ros 防火墙（ROS防火墙）.docVIP

ros 防火墙（ROS防火墙） # about setting up an TCP connection, mainly to reduce the survival time of connection /ip firewall connection tracking Set, enabled=yes, tcp-syn-sent-timeout=1m, tcp-syn-received-timeout=1m \ Tcp-established-timeout=1d tcp-fin-wait-timeout=10s \ Tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \ Tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \ Udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m # delete the existing firewall (if any) : foreach, I, in=[/ip, firewall, filter, find], do=[/ip, firewall,, filter, disable, $i] : foreach, I, in, [/ip, firewall, filter, find], do, [/ip,, firewall, filter, remove, $i] # in a short period of time from the same address by changing the port to send a large number of packets, as port scan # within a short period of time and the establishment of a large number of TCP connections (more than 10), as DDoS denial of service attacks into the blacklist a day! The establishment of # blacklist only three concurrent connections # network packet forwarding # disable the host from the network Ping routing, is turned off by default According to the # routing host, input /ip firewall filter Add, chain=input, connection-state=established, action=accept, comment=, accept, established, connection, packets, disabled=no Add, chain=input, connection-state=related, action=accept, comment=, accept, related, connection, packets, disabled=no Add, chain=input, connection-state=invalid, action=drop, comment=, drop, invalid, packets, disabled=no Add, chain=input, protocol=tcp, psd=21,3s, 3,1, action=drop, comment=, detect, and, drop, port, scan, connections, disabled=no Add, chain=input, protocol=tcp, connection-limit=3,32, src-address-list=black_list, action=tarpit, comment=, suppress, DoS, attack, disabled=no Add, chain=input, protocol=tcp, connection-limit=10,32, action=add-src-to-address-list, address-list=black_list, address-list-timeout=1d, comment=, detect, DoS, attack, disabled=no Add, chain=input, dst-a