DNS連線(使用過input和prerouting等)發現抓不到。
Mangle有標記和包流量顯示，但是Simple Queue就是反應沒流量。
試了試，流控上有反應也只是，上傳或下載單邊有反應。
不知道有大大能教在Simple Queue抓到DNS連線包正常方法嗎
kclonline wrote:chain的選擇決定您標記的位置.
最近嘗試設定Simple...(恕刪)
NAT進/出口(prerouting / postrouting),還是路由器進/出口 (input / output),
還是區網的方向(forward)
/ip firewall mangle
add action=mark-packet chain=postrouting protocol=udp dst-port=53 \
new-packet-mark=upload_dns out-interface=pppoe-out1 passthrough=no
add action=mark-packet chain=prerouting protocol=udp src-port=53 \
new-packet-mark=download_dns in-interface=pppoe-out1 passthrough=no
/queue tree
add max-limit=100k name=UploadDNS packet-mark=upload_dns \
parent=pppoe-out1 queue=default
add max-limit=300k name=DownloadDNS packet-mark=download_dns \
parent=ether2-master-local queue=default
elodie319 wrote:那您再匯入/ipv6 firewall raw add action=drop chain=output ,
/ipv6 firewall...(恕刪)
連Router向ISP提要求也封殺掉。
但...您幹嘛這麼刻意封殺？
您進system把Router的ipv6套件disable，重開機後Router變成沒ipv6的路由器不是省事的多!?
kclonline wrote:/ip firewall mangle
嗨G大，目前也還是...(恕刪)
add action=mark-packet chain=postrouting protocol=udp dst-port=53 \
new-packet-mark=dns out-interface=pppoe-out1 passthrough=no
/queue simple add target=pppoe-out1 max-limit=300k/100k name=DNS packet-mark=dns
注意QoS的對象是DNS-Server ,非是本地.
所以DNS-Server的download 等於本地的upload ;相對DNS-Server的upload 等於本地的download.
若您的QoS對象是8.8.8.8 (google dns)這樣明確的地址.
mark-packet不必做了,直接在queue simple的target設8.8.8.8/32就好
[admin@Router OS] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=forward action=jump jump-target=detect-ddos connection-state=new
1 chain=detect-ddos action=return
dst-limit=32,32,src-and-dst-addresses/10s
2 chain=detect-ddos action=return src-address=192.168.0.1
3 chain=detect-ddos action=add-dst-to-address-list address-list=ddosed
address-list-timeout=10m
4 chain=detect-ddos action=add-src-to-address-list address-list=ddoser
address-list-timeout=10m
5 chain=forward action=drop connection-state=new src-address-list=ddoser
dst-address-list=ddosed
內文搜尋
從 APP 打開
X