求助一个问题，ROS高手进下。感激。

乡村小子

我的ros在很多网吧使用都出现过一个怪问题。
问题是： 某台机器IP无法上网，但可以PING通任何内外网IP。就是打不开网站玩不了游戏等。

当我在CONN连接里把此IP的当前连接删除后，就可以正常上网。。
起初这个问题只出现在下载流量比较大的服务器上，现在客户机也常出现。。
谁能告诉怎么解决？以下是我使用的防火墙规则。
# firewall filte scripts
# Edit chenyang
#
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=5s \
  tcp-established-timeout=5h tcp-fin-wait-timeout=10s \
  tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
  tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
  udp-stream-timeout=2m icmp-timeout=10s generic-timeout=5m



# firewall filte scripts
# Edit chenyang
#
/ ip firewall filter
add chain=input connection-state=invalid action=drop \
    comment="丢弃非法连接数据" disabled=no
/ip firewall filter
add action=drop chain=forward comment="机器狗目标地址过滤" disabled=no dst-address-list=Robotdog
add action=jump chain=forward comment="跳转机器狗过域名滤规则" disabled=no jump-target=Robotdog
add chain=input protocol=tcp dst-port=80 connection-limit=20,0 action=drop \
    comment="限制总http连接数为20" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop \
    comment="探测并丢弃端口扫描连接" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
    action=tarpit comment="压制DoS攻击" disabled=no
add chain=input protocol=tcp connection-limit=10,32 \
    action=add-src-to-address-list address-list=black_list \
    address-list-timeout=1d comment="探测DoS攻击" disabled=no
add chain=input dst-address-type=!local action=drop comment="丢弃掉非本地数据" \
    disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP \
    comment="跳转到ICMP链表" disabled=no
add chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept \
    comment="Ping应答限制为每秒5个包" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5 action=accept \
    comment="Traceroute限制为每秒5个包" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5 action=accept \
    comment="MTU线路探测限制为每秒5个包" disabled=no
add chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept \
    comment="Ping请求限制为每秒5个包" disabled=no
add chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept \
    comment="Trace TTL限制为每秒5个包" disabled=no
add chain=ICMP protocol=icmp action=drop comment="丢弃掉任何ICMP数据" \
    disabled=no
add chain=forward connection-state=invalid action=drop \
    comment="丢弃非法数据包" disabled=no
add chain=forward protocol=tcp connection-limit=80,32 action=drop \
    comment="限制每个主机TCP连接数为80条" disabled=no
add chain=forward src-address-type=!unicast action=drop \
    comment="丢弃掉所有非单播数据" disabled=no
add chain=forward protocol=icmp action=jump jump-target=ICMP \
    comment="跳转到ICMP链表" disabled=no
add chain=forward action=jump jump-target=virus comment="跳转到病毒链表" \
    disabled=no
add chain=virus protocol=tcp dst-port=41 action=drop \
    comment="DeepThroat.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=82 action=drop \
    comment="Worm.NetSky.Y@mm" disabled=no
add chain=virus protocol=tcp dst-port=113 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-1" disabled=no
add chain=virus protocol=tcp dst-port=2041 action=drop \
    comment="W33.Korgo.A/B/C/D/E/F-2" disabled=no
add chain=virus protocol=tcp dst-port=3150 action=drop \
    comment="DeepThroat.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=3067 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-3" disabled=no
add chain=virus protocol=tcp dst-port=3422 action=drop \
    comment="Backdoor.IRC.Aladdinz.R-1" disabled=no
add chain=virus protocol=tcp dst-port=6667 action=drop \
    comment="W32.Korgo.A/B/C/D/E/F-4" disabled=no
add chain=virus protocol=tcp dst-port=6789 action=drop \
    comment="Worm.NetSky.S/T/U@mm" disabled=no
add chain=virus protocol=tcp dst-port=8787 action=drop \
    comment="Back.Orifice.2000.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=8879 action=drop \
    comment="Back.Orifice.2000.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=8967 action=drop \
    comment="W32.Dabber.A/B-2" disabled=no
add chain=virus protocol=tcp dst-port=9999 action=drop \
    comment="W32.Dabber.A/B-3" disabled=no
add chain=virus protocol=tcp dst-port=20034 action=drop \
    comment="Block.NetBus.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=21554 action=drop \
    comment="GirlFriend.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=31666 action=drop \
    comment="Back.Orifice.2000.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=43958 action=drop \
    comment="Backdoor.IRC.Aladdinz.R-2" disabled=no
add chain=virus protocol=tcp dst-port=999 action=drop \
    comment="DeepThroat.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=6670 action=drop \
    comment="DeepThroat.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=6771 action=drop \
    comment="DeepThroat.Trojan-5" disabled=no
add chain=virus protocol=tcp dst-port=60000 action=drop \
    comment="DeepThroat.Trojan-6" disabled=no
add chain=virus protocol=tcp dst-port=2140 action=drop \
    comment="DeepThroat.Trojan-7" disabled=no
add chain=virus protocol=tcp dst-port=10067 action=drop \
    comment="Portal.of.Doom.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=10167 action=drop \
    comment="Portal.of.Doom.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=3700 action=drop \
    comment="Portal.of.Doom.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=9872-9875 action=drop \
    comment="Portal.of.Doom.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=6883 action=drop \
    comment="Delta.Source.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=26274 action=drop \
    comment="Delta.Source.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop \
    comment="Delta.Source.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=47262 action=drop \
    comment="Delta.Source.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=3791 action=drop \
    comment="Eclypse.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3801 action=drop \
    comment="Eclypse.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=65390 action=drop \
    comment="Eclypse.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=5880-5882 action=drop \
    comment="Y3K.RAT.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5888-5889 action=drop \
    comment="Y3K.RAT.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=30100-30103 action=drop \
    comment="NetSphere.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=30133 action=drop \
    comment="NetSphere.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=7300-7301 action=drop \
    comment="NetMonitor.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=7306-7308 action=drop \
    comment="NetMonitor.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=79 action=drop \
    comment="FireHotcker.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5031 action=drop \
    comment="FireHotcker.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=5321 action=drop \
    comment="FireHotcker.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=6400 action=drop \
    comment="TheThing.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=1047 action=drop \
    comment="GateCrasher.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=6969-6970 action=drop \
    comment="GateCrasher.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=2774 action=drop comment="SubSeven-1" \
    disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="SubSeven-2" \
    disabled=no
add chain=virus protocol=tcp dst-port=1243 action=drop comment="SubSeven-3" \
    disabled=no
add chain=virus protocol=tcp dst-port=1234 action=drop comment="SubSeven-4" \
    disabled=no
add chain=virus protocol=tcp dst-port=6711-6713 action=drop \
    comment="SubSeven-5" disabled=no
add chain=virus protocol=tcp dst-port=16959 action=drop comment="SubSeven-7" \
    disabled=no
add chain=virus protocol=tcp dst-port=25685-25686 action=drop \
    comment="Moonpie.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=25982 action=drop \
    comment="Moonpie.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=31337-31339 action=drop \
    comment="NetSpy.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=8102 action=drop comment="Trojan" \
    disabled=no
add chain=virus protocol=tcp dst-port=8011 action=drop comment="WAY.Trojan" \
    disabled=no
add chain=virus protocol=tcp dst-port=7626 action=drop comment="Trojan.BingHe" \
    disabled=no
add chain=virus protocol=tcp dst-port=19191 action=drop \
    comment="Trojan.NianSeHoYian" disabled=no
add chain=virus protocol=tcp dst-port=23444-23445 action=drop \
    comment="NetBull.Trojan" disabled=no
add chain=virus protocol=tcp dst-port=2583 action=drop \
    comment="WinCrash.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3024 action=drop \
    comment="WinCrash.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=4092 action=drop \
    comment="WinCrash.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=5714 action=drop \
    comment="WinCrash.Trojan-4" disabled=no
add chain=virus protocol=tcp dst-port=1010-1012 action=drop \
    comment="Doly1.0/1.35/1.5trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=1015 action=drop \
    comment="Doly1.0/1.35/1.5trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=2004-2005 action=drop \
    comment="TransScout.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=9878 action=drop \
    comment="TransScout.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=2773 action=drop \
    comment="Backdoor.YAI..Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=7215 action=drop \
    comment="Backdoor.YAI.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=54283 action=drop \
    comment="Backdoor.YAI.Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=1003 action=drop \
    comment="BackDoorTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=5598 action=drop \
    comment="BackDoorTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=5698 action=drop \
    comment="BackDoorTrojan-3" disabled=no
add chain=virus protocol=tcp dst-port=31554 action=drop \
    comment="SchainwindlerTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=18753 action=drop \
    comment="Shaft.DDoS.Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=20432 action=drop \
    comment="Shaft.DDoS.Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=65000 action=drop \
    comment="Devil.DDoS.Trojan" disabled=no
add chain=virus protocol=tcp dst-port=11831 action=drop \
    comment="LatinusTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=29559 action=drop \
    comment="LatinusTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=1784 action=drop \
    comment="Snid.X2Trojan-1" disabled=no
add chain=virus protocol=tcp dst-port=3586 action=drop \
    comment="Snid.X2Trojan-2" disabled=no
add chain=virus protocol=tcp dst-port=7609 action=drop \
    comment="Snid.X2Trojan-3" disabled=no
add chain=virus protocol=tcp dst-port=12348-12349 action=drop \
    comment="BionetTrojan-1" disabled=no
add chain=virus protocol=tcp dst-port=12478 action=drop \
    comment="BionetTrojan-2" disabled=no
add chain=virus protocol=tcp dst-port=57922 action=drop \
    comment="BionetTrojan-3" disabled=no
add chain=virus protocol=tcp dst-port=3127 action=drop \
    comment="Worm.Novarg.a.Mydoom.a1." disabled=no
add chain=virus protocol=tcp dst-port=6777 action=drop \
    comment="Worm.BBeagle.a.Bagle.a." disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop \
    comment="Worm.BBeagle.b" disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop \
    comment="Worm.BBeagle.c-g/j-l" disabled=no
add chain=virus protocol=tcp dst-port=2556 action=drop \
    comment="Worm.BBeagle.p/q/r/n" disabled=no
add chain=virus protocol=tcp dst-port=20742 action=drop \
    comment="Worm.BBEagle.m-2" disabled=no
add chain=virus protocol=tcp dst-port=4751 action=drop \
    comment="Worm.BBeagle.s/t/u/v" disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop \
    comment="Worm.BBeagle.aa/ab/w/x-z-2" disabled=no
add chain=virus protocol=tcp dst-port=5238 action=drop \
    comment="Worm.LovGate.r.RpcExploit" disabled=no
add chain=virus protocol=tcp dst-port=1068 action=drop comment="Worm.Sasser.a" \
    disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop \
    comment="Worm.Sasser.b/c/f" disabled=no
add chain=virus protocol=tcp dst-port=9996 action=drop \
    comment="Worm.Sasser.b/c/f" disabled=no
add chain=virus protocol=tcp dst-port=9995 action=drop comment="Worm.Sasser.d" \
    disabled=no
add chain=virus protocol=tcp dst-port=10168 action=drop \
    comment="Worm.Lovgate.a/b/c/d" disabled=no
add chain=virus protocol=tcp dst-port=20808 action=drop \
    comment="Worm.Lovgate.v.QQ" disabled=no
add chain=virus protocol=tcp dst-port=1092 action=drop \
    comment="Worm.Lovgate.f/g" disabled=no
add chain=virus protocol=tcp dst-port=20168 action=drop \
    comment="Worm.Lovgate.f/g" disabled=no
add chain=virus protocol=tcp dst-port=1363-1364 action=drop \
    comment="ndm.requester" disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen.cast" \
    disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
    disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichainlid" \
    disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop \
    comment="Backdoor.Optixprotocol" disabled=no
add chain=virus protocol=tcp dst-port=8888 action=drop \
    comment="Worm.BBeagle.b" disabled=no
add chain=virus protocol=udp dst-port=44444 action=drop \
    comment="Delta.Source.Trojan-7" disabled=no
add chain=virus protocol=udp dst-port=8998 action=drop \
    comment="Worm.Sobig.f-3" disabled=no
add chain=virus protocol=udp dst-port=123 action=drop comment="Worm.Sobig.f-1" \
    disabled=no
add chain=virus protocol=tcp dst-port=3198 action=drop \
    comment="Worm.Novarg.a.Mydoom.a2." disabled=no
add chain=virus protocol=tcp dst-port=139 action=drop comment="Drop Blaster \
    Worm" disabled=no
add chain=virus protocol=tcp dst-port=135 action=drop comment="Drop Blaster \
    Worm" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster \
    Worm" disabled=no
add chain=forward action=accept comment="接受所有数据" disabled=no
add action=drop chain=Robotdog comment="" content=yu.8s7.net disabled=no
add action=drop chain=Robotdog comment="" content=www.777ggg.com disabled=no
add action=drop chain=Robotdog comment="" content=18mo.com disabled=no
add action=drop chain=Robotdog comment="" content=xxx.m111.biz disabled=no
add action=drop chain=Robotdog comment="" content=xxx.mmma.biz disabled=no
add action=drop chain=Robotdog comment="" content=11SSS.COM disabled=no
add action=drop chain=Robotdog comment="" content=jopenqq.com disabled=no
add action=drop chain=Robotdog comment="" content=t.11se.com disabled=no
add action=drop chain=Robotdog comment="" content=www.94ak.com disabled=no
add action=drop chain=Robotdog comment="" content=ask.35832.com disabled=no
add action=drop chain=Robotdog comment="" content=wwww.35832.com disabled=no
add action=drop chain=Robotdog comment="" content=www.pt950yr.cn disabled=no
add action=drop chain=Robotdog comment="" content=832823.cn disabled=no
add action=drop chain=Robotdog comment="" content=www.99mmm.com disabled=no
add action=drop chain=Robotdog comment="" content=rrr.jopenkk.com disabled=no
add action=drop chain=Robotdog comment="" content=366ip.com disabled=no
add action=drop chain=Robotdog comment="" content=www.366ip.com disabled=no
add action=drop chain=Robotdog comment="" content=www.161816.com disabled=no
add action=drop chain=Robotdog comment="" content=down.dj7788.cn disabled=no
add action=drop chain=Robotdog comment="" content=www.15197.com disabled=no
add action=drop chain=Robotdog comment="" content=www.66ki.cn disabled=no
add action=drop chain=Robotdog comment="" content=xx.exiao01.com disabled=no
add action=drop chain=Robotdog comment="" content=1.ehai01.com disabled=no
add action=drop chain=Robotdog comment="" content=bbb.ehai01.com disabled=no
add action=drop chain=Robotdog comment="" content=a.6u6.biz disabled=no
add action=drop chain=Robotdog comment="" content=www.exiao00.com disabled=no
add action=drop chain=Robotdog comment="" content=www.shliao.com disabled=no
add action=drop chain=Robotdog comment="" content=love.netskys.cn disabled=no
add action=drop chain=Robotdog comment="" content=www.luckbird8.cn disabled=no
add action=drop chain=Robotdog comment="" content=www.webye163.com disabled=no
add action=drop chain=Robotdog comment="" content=www.3389qiqi.com disabled=no
add action=drop chain=Robotdog comment="" content=www.nba1234671.com disabled=no
add action=drop chain=Robotdog comment="" content=down.18.dd.net disabled=no
add action=drop chain=Robotdog comment="" content=qqq.dzydhx.com disabled=no
add action=drop chain=Robotdog comment="" content=mmpp.lovemmll.cn disabled=no
add action=drop chain=Robotdog comment="" content=www.333292.com disabled=no
add action=drop chain=Robotdog comment="" content=www.caiyi8.com disabled=no
add action=drop chain=Robotdog comment="" content=www.zhaoyou8.com disabled=no

twticfvtk

太长了.看不懂..帮顶啦...

zhuww

建议把这几个删除，觉得官方防火墙有些多余的东西，用了反而不好

add chain=input protocol=tcp dst-port=80 connection-limit=20,0 action=drop \
    comment="限制总http连接数为20" disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop \
    comment="探测并丢弃端口扫描连接" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
    action=tarpit comment="压制DoS攻击" disabled=no
add chain=input protocol=tcp connection-limit=10,32 \
    action=add-src-to-address-list address-list=black_list \
    address-list-timeout=1d comment="探测DoS攻击" disabled=no

乡村小子

恩。谢谢。但是关键的原因不知道在哪里

为何某IP会出现无法上网却又能PING通。。

删除当前连接又可以正常的问题。。


很微妙，哪位大哥能具体告诉我原因？或者修改方案。

ly03j3

建议把大部份防火停了，留一两个防三波，灰鸽基本可以了

guxing

很简单的问题，把add chain=forward action=jump jump-target=virus comment="跳转到病毒链表" \
    disabled=no 这个规则停掉看看。应该就没问题了。

乡村小子

恩.谢谢.我按楼上所说试试.感激了。

乡村小子

原帖由 ly03j3 于 2008-9-18 10:02 发表

                               
登录/注册后可看大图

建议把大部份防火停了，留一两个防三波，灰鸽基本可以了

这样不行.我试过.网吧问题多....

乡村小子

QQ:26943 ..希望高手可以帮我认真看下,并解决下。楼上的 跳转病毒列表的 规则,我已经删除了。测试3天..谢谢.

seignior

1.virus那段，完全毫无意义，直接删除即可。论坛之前有帖简单讨论过这个问题，我就不细说了；
2.不能掌握的所谓“优化”，强烈建议不要执行，包括类似这些ros策略，操作系统的优化等等；
3./ ip firewall connection tracking tcp-established-timeout=5h时间过长，5分钟就完全足够了。
---------------------
add chain=input protocol=tcp dst-port=80 connection-limit=20,0 action=drop \
    comment="限制总http连接数为20" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
    action=tarpit comment="压制DoS攻击" disabled=no
add chain=input protocol=tcp connection-limit=10,32 \
    action=add-src-to-address-list address-list=black_list \
    address-list-timeout=1d comment="探测DoS攻击" disabled=no

去掉

d4rk

如果想从根本上解决问题，建议 sniff 一下 那个上不了网的机器，把 log 发上来，大家帮你读一下，看看问题出再哪，总这样一下一下的试 要弄到啥个年头去...

石开

add chain=forward protocol=tcp connection-limit=80,32 action=drop \
    comment="限制每个主机TCP连接数为80条" disabled=no

这个，限制了tcp连接

tpy372

10楼正解

网络-浪子

用这种垃圾防火墙，不出问题就怪了

乡村小子

原帖由 seignior 于 2008-9-21 22:49 发表

                               
登录/注册后可看大图

1.virus那段，完全毫无意义，直接删除即可。论坛之前有帖简单讨论过这个问题，我就不细说了；
2.不能掌握的所谓“优化”，强烈建议不要执行，包括类似这些ros策略，操作系统的优化等等；
3./ ip firewall connecti ...

嗯.我按您的方式做下.谢谢。