routerOS防火墙规则

剑心通明

ip firewall rule input !!防火墙!!!!
add protocol=tcp tcp-options=no-sys-only connection-state=established action=accept comment="Established TCP connections" disabled=no
add connect
ion-state=related action=accept comment="Related connections" disabled=no
add dst-address=:69 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:69 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:134-139 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:134-139 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:161-162 protocol=tcp action=drop comment="drop SNMP Trap" disabled=no
add dst-address=:161-162 protocol=udp action=drop comment="drop SNMP Trap" disabled=no
add dst-address=:445 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:445 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:554 protocol=tcp action=drop comment="drop blaster wrom" disabled=no
add dst-address=:554 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:593 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:593 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:1025 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:1025 protocol=udp action=drop comment="drop blaster worm" disabled=no
add det-address=:1068 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:1068 protocol=udp action=drop comment-"drop blaster worm" disabled=no
add dst-address=:2000 protocol=tcp action=drop comment="drop Millenium" disabled=no
add dst-address=:2000 protocol=udp action=drop comment="drop millenium" disabled=no
add dst-address=:3127-3198 protocol=tcp action=drop comment="drop proxy worm" disabled=no
add dst-address=:3127-3198 protocol=udp action=drop comment="drop proxy worm" disabled=no
add dst-address=:3389 protocol=tcp action=drop comment="drop windows supper clinet link" disabled=no
add dst-address=:3389 protocpl=udp action=drop comment="drop windows supper clinet link" disabled=no
add dst-address=:4444 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:4444 protocol=udp action=drop comment="drop blaster worm" disabled=no
add dst-address=:5554 protocol=tcp action=drop comment="drop blaster worm' disabled=no
add dst-address=:5554 protocol=udp action=drop comment="drop Bt download" disabled=no
add dst-address=:6881-6889 protocol=tcp action=drop comment="drop drop Bt download" disabled=no
add dst-address=:6881-6889 protocol=udp action=drop comment="drop drop Bt download" disabled=no
add dst-address=:8881-8889 protocol=tcp action=drop comment="drop drop Bt download" disabled=no
add dst-address=:8881-8889 protocol=udp action=drop comment="drop drop Bt download" disabled=no
add dst-address=:39213 protocol=tcp action=drop comment="drop worm" disabled=no
add dst-address=:39213 protocol=tcp action=drop comment="drop worm" disabled=no
add protocol=udp action=accept comment="udp" disabled=no
add dst-address=XXX.XXX.XXX.XXX/32 protocol=icmp action=drop
add protocol=icmp limit-count=50 limit-burst=2 limit-time=5s action=accept comment="allow limited pings" disabled=0
comment="dont ping me" disabled=no
add dst-address=!192.168.0.0/24:3987 protocol=tcp action=drop comment="dont link me" disabled=no
add src-address=192.168.0.0/24 dst-address=192.168.0.125/32 action=accept comment="
http://blog.chinaitlab.com/from
lan admin" disabled=no
add action=drop log=yes comment="Log and drop everything else" disabled=no
ip firewall rule forward (禁止某些网站IP)
add dst-address=:134-139 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=:134-139 protocol=tcp action=drop comment="drop blaster worm" disabled=no
add dst-address=61.240.246.41/32 action=DROP comment="DROP WWW. CY07.COM" disabled=no
ip service 禁止外网控制路由
set telent port=23 address=192.168.0.0/24 disabled=yes
set ftp port=21 address=192.168.0.0/24 disabled=no (把21端口改了)
set www port=80 address=192.168.0.0/24 disabled=no (把80端口改了)
set ssh port=22 address=192.168.0.0/24 disabled=yes
user 管理员只能在内网登陆
set 0 address=192.168.0.0/24

将规则另存为*.rsc文件，进入控制台，或者在路由器本机上，输入 import *.rsc
该规则导入完成



本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/4206/showart_705094.html

tian_jirun

谢谢了，认真参考一下！！