ros 防火墙.docVIP

ros 防火墙 　　#关于ＴＣＰ连接的一些设置，主要是减少连接的存活时间 　　/ip firewall connection tracking 　　set enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m \ 　　tcp-established-timeout=1d tcp-fin-wait-timeout=10s \ 　　tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \ 　　tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \ 　　udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m 　　#删除已有的防火墙(如果有的话) 　　:foreach i in=[/ip firewall filter find] do=[/ip firewall filter disable $i] 　　:foreach i in [/ip firewall filter find] do [/ip firewall filter remove $i] 　　#在短时间内从同一地址用不断变化的端口向本机发送大量数据包，视为端口扫描 　　#短时间内同时建立大量TCP连接(超过10) ,视为 DDoS 拒绝服务攻击, 进黑名单一天! 　　#黑名单上的只能建立三个并发连接 　　#内网的数据包不转发 　　#禁止从外网ping路由主机，默认关闭 　　#针对路由主机的，input 　　/ip firewall filter 　　add chain=input connection-state=established action=accept comment=accept established connection packets disabled=no 　　add chain=input connection-state=related action=accept comment=accept related connection packets disabled=no 　　add chain=input connection-state=invalid action=drop comment=drop invalid packets disabled=no 　　add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment=detect and drop port scan connections disabled=no 　　add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit comment=suppress DoS attack disabled=no 　　add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list address-list-timeout=1d comment=detect DoS attack disabled=no 　　add chain=input dst-address-type=!local action=drop comment=drop all that is not to local disabled=no 　　add chain=input src-address-type=!unicast action=drop comment=drop all that is not from unicast disabled=no 　　add chain=input protocol=icmp action=jump jump-target=ICMP comment=jump to chain ICMP disabled=no 　　add chain=input action=jump jump-target=services comment=jump to chain services disabled=no 　　add chain=input action=jump jump-target=virus comment=jump to chain virus disabled=no 　　add chain