找回密码
 注册

QQ登录

只需一步,快速开始

搜索
查看: 4593|回复: 9

[pppoe] pppoe方式性能困惑?

[复制链接]
发表于 2007-7-7 22:54:06 | 显示全部楼层 |阅读模式

马上注册,结交更多好友,享用更多功能,让你轻松玩转社区。

您需要 登录 才可以下载或查看,没有账号?注册

×
这两天正好别人有个routeros需要我帮忙调配一下,这哥们使用PPPoe方式(就是把ros作成了PPPoe Server),我没有在RouterOS下做NAT,仅仅是把它作为一个路由器,测试方法如下:不通过routeROS直接接交换机,下载内网的一台ftp服务器,下载可以达到8MB/S左右,接上ros后,下载居然只能到2MB/s,这哥们是一台P3 450Mhz、512M SDRAM、512M CF转成IDE接口,没有用NAT仅仅吧ros当作路由,居然损失这么多?还没有测试不用PPPoe直接连接网卡的方式,防火墙里面没有多少规则,有也是input链里面的,不在forward里面,应该不是瓶颈,大家遇到过这样的情况吗?有可能是什么原因呢?还是PPPoe确实效率低些?也不至于这样啊.
routeros
 楼主| 发表于 2007-7-7 23:03:04 | 显示全部楼层
解决了,把input链里面的规则全部禁用之后,可以了,但是没有时间一条条测试到底哪些对性能影响最大,把规则贴一下。感觉都是些常见病毒的端口,不知道哪条影响了性能,还是规则太多影响了,不过说实话,把这些端口放在input链上面,感觉有点掩耳盗铃的味道,呵呵,放在forward里面可能更好些,目前我全部给这哥们禁用了,看来安全性和效率是很难同时兼顾的。


  1. # jul/07/2007 23:03:26 by RouterOS 2.9.27
  2. #
  3. / ip firewall filter
  4. add chain=input protocol=tcp dst-port=135-139 action=drop comment="" \
  5.     disabled=yes
  6. add chain=input protocol=tcp dst-port=82 action=drop \
  7.     comment="Worm.NetSky.Y@mm" disabled=yes
  8. add chain=input protocol=tcp dst-port=113 action=drop \
  9.     comment="W32.Korgo.A/B/C/D/E/F-1" disabled=yes
  10. add chain=input protocol=tcp dst-port=2041 action=drop \
  11.     comment="W33.Korgo.A/B/C/D/E/F-2" disabled=yes
  12. add chain=input protocol=tcp dst-port=3067 action=drop \
  13.     comment="W32.Korgo.A/B/C/D/E/F-3" disabled=yes
  14. add chain=input protocol=tcp dst-port=6667 action=drop \
  15.     comment="W32.Korgo.A/B/C/D/E/F-4" disabled=yes
  16. add chain=input protocol=tcp dst-port=445 action=drop \
  17.     comment="W32.Korgo.A/B/C/D/E/F-5" disabled=yes
  18. add chain=input protocol=tcp dst-port=1000-1001 action=drop \
  19.     comment="Backdoor.Nibu.B-1" disabled=yes
  20. add chain=input protocol=tcp dst-port=2283 action=drop \
  21.     comment="Backdoor.Nibu.B-2" disabled=yes
  22. add chain=input protocol=tcp dst-port=10000 action=drop \
  23.     comment="Backdoor.Nibu.E/G/H" disabled=yes
  24. add chain=input protocol=tcp dst-port=3422 action=drop \
  25.     comment="Backdoor.IRC.Aladinz.R-1" disabled=yes
  26. add chain=input protocol=tcp dst-port=43958 action=drop \
  27.     comment="Backdoor.IRC.Aladinz.R-2" disabled=yes
  28. add chain=input protocol=tcp dst-port=5554 action=drop \
  29.     comment="W32.Dabber.A/B-1" disabled=yes
  30. add chain=input protocol=tcp dst-port=8967 action=drop \
  31.     comment="W32.Dabber.A/B-2" disabled=yes
  32. add chain=input protocol=tcp dst-port=9898-9999 action=drop \
  33.     comment="W32.Dabber.A/B-3" disabled=yes
  34. add chain=input protocol=tcp dst-port=6789 action=drop \
  35.     comment="Worm.NetSky.S/T/U@mm" disabled=yes
  36. add chain=input protocol=tcp dst-port=8787 action=drop \
  37.     comment="Back.Orifice.2000.Trojan-1" disabled=yes
  38. add chain=input protocol=tcp dst-port=8879 action=drop \
  39.     comment="Back.Orifice.2000.Trojan-2" disabled=yes
  40. add chain=input protocol=tcp dst-port=31666 action=drop \
  41.     comment="Back.Orifice.2000.Trojan-3" disabled=yes
  42. add chain=input protocol=tcp dst-port=31337-31338 action=drop \
  43.     comment="Back.Orifice.2000.Trojan-4" disabled=yes
  44. add chain=input protocol=tcp dst-port=54320-54321 action=drop \
  45.     comment="Back.Orifice.2000.Trojan-5" disabled=yes
  46. add chain=input protocol=tcp dst-port=12345-12346 action=drop \
  47.     comment="Block.NetBus.Trojan-1" disabled=yes
  48. add chain=input protocol=tcp dst-port=20034 action=drop \
  49.     comment="Block.NetBus.Trojan-2" disabled=yes
  50. add chain=input protocol=tcp dst-port=21554 action=drop \
  51.     comment="GirlFriend.Trojan-1" disabled=yes
  52. add chain=input protocol=tcp dst-port=41 action=drop \
  53.     comment="DeepThroat.Trojan-1" disabled=yes
  54. add chain=input protocol=tcp dst-port=3150 action=drop \
  55.     comment="DeepThroat.Trojan-2" disabled=yes
  56. add chain=input protocol=tcp dst-port=999 action=drop \
  57.     comment="DeepThroat.Trojan-3" disabled=yes
  58. add chain=input protocol=tcp dst-port=6670 action=drop \
  59.     comment="DeepThroat.Trojan-4" disabled=yes
  60. add chain=input protocol=tcp dst-port=6771 action=drop \
  61.     comment="DeepThroat.Trojan-5" disabled=yes
  62. add chain=input protocol=tcp dst-port=60000 action=drop \
  63.     comment="DeepThroat.Trojan-6" disabled=yes
  64. add chain=input protocol=tcp dst-port=2140 action=drop \
  65.     comment="DeepThroat.Trojan-7" disabled=yes
  66. add chain=input protocol=tcp dst-port=10067 action=drop \
  67.     comment="Portal.of.Doom.Trojan-1" disabled=yes
  68. add chain=input protocol=tcp dst-port=10167 action=drop \
  69.     comment="Portal.of.Doom.Trojan-2" disabled=yes
  70. add chain=input protocol=tcp dst-port=3700 action=drop \
  71.     comment="Portal.of.Doom.Trojan-3" disabled=yes
  72. add chain=input protocol=tcp dst-port=9872-9875 action=drop \
  73.     comment="Portal.of.Doom.Trojan-4" disabled=yes
  74. add chain=input protocol=tcp dst-port=6883 action=drop \
  75.     comment="Delta.Source.Trojan-1" disabled=yes
  76. add chain=input protocol=tcp dst-port=26274 action=drop \
  77.     comment="Delta.Source.Trojan-2" disabled=yes
  78. add chain=input protocol=tcp dst-port=4444 action=drop \
  79.     comment="Delta.Source.Trojan-3" disabled=yes
  80. add chain=input protocol=tcp dst-port=47262 action=drop \
  81.     comment="Delta.Source.Trojan-4" disabled=yes
  82. add chain=input protocol=tcp dst-port=3791 action=drop \
  83.     comment="Eclypse.Trojan-1" disabled=yes
  84. add chain=input protocol=tcp dst-port=3801 action=drop \
  85.     comment="Eclypse.Trojan-2" disabled=yes
  86. add chain=input protocol=tcp dst-port=65390 action=drop \
  87.     comment="Eclypse.Trojan-3" disabled=yes
  88. add chain=input protocol=tcp dst-port=5880-5882 action=drop \
  89.     comment="Y3K.RAT.Trojan-1" disabled=yes
  90. add chain=input protocol=tcp dst-port=5888-5889 action=drop \
  91.     comment="Y3K.RAT.Trojan-2" disabled=yes
  92. add chain=input protocol=tcp dst-port=30100-30103 action=drop \
  93.     comment="NetSphere.Trojan-1" disabled=yes
  94. add chain=input protocol=tcp dst-port=30133 action=drop \
  95.     comment="NetSphere.Trojan-2" disabled=yes
  96. add chain=input protocol=tcp dst-port=7300-7301 action=drop \
  97.     comment="NetMonitor.Trojan-1" disabled=yes
  98. add chain=input protocol=tcp dst-port=7306-7308 action=drop \
  99.     comment="NetMonitor.Trojan-2" disabled=yes
  100. add chain=input protocol=tcp dst-port=79 action=drop \
  101.     comment="FireHotcker.Trojan-1" disabled=yes
  102. add chain=input protocol=tcp dst-port=5031 action=drop \
  103.     comment="FireHotcker.Trojan-2" disabled=yes
  104. add chain=input protocol=tcp dst-port=5321 action=drop \
  105.     comment="FireHotcker.Trojan-3" disabled=yes
  106. add chain=input protocol=tcp dst-port=6400 action=drop \
  107.     comment="TheThing.Trojan-1" disabled=yes
  108. add chain=input protocol=tcp dst-port=7777 action=drop \
  109.     comment="TheThing.Trojan-2" disabled=yes
  110. add chain=input protocol=tcp dst-port=1047 action=drop \
  111.     comment="GateCrasher.Trojan-1" disabled=yes
  112. add chain=input protocol=tcp dst-port=6969-6970 action=drop \
  113.     comment="GateCrasher.Trojan-2" disabled=yes
  114. add chain=input protocol=tcp dst-port=2774 action=drop comment="SubSeven-1" \
  115.     disabled=yes
  116. add chain=input protocol=tcp dst-port=27374 action=drop comment="SubSeven-2" \
  117.     disabled=yes
  118. add chain=input protocol=tcp dst-port=1243 action=drop comment="SubSeven-3" \
  119.     disabled=yes
  120. add chain=input protocol=tcp dst-port=1234 action=drop comment="SubSeven-4" \
  121.     disabled=yes
  122. add chain=input protocol=tcp dst-port=6711-6713 action=drop \
  123.     comment="SubSeven-5" disabled=yes
  124. add chain=input protocol=tcp dst-port=16959 action=drop comment="SubSeven-7" \
  125.     disabled=yes
  126. add chain=input protocol=tcp dst-port=11000 action=drop \
  127.     comment="Senna.Spy.Trojan-1" disabled=yes
  128. add chain=input protocol=tcp dst-port=13000 action=drop \
  129.     comment="Senna.Spy.Trojan-2" disabled=yes
  130. add chain=input protocol=tcp dst-port=25685-25686 action=drop \
  131.     comment="Moonpie.Trojan-1" disabled=yes
  132. add chain=input protocol=tcp dst-port=25982 action=drop \
  133.     comment="Moonpie.Trojan-2" disabled=yes
  134. add chain=input protocol=tcp dst-port=1024-1030 action=drop \
  135.     comment="NetSpy.Trojan-1" disabled=yes
  136. add chain=input protocol=tcp dst-port=1033 action=drop \
  137.     comment="NetSpy.Trojan-2" disabled=yes
  138. add chain=input protocol=tcp dst-port=31337-31339 action=drop \
  139.     comment="NetSpy.Trojan-3" disabled=yes
  140. add chain=input protocol=tcp dst-port=8102 action=drop comment="Trojan" \
  141.     disabled=yes
  142. add chain=input protocol=tcp dst-port=7306 action=drop \
  143.     comment="Netspy3.0Trojan" disabled=yes
  144. add chain=input protocol=tcp dst-port=8011 action=drop comment="WAY.Trojan" \
  145.     disabled=yes
  146. add chain=input protocol=tcp dst-port=7626 action=drop comment="Trojan.BingHe" \
  147.     disabled=yes
  148. add chain=input protocol=tcp dst-port=19191 action=drop \
  149.     comment="Trojan.NianSeHoYian" disabled=yes
  150. add chain=input protocol=tcp dst-port=23444-23445 action=drop \
  151.     comment="NetBull.Trojan" disabled=yes
  152. add chain=input protocol=tcp dst-port=2583 action=drop \
  153.     comment="WinCrash.Trojan-1" disabled=yes
  154. add chain=input protocol=tcp dst-port=3024 action=drop \
  155.     comment="WinCrash.Trojan-2" disabled=yes
  156. add chain=input protocol=tcp dst-port=4092 action=drop \
  157.     comment="WinCrash.Trojan-3" disabled=yes
  158. add chain=input protocol=tcp dst-port=5714 action=drop \
  159.     comment="WinCrash.Trojan-4" disabled=yes
  160. add chain=input protocol=tcp dst-port=1010-1012 action=drop \
  161.     comment="Doly1.0/1.35/1.5trojan-1" disabled=yes
  162. add chain=input protocol=tcp dst-port=1015 action=drop \
  163.     comment="Doly1.0/1.35/1.5trojan-2" disabled=yes
  164. add chain=input protocol=tcp dst-port=1999-2005 action=drop \
  165.     comment="TransScout.Trojan-1" disabled=yes
  166. add chain=input protocol=tcp dst-port=9878 action=drop \
  167.     comment="TransScout.Trojan-2" disabled=yes
  168. add chain=input protocol=tcp dst-port=2773 action=drop \
  169.     comment="Backdoor.YAI..Trojan-1" disabled=yes
  170. add chain=input protocol=tcp dst-port=7215 action=drop \
  171.     comment="Backdoor.YAI.Trojan-2" disabled=yes
  172. add chain=input protocol=tcp dst-port=54283 action=drop \
  173.     comment="Backdoor.YAI.Trojan-3" disabled=yes
  174. add chain=input protocol=tcp dst-port=1003 action=drop \
  175.     comment="BackDoorTrojan-1" disabled=yes
  176. add chain=input protocol=tcp dst-port=5598 action=drop \
  177.     comment="BackDoorTrojan-2" disabled=yes
  178. add chain=input protocol=tcp dst-port=5698 action=drop \
  179.     comment="BackDoorTrojan-3" disabled=yes
  180. add chain=input protocol=tcp dst-port=2716 action=drop \
  181.     comment="PrayerTrojan-1" disabled=yes
  182. add chain=input protocol=tcp dst-port=9999 action=drop \
  183.     comment="PrayerTrojan-2" disabled=yes
  184. add chain=input protocol=tcp dst-port=21544 action=drop \
  185.     comment="SchwindlerTrojan-1" disabled=yes
  186. add chain=input protocol=tcp dst-port=31554 action=drop \
  187.     comment="SchwindlerTrojan-2" disabled=yes
  188. add chain=input protocol=tcp dst-port=18753 action=drop \
  189.     comment="Shaft.DDoS.Trojan-1" disabled=yes
  190. add chain=input protocol=tcp dst-port=20432 action=drop \
  191.     comment="Shaft.DDoS.Trojan-2" disabled=yes
  192. add chain=input protocol=tcp dst-port=65000 action=drop \
  193.     comment="Devil.DDoS.Trojan" disabled=yes
  194. add chain=input protocol=tcp dst-port=11831 action=drop \
  195.     comment="LatinusTrojan-1" disabled=yes
  196. add chain=input protocol=tcp dst-port=29559 action=drop \
  197.     comment="LatinusTrojan-2" disabled=yes
  198. add chain=input protocol=tcp dst-port=1784 action=drop \
  199.     comment="Snid.X2Trojan-1" disabled=yes
  200. add chain=input protocol=tcp dst-port=3586 action=drop \
  201.     comment="Snid.X2Trojan-2" disabled=yes
  202. add chain=input protocol=tcp dst-port=7609 action=drop \
  203.     comment="Snid.X2Trojan-3" disabled=yes
  204. add chain=input protocol=tcp dst-port=12348-12349 action=drop \
  205.     comment="BionetTrojan-1" disabled=yes
  206. add chain=input protocol=tcp dst-port=12478 action=drop \
  207.     comment="BionetTrojan-2" disabled=yes
  208. add chain=input protocol=tcp dst-port=57922 action=drop \
  209.     comment="BionetTrojan-3" disabled=yes
  210. add chain=input protocol=tcp dst-port=3127-3198 action=drop \
  211.     comment="Worm.Novarg.a.Mydoom.a.-1" disabled=yes
  212. add chain=input protocol=tcp dst-port=4444 action=drop \
  213.     comment="Worm.MsBlaster-1" disabled=yes
  214. add chain=input protocol=tcp dst-port=6777 action=drop \
  215.     comment="Worm.BBeagle.a.Bagle.a." disabled=yes
  216. add chain=input protocol=tcp dst-port=8866 action=drop \
  217.     comment="Worm.BBeagle.b" disabled=yes
  218. add chain=input protocol=tcp dst-port=2745 action=drop \
  219.     comment="Worm.BBeagle.c-g/j-l" disabled=yes
  220. add chain=input protocol=tcp dst-port=2556 action=drop \
  221.     comment="Worm.BBeagle.p/q/r/n" disabled=yes
  222. add chain=input protocol=tcp dst-port=20742 action=drop \
  223.     comment="Worm.BBEagle.m-2" disabled=yes
  224. add chain=input protocol=tcp dst-port=4751 action=drop \
  225.     comment="Worm.BBeagle.s/t/u/v" disabled=yes
  226. add chain=input protocol=tcp dst-port=2535 action=drop \
  227.     comment="Worm.BBeagle.aa/ab/w/x-z-2" disabled=yes
  228. add chain=input protocol=tcp dst-port=5238 action=drop \
  229.     comment="Worm.LovGate.r.RpcExploit" disabled=yes
  230. add chain=input protocol=tcp dst-port=1068 action=drop comment="Worm.Sasser.a" \
  231.     disabled=yes
  232. add chain=input protocol=tcp dst-port=5554 action=drop \
  233.     comment="Worm.Sasser.b/c/f" disabled=yes
  234. add chain=input protocol=tcp dst-port=9996 action=drop \
  235.     comment="Worm.Sasser.b/c/f" disabled=yes
  236. add chain=input protocol=tcp dst-port=9995 action=drop comment="Worm.Sasser.d" \
  237.     disabled=yes
  238. add chain=input protocol=tcp dst-port=10168 action=drop \
  239.     comment="Worm.Lovgate.a/b/c/d" disabled=yes
  240. add chain=input protocol=tcp dst-port=20808 action=drop \
  241.     comment="Worm.Lovgate.v.QQ" disabled=yes
  242. add chain=input protocol=tcp dst-port=1092 action=drop \
  243.     comment="Worm.Lovgate.f/g" disabled=yes
  244. add chain=input protocol=tcp dst-port=20168 action=drop \
  245.     comment="Worm.Lovgate.f/g" disabled=yes
  246. add chain=input protocol=tcp dst-port=593 action=drop comment="" disabled=yes
  247. add chain=input protocol=tcp dst-port=1214 action=drop comment="" disabled=yes
  248. add chain=input protocol=tcp dst-port=1363-1364 action=drop \
  249.     comment="ndm.requester" disabled=yes
  250. add chain=input protocol=tcp dst-port=1368 action=drop comment="screen.cast" \
  251.     disabled=yes
  252. add chain=input protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
  253.     disabled=yes
  254. add chain=input protocol=tcp dst-port=1377 action=drop comment="cichlid" \
  255.     disabled=yes
  256. add chain=input protocol=tcp dst-port=3410 action=drop \
  257.     comment="Backdoor.OptixPro" disabled=yes
  258. add chain=input protocol=udp dst-port=135-139 action=drop comment="" \
  259.     disabled=yes
  260. add chain=input protocol=udp dst-port=8787 action=drop \
  261.     comment="Back.Orifice.2000.Trojan-6" disabled=yes
  262. add chain=input protocol=udp dst-port=8879 action=drop \
  263.     comment="Back.Orifice.2000.Trojan-7" disabled=yes
  264. add chain=input protocol=udp dst-port=31666 action=drop \
  265.     comment="Back.Orifice.2000.Trojan-8" disabled=yes
  266. add chain=input protocol=udp dst-port=31337-31338 action=drop \
  267.     comment="Back.Orifice.2000.Trojan-9" disabled=yes
  268. add chain=input protocol=udp dst-port=54320-54321 action=drop \
  269.     comment="Back.Orifice.2000.Trojan-10" disabled=yes
  270. add chain=input protocol=udp dst-port=12345-12346 action=drop \
  271.     comment="Block.NetBus.Trojan-3" disabled=yes
  272. add chain=input protocol=udp dst-port=20034 action=drop \
  273.     comment="Block.NetBus.Trojan-4" disabled=yes
  274. add chain=input protocol=udp dst-port=21554 action=drop \
  275.     comment="GirlFriend.Trojan-2" disabled=yes
  276. add chain=input protocol=udp dst-port=41 action=drop \
  277.     comment="DeepThroat.Trojan-8" disabled=yes
  278. add chain=input protocol=udp dst-port=3150 action=drop \
  279.     comment="DeepThroat.Trojan-9" disabled=yes
  280. add chain=input protocol=udp dst-port=999 action=drop \
  281.     comment="DeepThroat.Trojan-10" disabled=yes
  282. add chain=input protocol=udp dst-port=6670 action=drop \
  283.     comment="DeepThroat.Trojan-11" disabled=yes
  284. add chain=input protocol=udp dst-port=6771 action=drop \
  285.     comment="DeepThroat.Trojan-12" disabled=yes
  286. add chain=input protocol=udp dst-port=60000 action=drop \
  287.     comment="DeepThroat.Trojan-13" disabled=yes
  288. add chain=input protocol=udp dst-port=10067 action=drop \
  289.     comment="Portal.of.Doom.Trojan-5" disabled=yes
  290. add chain=input protocol=udp dst-port=10167 action=drop \
  291.     comment="Portal.of.Doom.Trojan-6" disabled=yes
  292. add chain=input protocol=udp dst-port=3700 action=drop \
  293.     comment="Portal.of.Doom.Trojan-7" disabled=yes
  294. add chain=input protocol=udp dst-port=9872-9875 action=drop \
  295.     comment="Portal.of.Doom.Trojan-8" disabled=yes
  296. add chain=input protocol=udp dst-port=6883 action=drop \
  297.     comment="Delta.Source.Trojan-5" disabled=yes
  298. add chain=input protocol=udp dst-port=26274 action=drop \
  299.     comment="Delta.Source.Trojan-6" disabled=yes
  300. add chain=input protocol=udp dst-port=44444 action=drop \
  301.     comment="Delta.Source.Trojan-7" disabled=yes
  302. add chain=input protocol=udp dst-port=47262 action=drop \
  303.     comment="Delta.Source.Trojan-8" disabled=yes
  304. add chain=input protocol=udp dst-port=3791 action=drop \
  305.     comment="Eclypse.Trojan-1" disabled=yes
  306. add chain=input protocol=udp dst-port=3801 action=drop \
  307.     comment="Eclypse.Trojan-2" disabled=yes
  308. add chain=input protocol=udp dst-port=5880-5882 action=drop \
  309.     comment="Eclypse.Trojan-3" disabled=yes
  310. add chain=input protocol=udp dst-port=5888-5889 action=drop \
  311.     comment="Eclypse.Trojan-4" disabled=yes
  312. add chain=input protocol=udp dst-port=34555 action=drop \
  313.     comment="Trin00.DDoS.Trojan-1" disabled=yes
  314. add chain=input protocol=udp dst-port=35555 action=drop \
  315.     comment="Trin00.DDoS.Trojan-2" disabled=yes
  316. add chain=input protocol=udp dst-port=31338 action=drop \
  317.     comment="NetSpy.DK.Trojan-1" disabled=yes
  318. add chain=input protocol=udp dst-port=69 action=drop \
  319.     comment="Worm.MsBlaster-2" disabled=yes
  320. add chain=input protocol=udp dst-port=123 action=drop comment="Worm.Sobig.f-1" \
  321.     disabled=yes
  322. add chain=input protocol=udp dst-port=995-999 action=drop \
  323.     comment="Worm.Sobig.f-2" disabled=yes
  324. add chain=input protocol=udp dst-port=8998 action=drop \
  325.     comment="Worm.Sobig.f-3" disabled=yes
复制代码

[ 本帖最后由 duckybsd 于 2007-7-7 23:06 编辑 ]
routeros
回复

使用道具 举报

发表于 2007-7-8 00:03:13 | 显示全部楼层
这段东西,按道理来说,无论是在input还是在forward,其实完全没有作用(除了增加系统负担 ).......据说竟然这段东西是中文官方释放的,昏迷的说..........

[ 本帖最后由 seignior 于 2007-7-8 00:04 编辑 ]
routeros
回复

使用道具 举报

 楼主| 发表于 2007-7-8 01:01:23 | 显示全部楼层
原帖由 seignior 于 2007-7-8 00:03 发表
这段东西,按道理来说,无论是在input还是在forward,其实完全没有作用(除了增加系统负担 ).......据说竟然这段东西是中文官方释放的,昏迷的说..........


个人觉得,把一些某段时间内流行的木马端口,放在forward链当中drop掉得话,还是有一定的保护内网用户的作用的,多了就无意了,对性能影响确实挺大的。
routeros
回复

使用道具 举报

发表于 2007-7-8 01:16:55 | 显示全部楼层
问题是,你觉得ros会中上述列表的木马、病毒嘛(input)?而如果是针对内网,因为是经过NAT的,端口早改变了,放在forward又有什么用?
routeros
回复

使用道具 举报

 楼主| 发表于 2007-7-8 01:35:15 | 显示全部楼层
原帖由 seignior 于 2007-7-8 01:16 发表
问题是,你觉得ros会中上述列表的木马、病毒嘛(input)?而如果是针对内网,因为是经过NAT的,端口早改变了,放在forward又有什么用?



ros不会中,但是forward中,即使是NAT出去的包目的端口是不会变的。同样进来的包源端口是不会变的。
routeros
回复

使用道具 举报

发表于 2007-7-8 01:52:40 | 显示全部楼层
学习中,顶
routeros
回复

使用道具 举报

发表于 2007-7-8 02:54:41 | 显示全部楼层
原帖由 duckybsd 于 2007-7-8 01:35 发表



ros不会中,但是forward中,即使是NAT出去的包目的端口是不会变的。同样进来的包源端口是不会变的。



我举个简单的例子吧,假设病毒需要打开了111这个端口,局域网有10台机器中了这个病毒,你觉得nat路由有多少个111端口可以开放给下面这10台机?


另外,nat是边缘路由,如果不在nat表里等待的链接,外部进来的请求,又如何能到达内网?(换一句话说,对于边缘路由,外面到达的包,如果不是内网某个之前发出去的链接所期待的答复,就根本不会进内网而被直接仍掉,NAT正式的名称是“边缘路由”,这个意思本来就是说,这个玩意就是单向的,不是传统路由般双向)
routeros
回复

使用道具 举报

发表于 2007-7-8 16:34:25 | 显示全部楼层
什么狗屁传说中的官网防火墙(估计也是冒充),害死不少人...
routeros
回复

使用道具 举报

发表于 2007-7-10 00:47:28 | 显示全部楼层

不明白你的意思

真没看得懂楼主的意思,我用PPPOE就没什么问题,呵呵但是PING值是大了点,问题是好象没什么影响嘛. 我就没加什么所谓防病毒的规则,还不是用得好好的,我所见过的迷信加这些脚本的 莫名其妙的多了
routeros
回复

使用道具 举报

您需要登录后才可以回帖 登录 | 注册

本版积分规则

QQ|Archiver|手机版|小黑屋|软路由 ( 渝ICP备15001194号-1|渝公网安备 50011602500124号 )

GMT+8, 2024-11-22 12:03 , Processed in 0.135866 second(s), 4 queries , Gzip On, Redis On.

Powered by Discuz! X3.5 Licensed

© 2001-2024 Discuz! Team.

快速回复 返回顶部 返回列表