dophone wrote:好了,script設定每分鐘檢查一次即可.
*42a4好神奇喔...(恕刪)
記得test.noip.me 也要改
https://dl.dropboxusercontent.com/u/34743921/dophone.txt
請注意:
凡nat內 眾src-address要與address-list設定的ip相同才會跟著一起更新;
其它不同ip的src-address則不會有任何反應.
gfx wrote:
同#4357樓把firewall...(恕刪)
請教高手 gfx 代為看看了, 為何內網電腦會被 ROS firewall 列入 address list 擋掉了 (firewall filter #1 rule)?
有關 Port Knocking 參數我 xxxx 塗掉了.
BTW; 我依據 http://forum.mikrotik.com/viewtopic.php?t=60909 試將 firewall filter #1 rule connection-limit 改100)
=========================================================================
/ip firewall filter
add action=add-src-to-address-list address-list=Syn_Flooder \
address-list-timeout=30m chain=input comment=\
"Add Syn Flood IP to the list" connection-limit=30,32 protocol=tcp \
tcp-flags=syn
add action=drop chain=input comment="Drop to syn flood list" \
src-address-list=Syn_Flooder
add action=add-src-to-address-list address-list=Port_Scanner \
address-list-timeout=1w chain=input comment="Port Scanner Detect" \
protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="Drop port scanner list" \
src-address-list=Port_Scanner
add action=drop chain=forward comment="Block doubleclick.net" content=\
doubleclick.net disabled=yes port=80,443 protocol=tcp
add action=jump chain=input comment="Jump for icmp input flow" jump-target=\
ICMP protocol=icmp
add action=drop chain=input comment="Block all access to the winbox - except t\\
o support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE SUP\\
PORT ADDRESS LIST" disabled=yes dst-port=8291 protocol=tcp \
src-address-list=!support
add action=jump chain=forward comment="Jump for icmp forward flow" \
jump-target=ICMP protocol=icmp
add action=drop chain=forward comment="Drop to bogon list" dst-address-list=\
bogons
add action=add-src-to-address-list address-list=spammers \
address-list-timeout=3h chain=forward comment=\
"Add Spammers to the list for 3 hours" connection-limit=30,32 dst-port=\
25,587 limit=30/1m,0 protocol=tcp
add action=drop chain=forward comment="Avoid spammers action" dst-port=25,587 \
protocol=tcp src-address-list=spammers
add action=drop chain=input comment="drop login brute forcers 1" dst-port=\
21,22,23,8291 log=yes log-prefix="Block login forcers" protocol=tcp \
src-address-list=login_blacklist
add action=add-src-to-address-list address-list=login_blacklist \
address-list-timeout=1d chain=input comment="drop login brute forcers 2" \
connection-state=new dst-port=21,22,23,8291 log=yes log-prefix=\
"Force logging 6-Block" protocol=tcp src-address-list=login_stage5
add action=add-src-to-address-list address-list=login_stage5 \
address-list-timeout=1m chain=input comment="drop login brute forcers 3" \
connection-state=new dst-port=21,22,23,8291 log=yes log-prefix=\
"Force Logging 5" protocol=tcp src-address-list=login_stage4
add action=add-src-to-address-list address-list=login_stage4 \
address-list-timeout=5m chain=input comment="drop login brute forcers 4" \
connection-state=new dst-port=21,22,23,8291 log=yes log-prefix=\
"Force Loging 4" protocol=tcp src-address-list=login_stage3
add action=add-src-to-address-list address-list=login_stage3 \
address-list-timeout=1m chain=input comment="drop login brute forcers 5" \
connection-state=new dst-port=21,22,23,8291 log-prefix="Force Loging 3" \
protocol=tcp src-address-list=login_stage2
add action=add-src-to-address-list address-list=login_stage2 \
address-list-timeout=1m chain=input comment="drop login brute forcers 6" \
connection-state=new dst-port=21,22,23,8291 log-prefix="Force Loging 2" \
protocol=tcp src-address-list=login_stage1
add action=add-src-to-address-list address-list=login_stage1 \
address-list-timeout=1m chain=input comment="drop login brute forcers 7" \
connection-state=new dst-port=21,22,23,8291 log-prefix="Force Loging 1" \
protocol=tcp
add chain=input comment="allow pptp" dst-port=1723 protocol=tcp
add chain=input in-interface=ether1-gateway protocol=gre
add action=add-src-to-address-list address-list=knock1 address-list-timeout=\
15s chain=input comment="Port Knocking 1" dst-port=xxxx protocol=tcp
add action=add-src-to-address-list address-list=knock2 address-list-timeout=\
15s chain=input comment="Port Knocking 2" dst-port=xxxx protocol=tcp \
src-address-list=knock1
add action=add-src-to-address-list address-list=support address-list-timeout=\
1h chain=input comment="Port Knocking Sucess" dst-port=xxxx log=yes \
log-prefix="Port Knocking Sucess" protocol=tcp src-address-list=knock2
add chain=input comment="Accept DNS - UDP in Support List" port=53 protocol=\
udp src-address-list=support
add chain=input comment="Accept DNS - TCP in Support List" port=53 protocol=\
tcp src-address-list=support
add chain=input comment="Accept to established connections" connection-state=\
established
add chain=input comment="Accept to related connections" connection-state=\
related
add chain=input comment="Full access to SUPPORT address list" \
src-address-list=support
add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE THIS \\
RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
add chain=ICMP comment="Echo request - Avoiding Ping Flood" icmp-options=8:0 \
limit=1,5 protocol=icmp
add chain=ICMP comment="Echo reply" icmp-options=0:0 protocol=icmp
add chain=ICMP comment="Time Exceeded" icmp-options=11:0 protocol=icmp
add chain=ICMP comment="Destination unreachable" icmp-options=3:0-1 protocol=\
icmp
add chain=ICMP comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp
add action=jump chain=output comment="Jump for icmp output" jump-target=ICMP \
protocol=icmp
===================================================================
內文搜尋
從 APP 打開
X