Firewall-FilterRule-Mangle

[cobrabatida]

Esse tópico é para colar o firewall de todos que usam o Mikrotik, na opcao export
para estudo, mas coloque bem detalhado como funciona as regras para apenas só copiar e colar no seu Mk, a parte de Nat nao Precisa cada um tem sua config
apenas a citadas no topo do topico, para colocar um Provedor para funcionar sem dor de cabeça, com bloqueio de Netbios, virus, limitar conexoes(na aba nat), bloqueio total de P2P, que no MK nao funciona 100%....... etc.....vamos ver qual o melhor o meu vai ai....... Só vale cobra criada neste post...valeu

[cobrabatida]

Esse tópico é para colar o firewall de todos que usam o Mikrotik, na opcao export
para estudo, mas coloque bem detalhado como funciona as regras para apenas só copiar e colar no seu Mk, a parte de Nat nao Precisa cada um tem sua config
apenas a citadas no topo do topico, para colocar um Provedor para funcionar sem dor de cabeça, com bloqueio de Netbios, virus, limitar conexoes(na aba nat), bloqueio total de P2P, que no MK nao funciona 100%....... etc.....vamos ver qual o melhor o meu vai ai.......

/ ip firewall mangle
add chain=prerouting protocol=tcp dst-port=80 action=mark-connection \
new-connection-mark=http-down passthrough=yes comment="HTTP" disabled=no
add chain=prerouting connection-mark=http-down action=mark-packet \
new-packet-mark=http passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp dst-port=20-23 \
action=add-src-to-address-list address-list=drop_port_22_23 \
address-list-timeout=0s comment="Ajuste de Bloqueio SSH e Telnet" \
disabled=no
add chain=prerouting protocol=tcp dst-port=1863 action=mark-connection \
new-connection-mark=msn_in passthrough=yes comment="MSN-IN" disabled=no
add chain=prerouting connection-mark=msn_in action=mark-packet \
new-packet-mark=MSN_IN passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp src-port=1863 action=mark-connection \
new-connection-mark=msn_out passthrough=yes comment="MSN-OUT" disabled=no
add chain=prerouting connection-mark=msn_out action=mark-packet \
new-packet-mark=MSN_OUT passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp dst-port=443 action=mark-connection \
new-connection-mark=443_conn passthrough=yes comment="SSL" disabled=no
add chain=prerouting connection-mark=443_conn action=mark-packet \
new-packet-mark=HTTP passthrough=yes comment="" disabled=no
add chain=prerouting protocol=udp dst-port=5060 action=mark-connection \
new-connection-mark=voip_in passthrough=yes comment="VOIP-IN" disabled=no
add chain=prerouting connection-mark=voip_in action=mark-packet \
new-packet-mark=VOIP_IN passthrough=yes comment="" disabled=no
add chain=prerouting protocol=tcp src-port=5060 action=mark-connection \
new-connection-mark=voip_out passthrough=yes comment="VOIP-OUT" \
disabled=no
add chain=prerouting connection-mark=voip_out action=mark-packet \
new-packet-mark=VOIP_OUT passthrough=yes comment="" disabled=no
/ ip firewall nat
add chain=srcnat src-address=20.20.0.0/16 action=masquerade comment="" \
disabled=no
add chain=dstnat src-address=20.20.0.0/16 protocol=tcp dst-port=80 \
action=redirect to-ports=3126 comment="" disabled=no
/ ip firewall connection tracking
set enabled=yes tcp-syn-sent-timeout=5s tcp-syn-received-timeout=5s \
tcp-established-timeout=1d tcp-fin-wait-timeout=10s \
tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s \
tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s \
udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m \
tcp-syncookie=no
/ ip firewall filter
add chain=input in-interface=LINK protocol=tcp dst-port=3126 action=drop \
comment="Bloqueio de proxy externo " disabled=no
add chain=input protocol=tcp dst-port=20-23 action=drop comment="Drop SSH, \
FTP, TELNET" disabled=no
add chain=input connection-state=established action=accept comment="accept \
established packets" disabled=no
add chain=output connection-state=established action=accept comment="accept \
established packets" disabled=no
add chain=connlimit protocol=tcp dst-port=443 action=accept comment="SSL" \
disabled=no
add chain=connlimit protocol=tcp src-port=443 action=accept comment="" \
disabled=no
add chain=connlimit protocol=tcp dst-port=1863 action=accept comment="MSN" \
disabled=no
add chain=connlimit protocol=tcp src-port=1863 action=accept comment="" \
disabled=no
add chain="connlimit 20" protocol=tcp action=log log-prefix="" \
comment="connlimit 20" disabled=yes
add chain="connlimit 20" action=drop comment="connlimit 20" disabled=no
add chain=P2P p2p=all-p2p action=drop comment="" disabled=no
/ ip firewall service-port
set ftp ports=21 disabled=no
set tftp ports=69 disabled=no
set irc ports=6667 disabled=no
set h323 disabled=yes
set quake3 disabled=no
set gre disabled=yes
set pptp disabled=yes