id.3則是無條件封鎖....
我的建議是:舊設定選擇捨棄不用，換小弟準備的firewall filter試試.
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
首先在/ip firewall address-list建立All-Lan清單:
建立DNS-Server清單:
然後將下面code一次複製全部,然後一口氣全部貼到命令欄進行匯入.
/ip firewall filter
add action=drop chain=forward comment="\\B8T\\A5\\CEPort" dst-port=22,23 \
protocol=tcp src-address-list=!All-Lan
add chain=input comment="\\A4\\B9\\B3\\\\\\B0\\CF\\BA\\F4\\B8\\CB\\B8m" src-address=1.1.1.1
add chain=input src-address-list=All-Lan
add action=drop chain=input comment="DoS\\A9\\DA\\B5\\B4\\AAA\\B0\\C8\\A7\\F0\\C0\\BB" \
connection-limit=10,32 protocol=tcp src-port=!80
add action=drop chain=input comment="\\A8\\BE\\A4\\EE\\B3Q\\B1\\BD\\BA\\CB Port" protocol=tcp \
src-address-list="port scanners"
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" address-list-timeout=2w \
chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add chain=input comment="\\A4\\B9\\B3\\\\VPN" dst-port=1723 protocol=tcp
add chain=input protocol=gre
add chain=input dst-port=1194 protocol=tcp
add chain=input dst-port=443 protocol=tcp
add chain=input dst-port=1701,500,4500 protocol=udp
add chain=input protocol=ipencap
add chain=input protocol=ipsec-esp
add chain=input protocol=tcp src-port=1723
add chain=input protocol=tcp src-port=1194
add action=add-dst-to-address-list address-list=a.test address-list-timeout=1s chain=output \
comment="\\A4\\B9\\B3\\\\ICMP\\A6^\\C0\\B3" dst-address-list=!All-Lan protocol=icmp
add chain=input protocol=icmp src-address-list=a.test
add chain=input comment="\\A4\\B9\\B3\\\\DNS" src-address-list=DNS-Server
add chain=input comment="\\A4\\B9\\B3\\\\ROS-Cloud\\A6\\F8\\AAA\\BE\\B9" src-address=81.198.87.240
add chain=input comment="\\A4\\B9\\B3\\\\Winbox\\B3s\\BDu" dst-port=8291,8728 protocol=tcp
add chain=input comment="\\A4\\B9\\B3\\\\\\B6l\\A5\\F3\\A6\\F8\\AAA\\BE\\B9" protocol=tcp src-port=25,587
add chain=input comment="\\A4\\B9\\B3\\\\WWW\\A6\\F8\\AAA\\BE\\B9" protocol=tcp src-port=80,443
add chain=input comment="\\A4\\B9\\B3\\\\\\AE\\C9\\B6\\A1\\A6\\F8\\AAA\\BE\\B9" dst-port=123 \
protocol=udp src-port=123
add action=drop chain=input comment="\\A5\\E1\\B1\\F3\\A5\\BC\\A9w\\B8q\\AA\\BA\\AB\\CA\\A5]"
匯入後即下:
web-proxy / pptp /l2tp-ipsec的地方不動,
其它vpn您可能使用的port不同,依個人情形做修改即可.
