst-port=1010-1012 action=drop \
     
163.     comment="Doly1.0/1.35/1.5trojan-1" disabled=yes
     
164. add chain=input protocol=tcp dst-port=1015 action=drop \
     
165.     comment="Doly1.0/1.35/1.5trojan-2" disabled=yes
     
166. add chain=input protocol=tcp dst-port=1999-2005 action=drop \
     
167.     comment="TransScout.Trojan-1" disabled=yes
     
168. add chain=input protocol=tcp dst-port=9878 action=drop \
     
169.     comment="TransScout.Trojan-2" disabled=yes
     
170. add chain=input protocol=tcp dst-port=2773 action=drop \
     
171.     comment="Backdoor.YAI..Trojan-1" disabled=yes
     
172. add chain=input protocol=tcp dst-port=7215 action=drop \
     
173.     comment="Backdoor.YAI.Trojan-2" disabled=yes
     
174. add chain=input protocol=tcp dst-port=54283 action=drop \
     
175.     comment="Backdoor.YAI.Trojan-3" disabled=yes
     
176. add chain=input protocol=tcp dst-port=1003 action=drop \
     
177.     comment="BackDoorTrojan-1" disabled=yes
     
178. add chain=input protocol=tcp dst-port=5598 action=drop \
     
179.     comment="BackDoorTrojan-2" disabled=yes
     
180. add chain=input protocol=tcp dst-port=5698 action=drop \
     
181.     comment="BackDoorTrojan-3" disabled=yes
     
182. add chain=input protocol=tcp dst-port=2716 action=drop \
     
183.     comment="PrayerTrojan-1" disabled=yes
     
184. add chain=input protocol=tcp dst-port=9999 action=drop \
     
185.     comment="PrayerTrojan-2" disabled=yes
     
186. add chain=input protocol=tcp dst-port=21544 action=drop \
     
187.     comment="SchwindlerTrojan-1" disabled=yes
     
188. add chain=input protocol=tcp dst-port=31554 action=drop \
     
189.     comment="SchwindlerTrojan-2" disabled=yes
     
190. add chain=input protocol=tcp dst-port=18753 action=drop \
     
191.     comment="Shaft.DDoS.Trojan-1" disabled=yes
     
192. add chain=input protocol=tcp dst-port=20432 action=drop \
     
193.     comment="Shaft.DDoS.Trojan-2" disabled=yes
     
194. add chain=input protocol=tcp dst-port=65000 action=drop \
     
195.     comment="Devil.DDoS.Trojan" disabled=yes
     
196. add chain=input protocol=tcp dst-port=11831 action=drop \
     
197.     comment="LatinusTrojan-1" disabled=yes
     
198. add chain=input protocol=tcp dst-port=29559 action=drop \
     
199.     comment="LatinusTrojan-2" disabled=yes
     
200. add chain=input protocol=tcp dst-port=1784 action=drop \
     
201.     comment="Snid.X2Trojan-1" disabled=yes
     
202. add chain=input protocol=tcp dst-port=3586 action=drop \
     
203.     comment="Snid.X2Trojan-2" disabled=yes
     
204. add chain=input protocol=tcp dst-port=7609 action=drop \
     
205.     comment="Snid.X2Trojan-3" disabled=yes
     
206. add chain=input protocol=tcp dst-port=12348-12349 action=drop \
     
207.     comment="BionetTrojan-1" disabled=yes
     
208. add chain=input protocol=tcp dst-port=12478 action=drop \
     
209.     comment="BionetTrojan-2" disabled=yes
     
210. add chain=input protocol=tcp dst-port=57922 action=drop \
     
211.     comment="BionetTrojan-3" disabled=yes
     
212. add chain=input protocol=tcp dst-port=3127-3198 action=drop \
     
213.     comment="Worm.Novarg.a.Mydoom.a.-1" disabled=yes
     
214. add chain=input protocol=tcp dst-port=4444 action=drop \
     
215.     comment="Worm.MsBlaster-1" disabled=yes
     
216. add chain=input protocol=tcp dst-port=6777 action=drop \
     
217.     comment="Worm.BBeagle.a.Bagle.a." disabled=yes
     
218. add chain=input protocol=tcp dst-port=8866 action=drop \
     
219.     comment="Worm.BBeagle.b" disabled=yes
     
220. add chain=input protocol=tcp dst-port=2745 action=drop \
     
221.     comment="Worm.BBeagle.c-g/j-l" disabled=yes
     
222. add chain=input protocol=tcp dst-port=2556 action=drop \
     
223.     comment="Worm.BBeagle.p/q/r/n" disabled=yes
     
224. add chain=input protocol=tcp dst-port=20742 action=drop \
     
225.     comment="Worm.BBEagle.m-2" disabled=yes
     
226. add chain=input protocol=tcp dst-port=4751 action=drop \
     
227.     comment="Worm.BBeagle.s/t/u/v" disabled=yes
     
228. add chain=input protocol=tcp dst-port=2535 action=drop \
     
229.     comment="Worm.BBeagle.aa/ab/w/x-z-2" disabled=yes
     
230. add chain=input protocol=tcp dst-port=5238 action=drop \
     
231.     comment="Worm.LovGate.r.RpcExploit" disabled=yes
     
232. add chain=input protocol=tcp dst-port=1068 action=drop comment="Worm.Sasser.a" \
     
233.     disabled=yes
     
234. add chain=input protocol=tcp dst-port=5554 action=drop \
     
235.     comment="Worm.Sasser.b/c/f" disabled=yes
     
236. add chain=input protocol=tcp dst-port=9996 action=drop \
     
237.     comment="Worm.Sasser.b/c/f" disabled=yes
     
238. add chain=input protocol=tcp dst-port=9995 action=drop comment="Worm.Sasser.d" \
     
239.     disabled=yes
     
240. add chain=input protocol=tcp dst-port=10168 action=drop \
     
241.     comment="Worm.Lovgate.a/b/c/d" disabled=yes
     
242. add chain=input protocol=tcp dst-port=20808 action=drop \
     
243.     comment="Worm.Lovgate.v.QQ" disabled=yes
     
244. add chain=input protocol=tcp dst-port=1092 action=drop \
     
245.     comment="Worm.Lovgate.f/g" disabled=yes
     
246. add chain=input protocol=tcp dst-port=20168 action=drop \
     
247.     comment="Worm.Lovgate.f/g" disabled=yes
     
248. add chain=input protocol=tcp dst-port=593 action=drop comment="" disabled=yes
     
249. add chain=input protocol=tcp dst-port=1214 action=drop comment="" disabled=yes
     
250. add chain=input protocol=tcp dst-port=1363-1364 action=drop \
     
251.     comment="ndm.requester" disabled=yes
     
252. add chain=input protocol=tcp dst-port=1368 action=drop comment="screen.cast" \
     
253.     disabled=yes
     
254. add chain=input protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
     
255.     disabled=yes
     
256. add chain=input protocol=tcp dst-port=1377 action=drop comment="cichlid" \
     
257.     disabled=yes
     
258. add chain=input protocol=tcp dst-port=3410 action=drop \
     
259.     comment="Backdoor.OptixPro" disabled=yes
     
260. add chain=input protocol=udp dst-port=135-139 action=drop comment="" \
     
261.     disabled=yes
     
262. add chain=input protocol=udp dst-port=8787 action=drop \
     
263.     comment="Back.Orifice.2000.Trojan-6" disabled=yes
     
264. add chain=input protocol=udp dst-port=8879 action=drop \
     
265.     comment="Back.Orifice.2000.Trojan-7" disabled=yes
     
266. add chain=input protocol=udp dst-port=31666 action=drop \
     
267.     comment="Back.Orifice.2000.Trojan-8" disabled=yes
     
268. add chain=input protocol=udp dst-port=31337-31338 action=drop \
     
269.     comment="Back.Orifice.2000.Trojan-9" disabled=yes
     
270. add chain=input protocol=udp dst-port=54320-54321 action=drop \
     
271.     comment="Back.Orifice.2000.Trojan-10" disabled=yes
     
272. add chain=input protocol=udp dst-port=12345-12346 action=drop \
     
273.     comment="Block.NetBus.Trojan-3" disabled=yes
     
274. add chain=input protocol=udp dst-port=20034 action=drop \
     
275.     comment="Block.NetBus.Trojan-4" disabled=yes
     
276. add chain=input protocol=udp dst-port=21554 action=drop \
     
277.     comment="GirlFriend.Trojan-2" disabled=yes
     
278. add chain=input protocol=udp dst-port=41 action=drop \
     
279.     comment="DeepThroat.Trojan-8" disabled=yes
     
280. add chain=input protocol=udp dst-port=3150 action=drop \
     
281.     comment="DeepThroat.Trojan-9" disabled=yes
     
282. add chain=input protocol=udp dst-port=999 action=drop \
     
283.     comment="DeepThroat.Trojan-10" disabled=yes
     
284. add chain=input protocol=udp dst-port=6670 action=drop \
     
285.     comment="DeepThroat.Trojan-11" disabled=yes
     
286. add chain=input protocol=udp dst-port=6771 action=drop \
     
287.     comment="DeepThroat.Trojan-12" disabled=yes
     
288. add chain=input protocol=udp dst-port=60000 action=drop \
     
289.     comment="DeepThroat.Trojan-13" disabled=yes
     
290. add chain=input protocol=udp dst-port=10067 action=drop \
     
291.     comment="Portal.of.Doom.Trojan-5" disabled=yes
     
292. add chain=input protocol=udp dst-port=10167 action=drop \
     
293.     comment="Portal.of.Doom.Trojan-6" disabled=yes
     
294. add chain=input protocol=udp dst-port=3700 action=drop \
     
295.     comment="Portal.of.Doom.Trojan-7" disabled=yes
     
296. add chain=input protocol=udp dst-port=9872-9875 action=drop \
     
297.     comment="Portal.of.Doom.Trojan-8" disabled=yes
     
298. add chain=input protocol=udp dst-port=6883 action=drop \
     
299.     comment="Delta.Source.Trojan-5" disabled=yes
     
300. add chain=input protocol=udp dst-port=26274 action=drop \
     
301.     comment="Delta.Source.Trojan-6" disabled=yes
     
302. add chain=input protocol=udp dst-port=44444 action=drop \
     
303.     comment="Delta.Source.Trojan-7" disabled=yes
     
304. add chain=input protocol=udp dst-port=47262 action=drop \
     
305.     comment="Delta.Source.Trojan-8" disabled=yes
     
306. add chain=input protocol=udp dst-port=3791 action=drop \
     
307.     comment="Eclypse.Trojan-1" disabled=yes
     
308. add chain=input protocol=udp dst-port=3801 action=drop \
     
309.     comment="Eclypse.Trojan-2" disabled=yes
     
310. add chain=input protocol=udp dst-port=5880-5882 action=drop \
     
311.     comment="Eclypse.Trojan-3" disabled=yes
     
312. add chain=input protocol=udp dst-port=5888-5889 action=drop \
     
313.     comment="Eclypse.Trojan-4" disabled=yes
     
314. add chain=input protocol=udp dst-port=34555 action=drop \
     
315.     comment="Trin00.DDoS.Trojan-1" disabled=yes
     
316. add chain=input protocol=udp dst-port=35555 action=drop \
     
317.     comment="Trin00.DDoS.Trojan-2" disabled=yes
     
318. add chain=input protocol=udp dst-port=31338 action=drop \
     
319.     comment="NetSpy.DK.Trojan-1" disabled=yes
     
320. add chain=input protocol=udp dst-port=69 action=drop \
     
321.     comment="Worm.MsBlaster-2" disabled=yes
     
322. add chain=input protocol=udp dst-port=123 action=drop comment="Worm.Sobig.f-1" \
     
323.     disabled=yes
     
324. add chain=input protocol=udp dst-port=995-999 action=drop \
     
325.     comment="Worm.Sobig.f-2" disabled=yes
     
326. add chain=input protocol=udp dst-port=8998 action=drop \
     
327.     comment="Worm.Sobig.f-3" disabled=yes
     

复制代码

[ 本帖最后由 duckybsd 于 2007-7-7 23:06 编辑 ]

seignior

这段东西，按道理来说，无论是在input还是在forward，其实完全没有作用(除了增加系统负担 ).......据说竟然这段东西是中文官方释放的，昏迷的说..........

[ 本帖最后由 seignior 于 2007-7-8 00:04 编辑 ]

duckybsd

原帖由 seignior 于 2007-7-8 00:03 发表

                               
登录/注册后可看大图

这段东西，按道理来说，无论是在input还是在forward，其实完全没有作用(除了增加系统负担 ).......据说竟然这段东西是中文官方释放的，昏迷的说..........

个人觉得，把一些某段时间内流行的木马端口，放在forward链当中drop掉得话，还是有一定的保护内网用户的作用的，多了就无意了，对性能影响确实挺大的。

seignior

问题是，你觉得ros会中上述列表的木马、病毒嘛(input)？而如果是针对内网，因为是经过NAT的，端口早改变了，放在forward又有什么用？

duckybsd

原帖由 seignior 于 2007-7-8 01:16 发表

                               
登录/注册后可看大图

问题是，你觉得ros会中上述列表的木马、病毒嘛(input)？而如果是针对内网，因为是经过NAT的，端口早改变了，放在forward又有什么用？

ros不会中，但是forward中，即使是NAT出去的包目的端口是不会变的。同样进来的包源端口是不会变的。

wdwwdw

学习中，顶

seignior

原帖由 duckybsd 于 2007-7-8 01:35 发表

                               
登录/注册后可看大图

ros不会中，但是forward中，即使是NAT出去的包目的端口是不会变的。同样进来的包源端口是不会变的。

我举个简单的例子吧，假设病毒需要打开了111这个端口，局域网有10台机器中了这个病毒，你觉得nat路由有多少个111端口可以开放给下面这10台机？


另外，nat是边缘路由，如果不在nat表里等待的链接，外部进来的请求，又如何能到达内网？(换一句话说，对于边缘路由，外面到达的包，如果不是内网某个之前发出去的链接所期待的答复，就根本不会进内网而被直接仍掉，NAT正式的名称是“边缘路由”，这个意思本来就是说，这个玩意就是单向的，不是传统路由般双向)

tpy372

什么狗屁传说中的官网防火墙（估计也是冒充），害死不少人...

chyhc

真没看得懂楼主的意思,我用PPPOE就没什么问题,呵呵但是PING值是大了点,问题是好象没什么影响嘛. 我就没加什么所谓防病毒的规则,还不是用得好好的,我所见过的迷信加这些脚本的 莫名其妙的多了