310
Базовые настройки Firewall в Mikrotik
Если вы используете дефолтную конфигурацию роутера, то она по-умолчанию имеет стандартные правила firewall. Привожу список стандартных правил (rules) с комментариями. Напоминаю, что экспорт правил firewall в mikrotik можно выполнить следующей командой:
>> ip firewall export file=rules
Команды базового Firewall
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
Мой конфиг
/ip firewall filter
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=WEBFIG dst-port=80 in-interface=ether2 \
protocol=tcp
add action=accept chain=input comment=Winbox dst-port=8291 in-interface=\
ether2 protocol=tcp
add action=drop chain=input comment="All input Block" in-interface=ether2
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment="Drop WAN > LAN" in-interface=ether2 \
out-interface=ether3
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether2 protocol=tcp \
to-addresses=10.130.50.26 to-ports=443
add action=masquerade chain=srcnat disabled=yes
2 комментария
[…] Источник […]
[…] Источник […]