ros 防火墙规则（国外英文资料）.doc

ros 防火墙规则 The Routeros firewall is very flexible. The Routeros firewall is a packet filter firewall. You can define a set of rules that filter out packets sent to Routeros, from Routeros, and from routeros. In the Routeros firewall, you define three firewall (filter) chains (input, forward, output), and you can define your own rules in the three chains. Input means to send the data to Routeros itself (that is, the destination IP is an IP address in the Routeros interface); Output means the data sent from Routeros (that is, the packet source IP is an IP address in the Routeros interface); Forward means forwarding via Routeros (for example, your internal computer accesses an external network, and data needs to be forwarded through your Routeros). Prohibit Ping Routeros, we generally need to add rules in the input chain, because the packet is issued to Routeros, the packages target IP is a Routeros interface, IP address. (of course, if you just need to set up a rule to filter out ICMP information can be Ping up, when you Ping packets arrive at routeos, routeos can receive the data packets and respond, when Routeros responded to your package to send out checks output rules and filter out the response to your package in output). Each rule in each chain has the target IP, the source IP, the in interface, and its very flexible to build the rules. For example, ROS prohibits PING, prohibits external network Ping, you Routeros, you only need to choose your external network interface in in interface. Disable internal Ping, you can choose to connect to your internal network interface. If all Ping is banned, then the interface selects all. Of course, the Ping protocol is prohibited, ICMP, action, drop or reject are selected. The other is to pay attention to the ICMP Protocol and it is referred to as Ping, but Ping is a use of ICMP Protocol in our Ping (out types of packets sent the ICMP Protocol for the 8 code 0, written in Routeros for icmp-options=8:0; and we respond to Ping I