• 860

[研究所] MikroTik RouterOS 學習 (持續更新)

gfx wrote:
我下午就發現到了!h...(恕刪)


原來如此

我以為,我玩 QOS 搞掛了





Other 這部分掛了,上傳可以控制下載卻不行。

最初設定 other 沒問題,後來慢慢加其他的上去,other 下載就無法控制,
全部關閉僅保留 other 也沒用。

碰過幾次,管理失效,只是開啟編輯視窗再按下確認鈕居然就可接受管理...

以下 QoS 只是好玩,能用大半、不能用也大半,純粹測試用

/ip firewall mangle
add action=change-mss chain=forward in-interface=all-ppp new-mss=1452 \
protocol=tcp tcp-flags=syn tcp-mss=1453-65535
add action=change-mss chain=forward new-mss=1452 out-interface=all-ppp \
protocol=tcp tcp-flags=syn tcp-mss=1453-65535
add action=change-ttl chain=output comment="\\C5\\DC\\A7\\F3 TTL" new-ttl=set:128
add action=mark-connection chain=prerouting comment=DNS connection-state=new \
new-connection-mark=DNS port=53 protocol=udp
add action=mark-packet chain=prerouting connection-mark=DNS new-packet-mark=\
DNS passthrough=no
add action=mark-connection chain=postrouting connection-state=new \
new-connection-mark=DNS port=53 protocol=udp
add action=mark-packet chain=postrouting connection-mark=DNS new-packet-mark=\
DNS passthrough=no
add action=mark-connection chain=prerouting comment=VOIP in-interface=all-ppp \
new-connection-mark=VOIP port=5060,5061,10000-20000 protocol=udp
add action=mark-packet chain=prerouting connection-mark=VOIP new-packet-mark=\
VOIP passthrough=no
add action=mark-connection chain=postrouting new-connection-mark=VOIP-ou \
out-interface=all-ppp port=5060,5061,10000-20000 protocol=udp
add action=mark-packet chain=postrouting connection-mark=VOIP-up \
new-packet-mark=VOIP-up passthrough=no
add action=mark-connection chain=prerouting comment=UDP connection-state=new \
in-interface=all-ppp new-connection-mark=UDP protocol=udp
add action=mark-packet chain=prerouting connection-mark=UDP new-packet-mark=\
UDP passthrough=no
add action=mark-connection chain=postrouting connection-state=new \
new-connection-mark=UDP-up out-interface=all-ppp protocol=udp
add action=mark-packet chain=postrouting connection-mark=UDP-up \
new-packet-mark=UDP-up passthrough=no
add action=mark-connection chain=prerouting comment=ICMP connection-state=new \
new-connection-mark=ICMP protocol=icmp
add action=mark-packet chain=prerouting connection-mark=ICMP new-packet-mark=\
ICMP passthrough=no
add action=mark-connection chain=postrouting connection-state=new \
new-connection-mark=ICMP protocol=icmp
add action=mark-packet chain=postrouting connection-mark=ICMP \
new-packet-mark=ICMP passthrough=no
add action=mark-packet chain=postrouting comment=ACK new-packet-mark=ACK \
packet-size=0-123 passthrough=no protocol=tcp tcp-flags=ack
add action=mark-packet chain=prerouting new-packet-mark=ACK packet-size=0-123 \
passthrough=no protocol=tcp tcp-flags=ack
add action=mark-connection chain=prerouting comment=HTTP connection-mark=\
!HTTP_BIG connection-state=new in-interface=all-ppp new-connection-mark=\
HTTP port=80,443 protocol=tcp
add action=mark-packet chain=prerouting connection-mark=HTTP_BIG \
new-packet-mark=HTTP_BIG passthrough=no
add action=mark-connection chain=postrouting connection-mark=!HTTP_BIG-up \
connection-state=new new-connection-mark=HTTP-up out-interface=all-ppp \
port=80,443 protocol=tcp
add action=mark-packet chain=postrouting connection-mark=HTTP_BIG-up \
new-packet-mark=HTTP_BIG-up passthrough=no
add action=mark-connection chain=prerouting connection-bytes=500000-0 \
connection-mark=HTTP connection-rate=200k-100M in-interface=all-ppp \
new-connection-mark=HTTP_BIG protocol=tcp
add action=mark-packet chain=prerouting connection-mark=HTTP new-packet-mark=\
HTTP passthrough=no
add action=mark-connection chain=postrouting connection-bytes=500000-0 \
connection-mark=HTTP-up connection-rate=200k-100M new-connection-mark=\
HTTP_BIG-up out-interface=all-ppp protocol=tcp
add action=mark-packet chain=postrouting connection-mark=HTTP-up \
new-packet-mark=HTTP-up passthrough=no
add action=mark-connection chain=prerouting comment=OTHER connection-mark=\
no-mark in-interface=all-ppp new-connection-mark=OTHER
add action=mark-packet chain=prerouting connection-mark=OTHER \
new-packet-mark=OTHER passthrough=no
add action=mark-connection chain=postrouting connection-mark=no-mark \
new-connection-mark=OTHER-up out-interface=all-ppp
add action=mark-packet chain=postrouting connection-mark=OTHER-up \
new-packet-mark=OTHER-up passthrough=no

/queue tree
add limit-at=2M max-limit=20M name=LEVEL_A_UP parent=ether1-gateway queue=\
default
add limit-at=10M max-limit=100M name=LEVEL_A_DWON parent=global queue=default
add limit-at=2M max-limit=20M name=LEVEL_B_UP parent=ether1-gateway queue=\
default
add limit-at=10M max-limit=100M name=LEVEL_B_DWON parent=global queue=default
add limit-at=10M max-limit=100M name=LEVEL_C_DWON parent=global queue=default
add limit-at=2M max-limit=20M name=LEVEL_C_UP parent=ether1-gateway queue=\
default
add name=VOIP_U packet-mark=VOIP-up parent=LEVEL_A_UP priority=1 queue=\
default
add name=VOIP_D packet-mark=VOIP parent=LEVEL_A_DWON priority=1 queue=default
add name=ACK_D packet-mark=ACK parent=LEVEL_B_DWON priority=1 queue=default
add name=ACK_U packet-mark=ACK parent=LEVEL_B_UP priority=1 queue=default
add name=DNS_U packet-mark=DNS parent=LEVEL_B_UP priority=2 queue=default
add name=DNS_D packet-mark=DNS parent=LEVEL_B_DWON priority=2 queue=default
add name=UDP_U packet-mark=UDP-up parent=LEVEL_B_UP priority=3 queue=default
add name=UDP_D packet-mark=UDP parent=LEVEL_B_DWON priority=3 queue=default
add name=ICMP_U packet-mark=ICMP parent=LEVEL_B_UP priority=4 queue=default
add name=ICMP_D packet-mark=ICMP parent=LEVEL_B_DWON priority=4 queue=default
add name=HTTP_U packet-mark=HTTP-up parent=LEVEL_C_UP priority=1 queue=\
default
add name=HTTP_D packet-mark=HTTP parent=LEVEL_C_DWON priority=1 queue=default
add name=HTTP_BIG_U packet-mark=HTTP_BIG-up parent=LEVEL_C_UP priority=2 \
queue=default
add name=HTTP_BIG_D packet-mark=HTTP_BIG parent=LEVEL_C_DWON priority=2 \
queue=default
add name=OTHER_U packet-mark=OTHER-up parent=LEVEL_C_UP priority=3 queue=\
default
add name=OTHER_D packet-mark=OTHER parent=LEVEL_C_DWON priority=3 queue=\
default


看網頁上部分有趣的設定,我修改後也添加上去
JQJQ wrote:
原來如此我以為,我玩...(恕刪)

可指導change TTL這個rule的內容嗎?

我wiki了存活時間(Time To Live) ,
請問您改變了TTL只是為了降低ROS系統資源損耗嗎?
ttl 能知道是哪套系統,免得駭客針對該系統缺失來攻擊,所以我才異動 ttl
對於性能,以前有測過,感覺不出來

ipv6 沒這玩兒,當初也有打算把 ipv6 給搞上,才發現沒有


qos 下載好像全部管理失效 這幾天得找找原因

初期早到原因了... IPV6 與 v4 ,剛好我測的網站擁有兩個ip,
v4 上弄半天不行,後來可以,回頭弄 v6 又掛...,2各 ip 互跑,
設對了又改為設錯了,就這樣反覆著

JQJQ wrote:
ttl 能知道是哪套系統,免得駭客針對該系統缺失來攻擊,所以我才異動 ttl
對於性能,以前有測過,感覺不出來...(恕刪)


J兄這裡指的不讓駭客知道是那套系統是指 routeros 本身? 還是在 firewall 後端的伺服器? 因為大大設定的 output chain, 所改變的是從 routeros 出去的封包, 但 TTL 會隨著所經過的 router or gateway 不斷的遞減, 那麼駭客取得這個值到底是不是真的有用處? 小弟猜想 hacker 會利用已知的系統漏洞來做偵測, 這樣或許還比較快知道 user 使用的系統到底為何,

如果 routeros 要去改變經由它的封包, 應該要處理的是 prerouting chain, 而並非 output chain.
FB: Pctine
gfx wrote:
test-ipv6.com怎麼測則都是0分(恕刪)


IPv6 都掛點,遇時、超時....






pctine wrote:
J兄這裡指的不讓駭客...(恕刪)


只是不給對方知道用哪套系統而已

ttl 可加也不加,禁ping、掃描、DoS攻擊....等都在防火牆內,
現在被攻擊的次數少很多,幾年前跑出一票阻擋 IP。


ipv6 Pre QoS 挺麻煩,上下傳 控管目前還沒搞定

JQJQ wrote:
ipv6 Pre QoS 挺麻煩,上下傳 控管目前還沒搞定 ...(恕刪)


這部份或許改用 service type 來定義會比較容易處理.
FB: Pctine
pctine wrote:
這部份或許改用 se...(恕刪)


的確

想抓精準點但... 東改西改,好好的一鍋就搞砸了,心急之下
又搞更大。東加西加原本可用也弄成無法使用,匯出來仔細檢查
才知道掛在哪裡。

現在回歸常規設定,一般設定方式。


ipv6 正常了


Routeros 6.13 出了
RouterOS v6.13 released

What's new in 6.13

*) console - comments are now accepted where new command can start, that is,
where '/' or ':' characters can be used to start new command, e.g.
/interface { # comment until the end of the line
print
}
*) backup - backups by default are encrypted now (with user password).
To use backup on older versions, you should disable encryption with dont-encrypt
flag when creating it;
*) files with '.sensitive.' in the filename require 'sensitive'
permission to manipulate;
*) lcd - reduce CPU usage when displaying static screens;
*) l2tp - fixed occasional server lockup;
*) pptp - fixed memory leak;
*) sstp - fixed crashes;

Simply click “Check for updates” in QuickSet, Webfig or Winbox packages menu. If you run v5 or older, download the newest NPK package from our webpage, upload to your router, and reboot: http://www.mikrotik.com/download

--
FB: Pctine
感謝各位大大的幫忙,防火牆終於正常了,addresslist不到一天就有7萬8千多個ip,

不知道會不會破10萬!!之前都搞錯了,難怪都沒擋半個ip.

再請教一個問題,一般只有上網的pc有這麼大量的ip攻擊是否不正常?
這樣有辦法請中華電信換組ip嗎?



RB750G參考以下網址設了firewall QOS 2項,HiNet.Dr.Speed測速60/15M CPU最高看到99%,用了快3年很滿意,幫老婆管套房將LB-2206換下以RB750G取代,已訂了一台RB450G自用,套用參數不用傷腦筋
http://klseet.com/index.php?option=com_content&view=article&id=43&Itemid=40

PS:
1.firewall內容是啥,不懂
2.Qos怎管的,不懂
3.只知道蠻好用的
  • 860
內文搜尋
X
評分
評分
複製連結
請輸入您要前往的頁數(1 ~ 860)
Mobile01提醒您
您目前瀏覽的是行動版網頁
是否切換到電腦版網頁呢?