Wed May 02, 2012 3:41 pm
I'm sorry, that fighting in front too long but I wanted to ask whether it is ok to firewall settings?
/ip firewall filter
add action=drop chain=input disabled=no protocol=icmp
add action=drop chain=input comment="ssh layer7protocol block " disabled=no \
in-interface=ether1 layer7-protocol=ssh
add action=drop chain=input comment="telnet block port" disabled=no \
in-interface=ether1 layer7-protocol=telnet
add action=drop chain=input comment="drop invalid packets" connection-state=\
invalid disabled=no
add action=jump chain=forward comment="SYN Flood protect" connection-state=\
new disabled=no jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=accept chain=SYN-Protect connection-state=new disabled=no limit=\
400,5 protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new disabled=no protocol=\
tcp tcp-flags=syn
add action=drop chain=input comment="detect and drop port scan connections" \
disabled=no protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="dropping port scanners" disabled=no \
src-address-list="port scanners"
add action=add-src-to-address-list address-list=black_list \
address-list-timeout=1d chain=input comment="detect DoS attack" \
connection-limit=10,32 disabled=no protocol=tcp
add action=tarpit chain=input comment="suppress DoS attack" connection-limit=\
3,32 disabled=no protocol=tcp src-address-list=black_list
add action=drop chain=forward comment="P2P kinni" disabled=no p2p=all-p2p
add action=passthrough chain=unused-hs-chain comment=\
"place hotspot rules here" disabled=yes
add action=drop chain=forward comment="netbios layer7protocol" disabled=no \
layer7-protocol=netbios
add action=drop chain=forward comment="msn file transfer L7P" disabled=no \
layer7-protocol=msn-filetransfer
add action=drop chain=forward comment="messenger for Layer 7 P" disabled=yes \
layer7-protocol=msnmessenger
add action=accept chain=forward comment=sip disabled=yes dst-address-list=sip \
src-address-list=sip
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="SYN/FIN scan" disabled=no \
protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="SYN/RST scan" disabled=no \
protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" disabled=\
no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="ALL/ALL scan" disabled=no \
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="NMAP NULL scan" disabled=no \
protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="Port scanners to list " \
disabled=no protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="Port scanners to list " \
disabled=no protocol=tcp psd=21,3s,3,1
add action=drop chain=forward comment=trackers_drop content=tracker disabled=\
yes src-address=0.0.0.0/0
add action=jump chain=forward comment="jump to virus chain " disabled=no \
jump-target=virus
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
135-139 protocol=tcp
add action=drop chain=virus comment="Drop Messenger Worm" disabled=no \
dst-port=135-139 protocol=udp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
445 protocol=tcp
add action=drop chain=virus comment="Drop Blaster Worm" disabled=no dst-port=\
445 protocol=udp
add action=drop chain=virus comment=________ disabled=no dst-port=593 \
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1024-1030 \
protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=1080 \
protocol=tcp
add action=drop chain=virus comment=________ disabled=no dst-port=1214 \
protocol=tcp
add action=drop chain=virus comment="ndm requester" disabled=no dst-port=1363 \
protocol=tcp
add action=drop chain=virus comment="ndm server" disabled=no dst-port=1364 \
protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434 \
protocol=tcp
add action=drop chain=virus comment="screen cast" disabled=no dst-port=1368 \
protocol=tcp
add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373 \
protocol=tcp
add action=drop chain=virus comment="Drop Backdoor OptixPro" disabled=no \
dst-port=3410 protocol=tcp
add action=drop chain=virus comment="Drop Beagle.C-K" disabled=no dst-port=\
2745 protocol=tcp
add action=drop chain=virus comment="Drop PhatBot, Agobot, Gaobot" disabled=\
no dst-port=65506 protocol=tcp
add action=drop chain=virus comment=cichlid disabled=no dst-port=1377 \
protocol=tcp
add action=drop chain=virus comment="Bagle Virus" disabled=no dst-port=2745 \
protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=2283 \
protocol=tcp
add action=drop chain=virus comment="Drop Beagle" disabled=no dst-port=2535 \
protocol=tcp
add action=drop chain=virus comment="Drop MyDoom" disabled=no dst-port=\
3127-3128 protocol=tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\
tcp
add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=\
udp
add action=drop chain=virus comment="Drop Sasser" disabled=no dst-port=5554 \
protocol=tcp
add action=drop chain=virus comment="Drop Beagle.B" disabled=no dst-port=8866 \
protocol=tcp
add action=drop chain=virus comment="Drop Dabber.A-B" disabled=no dst-port=\
9898 protocol=tcp
add action=drop chain=virus comment="Drop Dumaru.Y" disabled=no dst-port=\
10000 protocol=tcp
add action=drop chain=virus comment="Drop MyDoom.B" disabled=no dst-port=\
10080 protocol=tcp
add action=drop chain=virus comment="Drop NetBus" disabled=no dst-port=12345 \
protocol=tcp
add action=drop chain=virus comment="Drop Kuang2" disabled=no dst-port=17300 \
protocol=tcp
add action=drop chain=virus comment="Drop SubSeven" disabled=no dst-port=\
27374 protocol=tcp
add action=drop chain=virus comment=Gen.Variant.Barys.135 disabled=no \
dst-port=3389 protocol=tcp
add action=accept chain=forward comment="Allow SMTP" disabled=yes dst-port=25 \
protocol=tcp
add action=accept chain=forward comment="Allow HTTP" disabled=yes dst-port=80 \
protocol=tcp
add action=accept chain=input comment="Allow Broadcast Traffic" disabled=no \
dst-address-type=broadcast
add action=accept chain=input comment="accept established connection packets" \
connection-state=established disabled=no
add action=accept chain=input comment=\
"Allow access to router from known network" disabled=no
add action=accept chain=input comment="accept related connection packets" \
connection-state=related disabled=no
add action=accept chain=forward comment=\
"accept established connection packets" connection-state=established \
disabled=no
add action=drop chain=forward comment="drop invalid packets" \
connection-state=invalid disabled=no
add action=accept chain=forward comment="accept related connection packets" \
connection-state=related disabled=no
add action=accept chain=forward comment="seest v2lja lubatud" disabled=no \
dst-address=0.0.0.0/0 src-address-list=safe
add action=jump chain=forward comment=\
"icmp lubatud, kuid nii et floodi poleks" disabled=no jump-target=ICMP \
protocol=icmp
add action=accept chain=ICMP comment="0:0 and limit for 5pac/s" disabled=no \
icmp-options=0:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:3 and limit for 5pac/s" disabled=no \
icmp-options=3:3 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:4 and limit for 5pac/s" disabled=no \
icmp-options=3:4 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="8:0 and limit for 5pac/s" disabled=no \
icmp-options=8:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="11:0 and limit for 5pac/s" disabled=no \
icmp-options=11:0-255 limit=5,5 protocol=icmp
add action=drop chain=forward connection-state=invalid disabled=no \
dst-address-list=!safe src-address-list=!safe
add action=drop chain=ICMP comment="Drop everything else" disabled=no \
protocol=icmp
add action=accept chain=services comment="accept localhost" disabled=no \
dst-address=127.0.0.1 src-address-list=127.0.0.1
add action=accept chain=services comment="allow MACwinbox " disabled=no \
dst-port=20561 protocol=udp
add action=accept chain=services disabled=yes dst-port=22 protocol=tcp
add action=accept chain=services comment="Bandwidth server" disabled=yes \
dst-port=2000 protocol=tcp
add action=accept chain=services comment="MT Winbox" disabled=no dst-port=\
8291 protocol=tcp
add action=accept chain=services comment=" MT Discovery Protocol" disabled=\
yes dst-port=5678 protocol=udp
add action=accept chain=services comment="allow SNMP" disabled=yes dst-port=\
161 protocol=tcp
add action=accept chain=services comment="Allow BGP" disabled=yes dst-port=\
179 protocol=tcp
add action=accept chain=services comment="allow BGP" disabled=yes dst-port=\
5000-5100 protocol=udp
add action=accept chain=services comment="Allow NTP" disabled=no dst-port=123 \
protocol=udp
add action=accept chain=services comment="Allow PPTP" disabled=yes dst-port=\
1723 protocol=tcp
add action=accept chain=services comment="allow PPTP and EoIP" disabled=yes \
protocol=gre
add action=accept chain=services comment=HTTP disabled=yes dst-port=80 \
protocol=tcp src-address-list=safe
add action=accept chain=services comment="allow DNS request" disabled=no \
dst-port=53 protocol=tcp src-address-list=safe
add action=accept chain=services comment="Allow DNS request" disabled=no \
dst-port=53 protocol=udp src-address-list=safe
add action=accept chain=services comment=UPnP disabled=yes dst-port=1900 \
protocol=udp
add action=accept chain=services comment=UPnP disabled=yes dst-port=2828 \
protocol=tcp
add action=accept chain=services comment="allow DHCP" disabled=no dst-port=\
67-68 protocol=udp
add action=accept chain=services comment="allow DHCP" disabled=no dst-port=\
67-68 protocol=tcp
add action=accept chain=services comment="allow Web Proxy" disabled=yes \
dst-port=8080 protocol=tcp
add action=accept chain=services comment="allow https for Hotspot" disabled=\
yes dst-port=443 protocol=tcp
add action=accept chain=services comment="allow Socks for Hotspot" disabled=\
yes dst-port=1080 protocol=tcp
add action=accept chain=services comment="allow IPSec connections" disabled=\
yes dst-port=500 protocol=udp
add action=accept chain=services comment="allow IPSec" disabled=yes protocol=\
ipsec-esp
add action=accept chain=services comment="allow IPSec" disabled=yes protocol=\
ipsec-ah
add action=accept chain=services comment="allow RIP" disabled=yes dst-port=\
520-521 protocol=udp
add action=accept chain=services comment="allow OSPF" disabled=yes protocol=\
ospf
add action=jump chain=input comment=\
"icmp lubatud, kuid nii et ping floodi poleks" disabled=no jump-target=\
ICMP protocol=icmp
add action=return chain=services disabled=no
add action=jump chain=input comment=\
"Lubatud sissetulevate teenuste nimekirja" disabled=no jump-target=\
services
add action=log chain=input disabled=no log-prefix="drop"
add action=drop chain=input disabled=no
add action=drop chain=forward comment="" disabled=no
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=yes dst-port=5060 \
new-connection-mark=voip_conn passthrough=yes protocol=udp
add action=mark-connection chain=prerouting disabled=yes dst-port=5061 \
new-connection-mark=voip_conn passthrough=yes protocol=udp
add action=mark-packet chain=prerouting connection-mark=voip_conn disabled=\
yes new-packet-mark=voip passthrough=no