coolcliff01 wrote:
請教一下各位，在下已.
那麼它 proxy 設定能否僅僅單純將流量導向比方 「proxy.hinet.net」或是內網架設的其他代理伺服器呢？這樣應該不會佔用太多 CPU？
..(恕刪)
參考這個:
http://forum.mikrotik.com/viewtopic.php?f=2&t=21407
*) pptp - fixed problem where tunnel stopped transmitting packets under heavy load;
*) web proxy - caching in RAM for boards with 32MB or less RAM will not cache any content;
*) leds - removed 'led' command and added support for 'on', 'off' types under 'system leds';
*) files - allow to move files between different disks in winbox;
*) dhcpv4 server - fix adding address lists from radius;
*) dhcpv4 server - make radius classless static route tag as dhcp vendor specific;
*) smb - fixed HDD used/free space reporting
*) made powerpc metarouters work again (were broken in v6.22);
*) disks - fixed fat32 formatting where some bogus files with strange names were created
(to delete existing files reformatting is needed);
*) disks - fixed problem where some of USB disks were not recognized;
*) fetch - allow checking certificate trust without crl checking;
*) userman - fix more web session problems when user uses
customer and administrator interfaces at the same time;
*) snmp - fix external storage info reporting;
*) snmp - fix bulk walk problem introduced in v6.20;
*) fix tunnels - keep keepalive disabled for existing tunnels when upgrading;
*) fix tunnels - mtu for eoip tunnels was not allowed
to be set less than 1280 since 6.20;
*) using routing-marks could lead to tunnel loop detection to turn off tunnels;
Hsinchu@Taiwan wrote:
Google: DNS的遞迴查詢攻擊與防護
長知識了，原來是有名的「DNS放大攻擊」......
再補充一個他人筆記
https://docs.google.com/document/d/1vACK8AihEUOnJ_wGSVHq0saFrIksJyfzjC9FQhLD86Y/edit
/ip firewall filter
add action=drop chain=input protocol=udp dst-port=53 in-interface=pppoe-out1 comment="Blocking DNS requests"
add action=drop chain=input protocol=tcp dst-port=53 in-interface=pppoe-out1 comment="Blocking DNS requests"
add action=drop chain=forward protocol=udp dst-port=53 out-interface=!pppoe-out1 comment="Blocking DNS requests"
add action=drop chain=forward protocol=tcp dst-port=53 out-interface=!pppoe-out1 comment="Blocking DNS requests"
/ip firewall nat
add action=redirect chain=dstnat protocol=udp dst-port=53 in-interface=!pppoe-out1 comment="Blocking DNS requests"
add action=redirect chain=dstnat protocol=tcp dst-port=53 in-interface=!pppoe-out1 comment="Blocking DNS requests"
PS. WAN Port interface 請修改成你的設定名稱。
(但明天又要換串接的網路線了 都跑不到1G)
這樣的話有點想試試看
因為ROS本身也具備IGMP Proxy的功能 且據Edkang大的說法 中華MOD是支援IGMP Proxy的
因此想試試看使用ROS來實作這一塊試試 但目前碰到兩個預想的問題
1. Youtube上有外國人分享怎麼設定ROS的IGMP Proxy 但他的設定方式似乎不適用MOD
不知道是我防火牆沒有開到還是如何 怎設就是沒有trigger到
讓我懷疑MOD是否也要跟著設定Udpxy 但我也不知道MOD用的UDP Port是哪些
2. ROS雖然支援IGMP Proxy 但似乎沒支援IGMP Snooping
不知道如果單純設好IGMP Proxy且可以使用後 是否也會產生廣播風暴
不知道有沒有人對這方面有了解
內文搜尋
從 APP 打開
X