Scribd
Upload
51 views

Firewall

This document contains firewall configuration rules for address lists, filters, and chains. It defines rules for common reserved and private IP ranges, as well as rules to detect and block potential threats like SYN floods, port scanning, and spamming. The rules are designed to allow legitimate traffic while protecting the network.

Uploaded by

Pepi To
Copyright
© © All Rights Reserved
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
51 views

Firewall

This document contains firewall configuration rules for address lists, filters, and chains. It defines rules for common reserved and private IP ranges, as well as rules to detect and block potential threats like SYN floods, port scanning, and spamming. The rules are designed to allow legitimate traffic while protecting the network.

Uploaded by

Pepi To
Copyright
© © All Rights Reserved
Available Formats
Download as XLSX, PDF, TXT or read online on Scribd
You are on page 1/ 6

/ip firewall address-list

1 add address=0.0.0.0/8
add address=10.0.0.0/8
2

3 disabled=yes list=bogons
4 add address=127.0.0.0/8
5 add address=169.254.0.0/16
add address=172.16.0.0/12
6

7 disabled=yes list=bogons
add address=192.168.0.0/16
8

9 disabled=yes list=bogons
10 add address=192.0.2.0/24
add address=192.88.99.0/24
11

12 add address=198.18.0.0/15
13 add address=198.51.100.0/24
14 add address=203.0.113.0/24
add address=224.0.0.0/4
15

16
add action=add-src-to-address-list address-
17 list=Syn_Flooder address-list-timeout=30m
chain=input \

add action=drop chain=input


18
add action=add-src-to-address-list address-
19 list=Port_Scanner address-list-timeout=1w
chain=input

20 disabled=no protocol=tcp psd=21,3s,3,1


add action=drop chain=input
21
add action=jump chain=input
22

23 add action=drop chain=input\

24

disabled=yes dst-port=8291 protocol=tcp src-address-


25 list=!support
add action=jump chain=forward
26
add action=drop chain=forward
27
add action=add-src-to-address-list address-
28 list=spammers address-list-timeout=3h chain=forward

add action=drop chain=forward


29

30 add action=accept chain=input


31 add action=accept chain=input
add action=accept chain=input
32

33 disabled=no
add action=accept chain=input
34
add action=accept chain=input
35
add action=drop chain=input
36

add action=accept chain=ICMP


37

add action=accept chain=ICMP


38
add action=accept chain=ICMP
39
add action=accept chain=ICMP
40

41 add action=accept chain=ICMP


42 add action=drop chain=ICMP
add action=jump chain=output
43

44 /ip firewall filter


add chain=input
45
add chain=input
46

47 add action=drop chain=input


add action=drop chain=input
48
add action=drop chain=input
49
add action=drop chain=input
50
51 /ip firewall filter
add chain=forward
52

53 add action=drop chain=forward


add action=drop chain=forward
54

add action=drop chain=forward


55

add action=drop chain=forward


56

add action=drop chain=forward


57

58 /ip firewall filter


add action=drop chain=forward
59
Self-Identification [RFC 3330] disabled=no list=bogons
Private[RFC 1918] - CLASS A # Check if you need this subnet
before enable it\

Loopback [RFC 3330] disabled=no list=bogons


Link Local [RFC 3330] disabled=no list=bogons
Private[RFC 1918] - CLASS B # Check if you need this subnet
before enable it\

Private[RFC 1918] - CLASS C # Check if you need this subnet


before enable it\

Reserved - IANA - TestNet1 disabled=no list=bogons


6to4 Relay Anycast [RFC 3068] disabled=no list=bogons

NIDB Testing disabled=no list=bogons


Reserved - IANA - TestNet2 disabled=no list=bogons
Reserved - IANA - TestNet3 disabled=no list=bogons
MC, Class D, IANA # Check if you need this subnet before
enable it\

Add Syn Flood IP to the list connection-limit=30,32


disabled=no protocol=tcp tcp-flags=syn

Drop to syn flood list disabled=no src-address-


list=Syn_Flooder
Port Scanner Detect\

Drop to port scan list disabled=no src-address-


list=Port_Scanner
Jump for icmp input flow disabled=no jump-target=ICMP
protocol=icmp

Block all access to the winbox - except to support list # DO


NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE
SUPPORT ADDRESS LIST\

Jump for icmp forward flow disabled=no jump-target=ICMP


protocol=icmp
Drop to bogon list disabled=no dst-address-list=bogons

Add Spammers to the list for 3 hours\

Avoid spammers action disabled=no dst-port=25,587


protocol=tcp src-address-list=spammers
Accept DNS - UDP disabled=no port=53 protocol=udp
Accept DNS - TCP disabled=no port=53 protocol=tcp
Accept to established connections connection-
state=established\

Accept to related connections connection-state=related


disabled=no
Full access to SUPPORT address list disabled=no src-address-
list=support
Drop anything else! # DO NOT ENABLE THIS RULE BEFORE
YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED\

Echo request - Avoiding Ping Flood, adjust the limit as


needed disabled=no icmp-options=8:0 limit=2,5
protocol=icmp

Echo reply disabled=no icmp-options=0:0 protocol=icmp

Time Exceeded disabled=no icmp-options=11:0


protocol=icmp
Destination unreachable disabled=no icmp-options=3:0-1
protocol=icmp
PMTUD disabled=no icmp-options=3:4 protocol=icmp
Drop to the other ICMPs disabled=no protocol=icmp
Jump for icmp output disabled=no jump-target=ICMP
protocol=icmp

Accept established and related packets connection-


state=established,related
Accept all connections from local network in-interface=LAN

Drop invalid packets connection-state=invalid


Drop all packets which are not destined to routes IP address
dst-address-type=!local
Drop all packets which does not have unicast source IP
address src-address-type=!unicast
Drop all packets from public internet which should not exist
in public network in-interface=WAN src-address-
list=NotPublic
Accept established and related packets connection-
state=established,related
Drop invalid packets connection-state=invalid
Drop new connections from internet which are not dst-
natted connection-nat-state=!dstnat connection-state=new
in-interface=WAN

Drop all packets from public internet which should not exist
in public network in-interface=WAN src-address-
list=NotPublic

Drop all packets from local network to internet which should


not exist in public network dst-address-list=NotPublic in-
interface=LAN

Drop all packets in local network which does not have local
network address in-interface=LAN src-address=!
192.168.88.0/24

Drop new connections from internet which are not dst-


natted connection-nat-state=!dstnat connection-state=new
in-interface=WAN

You might also like