发我的firewall代码,哪位高手帮我查查有什么问题!

fkuxfchina

偶的# mar/04/2005 08:06:43 by routeros 2.8.17# software id = BN9N-07T#/ ip firewall rule input add protocol=udp action=accept comment="" disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:135-139 protocol=udp action=drop comment="" disabled=no add dst-address=:445 protocol=tcp action=drop comment="" disabled=no add dst-address=:500 protocol=tcp action=drop comment="" disabled=no add dst-address=:1024-1030 protocol=tcp action=drop comment="" disabled=no add dst-address=:1024-1030 protocol=udp action=drop comment="" disabled=no add dst-address=:1068 protocol=tcp action=drop comment="" disabled=no add dst-address=:1068 protocol=udp action=drop comment="" disabled=no add dst-address=:1723 protocol=tcp action=drop comment="" disabled=no add dst-address=:4444 protocol=tcp action=drop comment="" disabled=no add dst-address=:5554 protocol=tcp action=drop comment="" disabled=no add dst-address=:6880-6890 protocol=tcp action=drop comment="" disabled=no add dst-address=:6880-6890 protocol=udp action=drop comment="" disabled=no add dst-address=:39213 protocol=tcp action=drop comment="" disabled=no add dst-address=XXXXXXXXXX/32 protocol=icmp action=drop comment="" \    disabled=no add connection-state=invalid action=drop comment="" disabled=no add src-address=!10.128.202.0/24 action=drop comment="" disabled=no 再就是下面的这个图了大家看看。10.128.202.255:135-139都有  是UDP的。。我都封掉了的呀。为什么还有呢。这个是内网端口向外发的吧。图片在附件中。。。谢了。。。

fkuxfchina

有好多这样的。。别的还好。没有了。都封了。。这样对CPU的占用有很大的问题。CPU都用到20%了。晕。

fkuxfchina

怎么没有人回复呢！帮我看看呀。

rainy

应该是add src-address=10.128.202.0/24:135-139 protocol=udp action=drop comment="" disabled=no 看看图中的 src-address 和 dst-address

中意

如果没有病毒的话，一般没有135－139的数据包的啊是不是内网中招了

pxgxb

不一定，访问网上邻居的时候就是用的139端口！

fkuxfchina

偶试试吧。。。我也是这样想的。如果内网没有毒。。他也不会发送135-138的包对外呀。不过还好。过几天网吧要K盘了。。再就做全盘保护。。。这样就没毒了。。。。但是有一点。add src-address=10.128.202.0/24:135-139 protocol=udp action=drop comment="" disabled=no 为什么是要加入src-address=10.128.202.0./24呢。。我封的是所有的135-139。也包括内网的呀。。

rainy

你的规则加入的是 input，routeros只会drop 访问自己的135-139的包。而你受到攻击的端口并不是135-139，所以中招要搞清楚 input output forward 的关系

hzkane

QUOTE (fkuxfchina @ Mar 5 2005, 12:40 AM)
偶的# mar/04/2005 08:06:43 by RouterOS 2.8.17# software id = BN9N-07T#/ ip firewall rule input add protocol=udp action=accept comment="" disabled=no add dst-address=:135-139 protocol=tcp action=drop comment="" disabled=no add dst-address=:135-139 protocol=udp action=drop comment="" disabled=no add dst-address=:445 protocol=tcp action=drop comment="" disabled=no add dst-address=:500 protocol=tcp action=drop comment="" disabled=no add dst-address=:1024-1030 protocol=tcp action=drop comment="" disabled=no add dst-address=:1024-1030 protocol=udp action=drop comment="" disabled=no add dst-address=:1068 protocol=tcp action=drop comment="" disabled=no add dst-address=:1068 protocol=udp action=drop comment="" disabled=no add dst-address=:1723 protocol=tcp action=drop comment="" disabled=no add dst-address=:4444 protocol=tcp action=drop comment="" disabled=no add dst-address=:5554 protocol=tcp action=drop comment="" disabled=no add dst-address=:6880-6890 protocol=tcp action=drop comment="" disabled=no add dst-address=:6880-6890 protocol=udp action=drop comment="" disabled=no add dst-address=:39213 protocol=tcp action=drop comment="" disabled=no add dst-address=XXXXXXXXXX/32 protocol=icmp action=drop comment="" \    disabled=no add connection-state=invalid action=drop comment="" disabled=no add src-address=!10.128.202.0/24 action=drop comment="" disabled=no 再就是下面的这个图了大家看看。10.128.202.255:135-139都有  是UDP的。。我都封掉了的呀。为什么还有呢。这个是内网端口向外发的吧。图片在附件中。。。谢了。。。  
  防火墙规则还是过于简单。连起码的UDP 123端口等都没封闭。。继续努力。。。TCP 1723端口是标准的VPN端口。你都封了？呵呵，