不過，應該是跟ROUTEROS相關的，
所以讓小弟借個版面問問看了...
小弟的NB一般時是用有線連接，遠端桌面跟網路分享都正常，
但是一切到無線網路之後，則網路芳鄰無法使用，遠端桌面還沒試，
不管我怎麼重新設定資料匣分享，就是無法分享資料匣。
但是只要插回網路線，則網路分享就會正常，
是否routeros是哪裡需要再進一步設定嗎?
不然一樣的環境，只是有線跟無線的差別，有一點搞不太懂...
小弟有用高清播放盒測試，播放盒以無線連接區網，
只要NB是有線網路，則可以順利讀到NB中分享的影片檔案，
但是只要NB切到無線的，則一樣是無線的高清播放盒則無法連接到NB的分享檔案，
一直搞不懂為什麼...
/ip firewall filter
add chain=input comment="default configuration" connection-state=established disabled=yes
add chain=input comment="default configuration" connection-state=related disabled=yes
add chain=forward comment="default configuration" connection-state=related disabled=yes
add chain=forward comment="default configuration" connection-state=established disabled=yes
add action=drop chain=input comment="default configuration" connection-state=invalid
add action=drop chain=forward comment="default configuration" connection-state=invalid
add action=drop chain=forward comment=:CryptoWall log=yes src-address=46.172.83.0/24
add action=drop chain=forward comment=:CryptoWall dst-address=46.172.83.0/24 log=yes
add action=drop chain=input comment=":W\\B0\\CF\\ACq\\A5\\E1\\B1\\F3" in-interface=Hinet src-address-list=Ban_IP
add action=drop chain=input comment=":W\\B6\\C2\\A6W\\B3\\E6\\A5\\E1\\B1\\F3" in-interface=Hinet src-address-list=Block_in
add action=add-src-to-address-list address-list=Block_in address-list-timeout=3h chain=input comment=":W\\A8\\BE\\B6B\\B4\\DBIP" in-interface=Hinet log=yes src-address-list=\
Lan_ip
add action=drop chain=input comment=":W\\B8T\\A4\\EEICMP" protocol=icmp src-address=!192.168.11.0/24 src-address-list=!DNS-1
add action=drop chain=input comment=:DNS_Check_T in-interface=Hinet log=yes protocol=tcp src-address-list=DNS-1 src-port=!53
add action=drop chain=input comment=:DNS_Check_U in-interface=Hinet log=yes protocol=udp src-address-list=DNS-1 src-port=!53
add action=add-src-to-address-list address-list=Block_in address-list-timeout=1d chain=input comment="Anti-DoS Attack" connection-limit=10,32 in-interface=Hinet protocol=\
tcp
add action=add-src-to-address-list address-list=Block_in address-list-timeout=1d chain=input comment="Anti-DoS Attack" connection-limit=10,32 in-interface=Hinet log=yes \
protocol=udp src-address-list=!DNS-1
add action=add-src-to-address-list address-list=Block_in address-list-timeout=1w chain=input comment=:Wan_B_Port connection-state=new dst-port=\
21-23,80,1723,8080,8081,8291,8728,9121,9122 in-interface=Hinet protocol=tcp src-address-list=!Lan_ip
add action=add-src-to-address-list address-list=Block_in address-list-timeout=1w chain=input comment=:Wan_B_Port connection-state=new dst-port=\
21-23,80,1723,8080,8081,8291,8728,9121,9122 in-interface=Hinet protocol=udp src-address-list=!Lan_ip
add action=drop chain=input comment=:Wan_D_Port connection-state=new dst-port=53,67,68,135-139,443,445,17500 in-interface=Hinet protocol=tcp src-address-list=!DNS-1
add action=drop chain=input comment=:Wan_D_Port connection-state=new dst-port=53,67,68,135-139,443,445,17500 in-interface=Hinet protocol=udp src-address-list=!DNS-1
add action=drop chain=output comment=":\\B8T\\A4\\EELan\\A6@\\A8\\C9\\A5~\\B6\\C7" dst-port=135-139,445 out-interface=Hinet protocol=udp
add action=drop chain=output comment=":\\B8T\\A4\\EEROS\\BCs\\BC\\BD" dst-port=5678,17500 out-interface=Hinet protocol=udp
add action=drop chain=input comment=":W\\A5\\E1\\B1\\F3\\A6h\\BC\\BD\\AA\\BA\\AB\\CA\\A5]" src-address-type=!unicast
add action=drop chain=input comment=":\\A4\\A3\\A4\\B9\\B3\\\\\\A6h\\BC\\BD" protocol=igmp
add action=drop chain=output comment=":DNS\\C2\\EA\\A9w" dst-address-list=!DNS-1 dst-port=53 log=yes protocol=udp src-address-list=Lan_ip
add action=drop chain=input comment=": NTP \\A8\\BE\\BFm" dst-port=123 protocol=udp src-port=!123
add action=drop chain=input comment=" Fake-DHCP" src-address=!192.168.11.0/24 src-address-list=BadDHCP
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=Block_in address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=Block_in address-list-timeout=3d chain=input comment=":\\A8\\BE\\B2q\\B1K\\BDX" connection-state=new dst-port=21,22,23,8291 \
protocol=tcp src-address-list=login_stage3
add action=add-src-to-address-list address-list=login_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp \
src-address-list=login_stage2
add action=add-src-to-address-list address-list=login_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp \
src-address-list=login_stage1
add action=add-src-to-address-list address-list=login_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=21,22,23,8291 protocol=tcp
add action=drop chain=input src-address-list=UDPDDOS
add action=drop chain=forward comment=":\\B8T\\A4\\EE\\A4\\BA\\B3\\A1\\AA\\DA\\BEF" dst-address=192.168.11.0/24 dst-port=135,137,139,445 protocol=tcp
add action=drop chain=forward comment=":\\B8T\\A4\\EE\\A4\\BA\\B3\\A1\\AA\\DA\\BEF" dst-address=192.168.11.0/24 dst-port=135,137,139,445 protocol=udp
:Service Port 全關的
:Ban_ip : 150.70.172.0/24 150.70.173.0/24 150.70.188.0/24
:DNS-1 : 8.8.4.4 8.8.8.8 168.95.1.1 168.95.192.1
:LAN_ip : 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
:內網IP 192.168.11.0/24 (ROS:192.168.11.1)
:NAT 主要是開放 20908 (TCP/UDP) 給內網的 192.168.11.3的Server
問題點:
主要不懂的地方是 Forward 與 input , 由於內網主要使用 NAT 功能.
那外網應該無法直接穿過路由器直接進入內網才對 , 那是不是NAT沒設定轉發的都會被路由器當作廢棄封包處理呢?
所以是不是 NAT 沒設定轉發的規則都可以使用input來進行阻擋呢?
:主要需求只有 20908 端口需要開放給其他人進入 , 而其餘非內網發起的連線都給予阻擋.
最後再請教個關於ARP的問題: 內網電腦安裝的防火牆是COMODO , 不知道為什麼有時候會出現這兩種狀況
1.由ROS發起的ARP攻擊 被COMODO攔截 後果:大概電腦網路有1分鐘會沒反應的狀況.
2.由網際網路IP 端口0 直接發送到內網IP 端口 0 這類的怪記錄..
其中第二種比較令人在意 , 因為是直接穿入內網 才會覺得奇怪
還請各位解惑 , 謝謝!
ba2001 wrote:能順利進入路徑B只有兩種情況:
我的理解是這樣:
正常來說來至WAN的連線 應該無法直接進入路徑B才對吧?
除非是 由路徑B內的電腦主動邀請進來; 為了應對這種情況 就必須使用 forward 來處理邀請進來的連線
是這樣嘛?
1.電腦對網路Server發出要求(從路徑B出去),Server回應後依著原路徑回覆電腦.
2.在Nat設portforward ,這樣封包就會直接往路徑B去.
所以您的說法是正確的,若非在這兩個條件內嘗試從wan進入的封包只會往路徑A送.
那假射 路徑B我只想開放 20000這端口進來 那是不是規則設定 forward , 只要DST端口不等於20000這端口都給予攔截就行了?
接上面:
若您有在NAT設portforward ,將封包送往192.168.88.10
因為這封包是往路徑B送,所以要封鎖dst-port:2000 ,您在filter對dst-port:2000做動作時chain就得用forward;
若您未將dst-port:2000透過portforward轉到其它電腦,那dst-port:2000就會依預設只送到路由器(路徑A)
因為是路由器(路徑A) ,所以在filter對dst-port:2000做封鎖時,chain就得用input.
內文搜尋
從 APP 打開
X