pctine wrote:
webfig 我沒有...(恕刪)
請問pctine大您是如何單獨將功能給匯出命令的,使用winbox那麼久這招我還是不會..
gfx wrote:
目前都是用Port Forwarding來做感覺不是很安全,希望能用觸發的方式來解決,
有用的時候Port才開啟....(恕刪)
RouterOS port trigger 應該是要結合 ip firewall filter, ip firewall nat & script 來達成. 日後有空再來補做法.
不過你可能誤會了 port trigger 的用法了, 一般 port trigger 並不是為了 security, 通常是為了某某些特定的 service. 例如 IRC.
如果你是為了安全的因素, 可以參考 port knocking, 參考 1F 的索引, 上面有說明.
FB: Pctine
ipv6 firewall
==
/ipv6 firewall filter
add chain=input content="Router - Allow IPv6 ICMP" protocol=icmpv6
add chain=input connection-state=established content=\
"Router - Accept established connections"
add action=drop chain=input connection-state=invalid content=\
"Router - Drop invalid connections"
add chain=input content="Router- UDP" protocol=udp
add chain=input content="Router - From our LAN" in-interface=\
ether3-master-local
add action=drop chain=input content="Router - Drop other traffic"
add action=drop chain=forward connection-state=invalid content=\
"LAN - Drop invalid Connections"
add chain=forward content="LAN - Accept UDP" protocol=udp
add chain=forward content="LAN - Accept ICMPv6" protocol=icmpv6
add chain=forward connection-state=related content=\
"LAN - Accept related connections"
add chain=forward content="LAN - Internal traffic" in-interface=\
ether3-master-local
add action=log chain=forward content="LAN - Log everything else" log-prefix=\
"Log IPv6"
add action=reject chain=forward connection-state=new content=\
"LAN - Drop everything else" in-interface=pppoe-out1
/ipv6 firewall mangle
add action=change-mss chain=forward in-interface=all-ppp new-mss=1432 \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
add action=change-mss chain=forward new-mss=1432 out-interface=all-ppp \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
/ipv6 nd
set [ find default=yes ] disabled=yes mtu=1500
add advertise-dns=yes hop-limit=64 interface=ether3-master-local \
managed-address-configuration=yes
===
ether3-master-local 是我目前的lan ip
依請況 修改你的資訊
----
ipv6 讓yahoo 網頁正常顯示
===
/ipv6 firewall mangle
add action=change-mss chain=forward in-interface=all-ppp new-mss=1432 \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
add action=change-mss chain=forward new-mss=1432 out-interface=all-ppp \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
==
修改mss
套用即可
資訊都來自網站
打開winbox
左邊有一個選項是
New Terminal
點下去，會直接進入 Terminal 模式(已經登入的routeros 的機器)
簡單的操作方式
==
MMM MMM KKK TTTTTTTTTTT KKK
MMMM MMMM KKK TTTTTTTTTTT KKK
MMM MMMM MMM III KKK KKK RRRRRR OOOOOO TTT III KKK KKK
MMM MM MMM III KKKKK RRR RRR OOO OOO TTT III KKKKK
MMM MMM III KKK KKK RRRRRR OOO OOO TTT III KKK KKK
MMM MMM III KKK KKK RRR RRR OOOOOO TTT III KKK KKK
MikroTik RouterOS 6.6 (c) 1999-2013 http://www.mikrotik.com/
[?] Gives the list of available commands
command [?] Gives help on the command and list of arguments
[Tab] Completes the command/word. If the input is ambigous,
a second [Tab] gives possible options
/ Move up to base level
.. Move up one level
/command Use command at the base level
[admin@xxx CO.] > /interface
[admin@xxx CO.] /interface> /
[admin@xxx CO.] > /ipv6
[admin@xxx CO.] /ipv6>
.. -- go up to root
address --
dhcp-client -- DHCPv6 client settings
dhcp-relay -- DHCPv6 relay settings
dhcp-server -- DHCPv6 server settings
firewall --
nd --
neighbor --
pool -- IPv6 address pools
route --
settings --
export -- Print or save an export script that can be used to restore configuration
[admin@xxx CO.] /ipv6> dhcp-client
[admin@xxx CO.] /ipv6 dhcp-client>
add disable enable find release renew
comment edit export print remove set
[admin@xxx CO.] /ipv6 dhcp-client> /
[admin@xxx CO.] > /ipv6
[admin@xxx CO.] /ipv6> firewall
[admin@xxx CO.] /ipv6 firewall> mangle
[admin@xxx CO.] /ipv6 firewall mangle> export
# nov/18/2013 15:48:26 by RouterOS 6.6
# software id = KML9-H8L7
#
/ipv6 firewall mangle
add action=change-mss chain=forward in-interface=all-ppp new-mss=1432 \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
add action=change-mss chain=forward new-mss=1432 out-interface=all-ppp \
protocol=tcp tcp-flags=syn tcp-mss=1433-65535
[admin@xxx CO.] /ipv6 firewall mangle>
--
直接倒出 就不用貼照片了
注:
目前用ipv6 上mobile01 似乎有時候會無法上mobile01的網站。ping也ping不到
內文搜尋
從 APP 打開
X