ROS防火墙策略与网页断流解决等系列方法

风一样的男孩

1. 本脚本为网吧通用防火墙，导入命令：im *.RSC
2.    请复制以下代码，保存为*.rsc
4. ------------------------------------------------------------------------------------------------------------------
5. / ip firewall connection tracking
6. set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=30s \
7.     tcp-established-timeout=5d tcp-fin-wait-timeout=2m \
8.     tcp-close-wait-timeout=1m tcp-last-ack-timeout=30s \
9.     tcp-time-wait-timeout=2m tcp-close-timeout=10s udp-timeout=30s \
10.     udp-stream-timeout=3m icmp-timeout=30s generic-timeout=10m
11. / ip firewall filter
12. add chain=input connection-state=invalid action=drop comment="drop invalid \
13.     packets" disabled=no
14. add chain=input connection-state=related action=accept comment="accept related \
15.     packets" disabled=no
16. add chain=input connection-state=established action=accept comment="accept \
17.     established packets" disabled=no
18. add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and \
19.     drop port scan connections" disabled=no
20. add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
21.     action=tarpit comment="suppress DoS attack" disabled=no
22. add chain=input protocol=tcp connection-limit=10,32 \
23.     action=add-src-to-address-list address-list=black_list \
24.     address-list-timeout=1d comment="detect DoS attack" disabled=no
25. add chain=input dst-address-type=!local action=drop comment="drop all that is \
26.     not to local" disabled=no
27. add chain=input src-address-type=!unicast action=drop comment="drom all that \
28.     is not from unicast" disabled=no
29. add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to \
30.     chain ICMP" disabled=no
31. add chain=input action=jump jump-target=services comment="jump to chain \
32.     services" disabled=no
33. add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS \
34.     request" disabled=no
35. add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS \
36.     request" disabled=no
37. add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept \
38.     comment="accept localhost" disabled=no
39. add chain=services protocol=tcp dst-port=20-21 action=accept comment="allow \
40.     ftp" disabled=no
41. add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, \
42.     ssh" disabled=no
43. add chain=services protocol=tcp dst-port=23 action=accept comment="allow \
44.     telnet" disabled=no
45. add chain=services protocol=tcp dst-port=80 action=accept comment="allow http, \
46.     webbox" disabled=no
47. add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow \
48.     winbox" disabled=no
49. add chain=services protocol=udp dst-port=20561 action=accept comment="allow \
50.     MACwinbox " disabled=no
51. add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth \
52.     server" disabled=no
53. add chain=services protocol=udp dst-port=5678 action=accept comment=" MT \
54.     Discovery Protocol" disabled=no
55. add chain=services protocol=udp dst-port=1701 action=accept comment="allow \
56.     L2TP" disabled=no
57. add chain=services protocol=tcp dst-port=1723 action=accept comment="allow \
58.     PPTP" disabled=no
59. add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" \
60.     disabled=no
61. add chain=services protocol=ipencap action=accept comment="allow IPIP" \
62.     disabled=no
63. add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" \
64.     disabled=no
65. add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" \
66.     disabled=no
67. add chain=services protocol=udp dst-port=67-68 action=accept comment="allow \
68.     DHCP" disabled=no
69. add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web \
70.     Proxy" disabled=no
71. add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" \
72.     disabled=no
73. add chain=services protocol=tcp dst-port=161 action=accept comment="allow \
74.     SNMP" disabled=no
75. add chain=services protocol=tcp dst-port=443 action=accept comment="allow \
76.     https for Hotspot" disabled=no
77. add chain=services protocol=tcp dst-port=1080 action=accept comment="allow \
78.     Socks for Hotspot" disabled=no
79. add chain=services protocol=udp dst-port=500 action=accept comment="allow \
80.     IPSec connections" disabled=no
81. add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" \
82.     disabled=no
83. add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" \
84.     disabled=no
85. add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" \
86.     disabled=no
87. add chain=services protocol=udp dst-port=520-521 action=accept comment="allow \
88.     RIP" disabled=no
89. add chain=services protocol=ospf action=accept comment="allow OSPF" \
90.     disabled=no
91. add chain=services protocol=udp dst-port=5000-5100 action=accept \
92.     comment="allow BGP" disabled=no
93. add chain=services protocol=tcp dst-port=1720 action=accept comment="allow \
94.     Telephony" disabled=no
95. add chain=services protocol=udp dst-port=1719 action=accept comment="allow \
96.     Telephony" disabled=no
97. add chain=forward connection-state=invalid action=drop comment="drop invalid \
98.     packets" disabled=no
99. add chain=forward connection-state=related action=accept comment="accept \
100.     related packets" disabled=no
101. add chain=forward connection-state=established action=accept comment="accept \
102.     established packets" disabled=no
103. add chain=forward src-address-type=!unicast action=drop comment="drop all that \
104.     is not from unicast" disabled=no
105. add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to \
106.     chain ICMP" disabled=no
107. add chain=forward action=jump jump-target=virus comment="jump to virus chain" \
108.     disabled=no
109. add chain=forward action=accept comment="Accept everything else" disabled=no
110. add chain=output protocol=tcp dst-port=53 action=accept comment="allow DNS \
111.     request" disabled=no
112. add chain=output protocol=udp dst-port=53 action=accept comment="Allow DNS \
113.     request" disabled=no
114. add chain=output connection-state=invalid action=drop comment="drop invalid \
115.     packets" disabled=no
116. add chain=output connection-state=related action=accept comment="accept \
117.     related packets" disabled=no
118. add chain=output connection-state=established action=accept comment="accept \
119.     established packets" disabled=no
120. add chain=output protocol=icmp  action=accept comment="" disabled=no
121. add chain=output action=drop comment="Drop all connections from this router" \
122.     disabled=no
123. add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop \
124.     Blaster Worm" disabled=no
125. add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop \
126.     Messenger Worm" disabled=no
127. add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster \
128.     Worm" disabled=no
129. add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster \
130.     Worm" disabled=no
131. add chain=virus protocol=tcp dst-port=593 action=drop comment="________" \
132.     disabled=no
133. add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \
134.     disabled=no
135. add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \
136.     disabled=no
137. add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \
138.     disabled=no
139. add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \
140.     disabled=no
141. add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \
142.     disabled=no
143. add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \
144.     disabled=no
145. add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
146.     disabled=no
147. add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" \
148.     disabled=no
149. add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \
150.     disabled=no
151. add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \
152.     disabled=no
153. add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \
154.     disabled=no
155. add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \
156.     disabled=no
157. add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop \
158.     Beagle.C-K" disabled=no
159. add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop \
160.     MyDoom" disabled=no
161. add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \
162.     OptixPro" disabled=no
163. add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" \
164.     disabled=no
165. add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" \
166.     disabled=no
167. add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \
168.     disabled=no
169. add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \
170.     disabled=no
171. add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop \
172.     Dabber.A-B" disabled=no
173. add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop \
174.     Dumaru.Y" disabled=no
175. add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop \
176.     MyDoom.B" disabled=no
177. add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \
178.     disabled=no
179. add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \
180.     disabled=no
181. add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop \
182.     SubSeven" disabled=no
183. add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \
184.     Gaobot" disabled=no
185.   
187. ------------------------------------------------------------------------------------------------------------------
192. 2.禁止外网ping路由
194. / ip firewall filter add chain=input src-address=!192.168.0.0/24 protocol=icmp action=drop comment="No wan Ping"
197. 3.防止灰鸽子木马
199. / ip firewall filter
200. add chain=forward protocol=tcp dst-port=1999 action=drop comment="Backdoor.GrayBird.ad"
201. add chain=forward dst-address=80.190.240.125 action=drop
202. add chain=forward dst-address=203.209.245.168 action=drop
203. add chain=forward dst-address=210.192.122.106 action=drop
204. add chain=forward dst-address=218.30.88.43 action=drop
205. add chain=forward dst-address=219.238.233.110 action=drop
206. add chain=forward dst-address=222.186.8.88 action=drop
207. add chain=forward dst-address=124.42.125.37 action=drop
208. add chain=forward dst-address=210.192.122.107 action=drop
209. add chain=forward dst-address=61.147.118.198 action=drop
210. add chain=forward dst-address=219.238.233.11 action=drop
213. 4.禁止P2P电驴下载
215. / ip firewall filter
216. add chain=forward protocol=tcp dst-port=4661-4662 action=drop comment="No Emule"
217. add chain=forward protocol=tcp dst-port=4242 action=drop
218. add chain=forward dst-address=62.241.53.15 action=drop
220. 5.禁止比特精灵下载（BitSpirit）
222. / ip firewall filter
223. add chain=forward protocol=tcp dst-port=16881 action=drop comment="No BitSpirit"
225. 6.禁止PPLIVE网络电视
227. / ip firewall filter
228. add chain=forward protocol=tcp dst-port=8008 action=drop comment="No PPlive TV"
229. add chain=forward protocol=udp dst-port=4004 action=drop
230. add chain=forward dst-address=218.108.237.11 action=drop
232. 7.禁止vagaa(哇嘎)
234. / ip firewall filter
235. add chain=forward content=www.vagaa.com action=reject comment="No VaGaa"
236. add chain=forward content=vagaa.com action=reject
237. add chain=forward protocol=tcp dst-port=40750 action=drop
238. add chain=forward protocol=udp dst-port=40750 action=drop
239. add chain=forward protocol=tcp dst-port=2004 action=drop
240. add chain=forward protocol=udp dst-port=2004 action=drop
241. add chain=forward protocol=tcp dst-port=2005 action=drop
242. add chain=forward protocol=udp dst-port=2005 action=drop
243. add chain=forward protocol=tcp dst-port=16521 action=drop
244. add chain=forward protocol=udp dst-port=16521 action=drop
246. 8.解决网页断流现象
247. 网页断流，就是说内网TCP传输具有时效性，不能保存过久，包一多路由就负担了，太短就是变连接不上了。游戏的TCP包就不存在这样的问题，因为游戏包小，时时通信，即使被刷新失效，马上也会有的。
248. 网页就不一样的了，有时候发现网页打不开，其它都正常这个就叫网页断流
249. 网页断流几个关系的问题：
250. 8.1.tracking问题  
251. 使用本站提供的，保证无问题，一个SYN推荐大家调高一点点为好
252. / ip firewall connection tracking
253. set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=30s \
254.     tcp-established-timeout=5d tcp-fin-wait-timeout=2m \
255.     tcp-close-wait-timeout=1m tcp-last-ack-timeout=30s \
256.     tcp-time-wait-timeout=2m tcp-close-timeout=10s udp-timeout=30s \
257.     udp-stream-timeout=3m icmp-timeout=30s generic-timeout=10m

复制代码

ip firewall connection tracking 的图
  

8.2.防火墙问题 防火墙把TCP3129-3198给禁用了 删除31XX一系列规则

8.3.Queue Tree 限制线程问题
这里说明下，我们只限制速度，不限制线程数为好

yjihje008

haohao

xq452168045

看晕了

gggydje1

哈哈   看不懂要     [s:23]  [s:23]