ROUTEROS 学习笔记

whxy5

ROUTEROS 学习笔记
ROUTEROS Firewall设置
CODE:
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m \
tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m
/ ip firewall filter
add chain=input protocol=tcp dst-port=135-139 action=drop
add chain=input protocol=udp dst-port=135-139 action=drop
add chain=input connection-state=established action=accept
add chain=input connection-state=related action=accept
add chain=input src-address=127.0.0.1 dst-address=127.0.0.1 action=accept
add chain=input connection-state=invalid action=drop
add chain=input dst-address-type=!local action=drop
add chain=input src-address-type=!unicast action=drop
add chain=input protocol=tcp psd=21,3s,3,1 action=drop
add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list address-list-timeout=1d
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit
add chain=input protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=input protocol=icmp action=drop
add chain=output protocol=icmp action=drop
add chain=forward protocol=icmp action=drop
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=no
set irc ports=6667 disabled=no
set h323 disabled=no
set quake3 disabled=no
set mms disabled=no
set gre disabled=no
set pptp disabled=no
/ip firewall mangle
add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440
[Copy to clipboard]
说明:
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m \
tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m
# + 放火墙部分 +
#
/ ip firewall filter
# 关135-139端口 不用多说了
add chain=input protocol=tcp dst-port=135-139 action=drop comment="drop Port"
add chain=input protocol=udp dst-port=135-139 action=drop
# + 对本机数据包相关 +
#
# 允许已建立的连接
add chain=input connection-state=established action=accept comment="input"
add chain=input connection-state=related action=accept
# 允许本机对本机
add chain=input src-address=127.0.0.1 dst-address=127.0.0.1 action=accept
# 丢弃明显异常包
add chain=input connection-state=invalid action=drop
# 丢弃目标非本机的包
add chain=input dst-address-type=!local action=drop
# 丢弃多播包
add chain=input src-address-type=!unicast action=drop
# + 安全相关 +
#
# 在短时间内从同一地址用不断变化的端口向本机发送大量数据包,视为端口扫描
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="..."
# 短时间内同时建立大量TCP连接(超过10),视为DoS拒绝服务攻击,进黑名单一天!
add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list address-list-timeout=1d disabled=no
# 黑名单上的只能建立3个并发连接,tarpit
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit disabled=no
# + ICMP相关 +
#
# 允许常见命令ping tracert,其它ICMP丢弃
add chain=input protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=input protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=output protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=3:3 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=3:4 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept
add chain=forward protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept
add chain=input protocol=icmp action=drop
add chain=output protocol=icmp action=drop
add chain=forward protocol=icmp action=drop
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=no
set irc ports=6667 disabled=no
set h323 disabled=no
set quake3 disabled=no
set mms disabled=no
set gre disabled=no
set pptp disabled=no
# + MMS值 +
# 一定要设置的哦...不然某些网页打不开的...
/ip firewall mangle
add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440
一些封禁名单。。。
/ ip firewall address-list
add list=not_in_internet address=0.0.0.0/8 comment="" disabled=no
add list=not_in_internet address=172.16.0.0/12 comment="" disabled=no
add list=not_in_internet address=10.0.0.0/8 comment="" disabled=no
add list=not_in_internet address=169.254.0.0/16 comment="" disabled=no
add list=not_in_internet address=127.0.0.0/8 comment="" disabled=no
add list=not_in_internet address=224.0.0.0/3 comment="" disabled=no
add list=Prohibits address=218.83.153.93 comment="pipicn.com" disabled=no
add list=Prohibits address=61.129.75.206 comment="hot.vagaa.com" disabled=no
add list=Prohibits address=193.138.221.214 comment="vagaa" disabled=no
add list=Prohibits address=218.201.43.106 comment="help.vagaa.com" disabled=no
add list=Prohibits address=58.17.4.26 comment="PP" disabled=no
add list=Prohibits address=220.194.55.102 comment="PP" disabled=no
add list=Prohibits address=202.107.233.211 comment="PP" disabled=no
/ ip firewall service-port
set ftp disabled=no
set tftp ports=69 disabled=yes
set irc ports=6667 disabled=yes
set h323 disabled=yes
set quake3 disabled=no
set mms disabled=no
set gre disabled=yes
set pptp disabled=yes
2.9X系列：
限线程脚本：
:for aaa from 2 to 254 do={/ip firewall filter add chain=forward src-address=(192.168.0. . ＄aaa) protocol=tcp connection-limit=50,32 action=drop}
限速脚本：
:for aaa from 2 to 254 do={/queue simple add name=(queue . ＄aaa) dst-address=(192.168.2. . ＄aaa) limit-at=0/0 max-limit=32000000/32000000}
说明：
脚本为一行不是两行
aaa是变量
2 to 254是2~254
192.168.0. . ＄aaa是IP
上两句加起来是192.168.0.2~192.168.0.254的意思
connection-limit=50是线程数这里为50
max-limit=2000000/2000000是上行／下行
使用：
WinBox-System-Scripts-＋
Name(脚本名程)
Source(脚本)
OK-选择要运行的脚本-Run Script
查看：
限线程：WinBox-IP-Firewall-Filter Rules(看是否已经填加进来)
限速：WinBox-Queues-Simple Queues(看是否已经填加进来)
限速脚本：
:for aaa from 2 to 254 do={/queue simple add name=(queue . ＄aaa) dst-address=(192.168.2. . ＄aaa) limit-at=0/0 max-limit=32000000/32000000}
说明：
脚本为一行不是两行
aaa是变量
2 to 254是2~254
192.168.0. . ＄aaa是IP
上两句加起来是192.168.0.2~192.168.0.254的意思
connection-limit=50是线程数这里为50
max-limit=2000000/2000000是上行／下行
用WINBOX登入ROS2.9X系列版本 到“NEW TERMINAL ”处输入以上的命令就行了。注意脚本变量的就行了
比较实用ROS路由限速脚本
ROS路由限速脚本!!
先看一个脚本:
:for aaa from 2 to 254 do={/queue simple add name=(queue . ＄aaa) dst-address=(192.168.0. . ＄aaa) limit-at=0/0 max-limit=1638400/819200 burst-limit=3276800/819200 burst-threshold=1474560/819200 burst-time=30/30}
脚本为一行不是两行
aaa是变量，你可以改成你想要的..但是要注意,前后三个,一定要相同!
2 to 254是2~254 这个我刚刚开始看不明白,因为我是中国人嘛…不学E文
192.168.0. . ＄aaa是IP 详细的说…192.168.0.空格.空格＄变量名上两句加起来是192.168.0.2~192.168.0.254的意思
(queue . ＄aaa)=(你要在simple queues 显示的规则名前缀.空格.空格＄aaa)
下来的就是这了
Limit-at=0/0 这个没必要理会,就是限制在多少,上行/下行的意思,不知道,有没有说错.
max-limit=1638400/819200 是最大的上行／下行速度
burst-limit=3276800/819200 是突破速度的最大值,这些网上有查的.
burst-threshold=1474560/819200 突破速度的阀值
burst-time=30/30 突破速度的时间,这为30秒.
下面这个一看就明白了就不多说了
1KB=1024B
1Byte=8bit
公式 KB*1024*8=?
以上脚本意为
192.168.0.2~192.168.0.254 IP段内IP在30秒内平均值小于突破阀值时,
最大下载速度可以超出最大速度值,并达到最大突破速度值,
如果30秒内平均值大于突破速度阀值时,IP速度最大值为
你所设置的max-limit值
使用：WinBox-System-Scripts-按+号Name(弄个好记的名字)
Source(把你按照上面说的,写好的脚本,粘贴下去)
OK-选择你刚刚起的名字-按Run Script
再看下 WinBox-queues- simple queues 是不是显示有一大堆,以你设置的规则名前缀+变量IP号的规则?如果是,那恭喜你成功了!
__________________________________________________________________________________________________
用WinBox登陆RouterOS，Tools---Torch
在Torch选项卡上点击[start]就可以看到了
用RouterOS查看局域网每个IP流量的方法，TX是下行速度，RX是上行速度
______________________________________________________________________________________________________
小包策略（研究）
/ ip firewall mangle
add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440 comment="" disabled=no
add chain=forward p2p=all-p2p action=mark-connection new-connection-mark=p2p_conn passthrough=yes comment="" disabled=no
add chain=forward connection-mark=p2p_conn action=mark-packet new-packet-mark=p2p passthrough=yes comment="" disabled=no
add chain=forward connection-mark=!p2p_conn action=mark-packet new-packet-mark=general passthrough=yes comment="" disabled=no
add chain=forward packet-size=32-512 action=mark-packet new-packet-mark=small passthrough=yes comment="" disabled=no
add chain=forward packet-size=512-1200 action=mark-packet new-packet-mark=big passthrough=yes comment="" disabled=no
/ queue tree
add name="p2p1" parent=wan packet-mark=p2p limit-at=2000000 queue=default priority=8 max-limit=6000000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="p2p2" parent=lan packet-mark=p2p limit-at=2000000 queue=default priority=8 max-limit=6000000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="ClassA" parent=lan packet-mark="" limit-at=0 queue=default priority=8 max-limit=100000000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="ClassB" parent=ClassA packet-mark="" limit-at=0 queue=default priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="Leaf1" parent=ClassA packet-mark=general limit-at=0 queue=default priority=7 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="Leaf2" parent=ClassB packet-mark=small limit-at=0 queue=default priority=5 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
add name="Leaf3" parent=ClassB packet-mark=big limit-at=0 queue=default priority=6 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no
————————————————————————————————————————————————————
1。单电信线路用不到电信路由表。
2。防火墙：只能举个例子给，看个人理解了
add chain=input protocol=tcp dst-port=135-139 action=drop
在input（联入）链中加入一条规则，丢弃所有TCP协议上的135-139端口的数据包。
add chain=forward protocol=tcp dst-port=80 action=drop
输入这个规则，则所有机器都无法访问外网的80端口，也就是基本打不开网页了。
3。ROS的管理分为本地控制台管理，远程telnet，winbox，ssh的管理。比较常用的是winbox，图形化简单易上手，推荐使用。
4。常见的ROS问题就是ARP攻击导致掉线。
-------------------------------------------------------------------------------------------------------
防ddos攻击：
add src-address=192.168.0.0/24 in-interface=X action=accept comment="ddos_X" disabled=no
add in-interface=X action=drop comment="" disabled=no
限制bt等p2p的连接数（可选）
add src-address=192.168.0.0/24 protocol=tcp tcp-options=syn-only p2p=all-p2p action=drop connection-limit=80 comment="limit \
p2p conn=20" disabled=no
如果你看谁不顺眼可以在防ddos前加上他的mac让他上不了网（一定在ddos前加）
add src-mac-address=XX:XX:XX:XX:XX:XX action=drop disabled=no
记住，防火墙是逐行执行的，如果符合前面的规则，后面的就不执行了。
对于封的端口，你可以根据你自己的判断来增减端口，比如你不让所有的人浏览网页，就封80端口，不让所以的人上qq，就封掉qq的端口


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/52542/showart_489913.html