Давно я не обращался за помощью к вам. Пришел момент.
Кто может подсказать особенности настройки подключение к провайдеру АСТ Системс по TCP/IP с предоставленным IP-адресом?
Привезли мне роутер CRS112-8P-4S и попросили конфиг сделать для подключения к указанному провайдеру.
Спросил человека, что у него будет за оборудование. Вроде бы тоже самое, что у меня, но еще PoE камеры.
Файервол взял свой отлаженный. И практически все заимствовал со своего. Разница - только в том, что у меня PPPoE от МТС, а тут - TCP/IP с конкретным IP.
Вроде бы поставил адреса
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.XX.XX/24 interface=ether1 network=192.168.XX.0 - тут то, что дал провайдер.
Указал DNS:
/ip dns
set allow-remote-requests=yes servers=91.206.148.2,91.206.149.2
/ip firewall address-list
add address=192.168.88.0/24 list=NotTrapsIP
add address=192.168.88.0/24 list=AllowIPRemoteManagement
И вроде бы NAT на порт указывает:
/ip firewall nat
add action=masquerade chain=srcnat comment=Masquerade ipsec-policy=out,none \
out-interface-list=WAN src-address=192.168.88.0/24
WAN - в листе интерфейсов:
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
Отдал человеку. Он заехал к провайдеру, что бы проверить. Там, естественно, никто в Router OS ничего не понимает. Подключили и сказали, что интернет не идет.
Сам он только начал свои первые шаги в WinBox.
Что я не учел или в чем ошибся?
# sep/19/2024 17:25:41 by RouterOS 6.49.13
# software id = S2BU-TDH7
#
# model = CRS112-8P-4S
# serial number = HE108QB2Y4J
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=sfp12 ] advertise=10M-full,100M-full,1000M-full \
rx-flow-control=auto tx-flow-control=auto
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.88.1-192.168.88.255
add name=dhcp ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add add-arp=yes address-pool=dhcp disabled=no interface=bridge name=dhcp1
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfp11
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.XX.XX/24 interface=ether1 network=192.168.XX.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 \
ntp-server=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=91.206.148.2,91.206.149.2
/ip firewall address-list
add address=192.168.88.0/24 list=NotTrapsIP
add address=192.168.88.0/24 list=AllowIPRemoteManagement
/ip firewall filter
add action=fasttrack-connection chain=forward comment="1,0 fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"2.1 Accept Forward Established,Related and Untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="2.2 --------- drop invalid Forward" \
connection-state=invalid
add action=accept chain=input comment=\
"2.3 --------- accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="2.4 --------- drop invalid Input" \
connection-state=invalid
add action=accept chain=forward comment="3.1 Accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="3.2 Accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=drop chain=forward comment="4.1 drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list=ddos-blacklist \
address-list-timeout=1d chain=input comment="5.1 DDoS attack filter" \
connection-limit=100,32 in-interface-list=WAN protocol=tcp
add action=tarpit chain=input comment="5.2 --------- end of DDoS" \
connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=jump chain=forward comment="6.1 DDoS Protect - SYN Flood" \
connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input comment="6.2 --------- --------- SYN Flood" \
connection-state=new in-interface-list=WAN jump-target=SYN-Protect \
protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect comment=\
"6.3 --------- --------- SYN Flood" connection-state=new limit=\
200,5:packet protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect comment=\
"6.4 --------- end of SYN Flood" connection-state=new protocol=tcp \
tcp-flags=syn
add action=drop chain=input comment="7.1 PSD \96 Port Scan Detection" \
src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" \
address-list-timeout=none-dynamic chain=input comment=\
"7.2 --------- PSD" in-interface-list=WAN protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=1w chain=input comment=\
"7.3 PSD \96 Port Scan Detection. Trap for port scanning" \
in-interface-list=WAN protocol=tcp psd=10,10s,3,1 src-address-list=\
!NotTrapsIP
add action=drop chain=input comment=\
"8.1 WinBox Port LockOut protection -DROP" src-address-list=\
"Black List Winbox"
add action=add-src-to-address-list address-list="Black List WinBox" \
address-list-timeout=none-dynamic chain=input comment=\
"8.2 --------- --------- WinBox Protection Stage 4" connection-state=\
new dst-port=80,8291 in-interface-list=WAN log=yes log-prefix=\
"BLACK WINBOX" protocol=tcp src-address-list="WinBox Stage 3"
add action=add-src-to-address-list address-list="WinBox Stage 3" \
address-list-timeout=1m chain=input comment=\
"8.3 --------- --------- WinBox Protection Stage 3" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 2"
add action=add-src-to-address-list address-list="WinBox Stage 2" \
address-list-timeout=1m chain=input comment=\
"8.4 --------- --------- WinBox Protection Stage 2" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 1"
add action=add-src-to-address-list address-list="WinBox Stage 1" \
address-list-timeout=1m chain=input comment=\
"8.5 --------- --------- WinBox Protection Stage 1" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"8.6 --------- end of WinBox Protection ACCEPT" dst-port=80,8291 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="9.1 OpenVPN Port Connections protection" \
src-address-list="Black List OpenVPN"
add action=add-src-to-address-list address-list="Black List OpenVPN" \
address-list-timeout=none-dynamic chain=input comment=\
"9.2 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN log=yes log-prefix="BLACK OpenVPN" \
protocol=tcp src-address-list="OpenVPN Stage 3"
add action=add-src-to-address-list address-list="OpenVPN Stage 3" \
address-list-timeout=1m chain=input comment=\
"9.3 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 2"
add action=add-src-to-address-list address-list="OpenVPN Stage 2" \
address-list-timeout=1m chain=input comment=\
"9.4 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 1"
add action=add-src-to-address-list address-list="OpenVPN Stage 1" \
address-list-timeout=1m chain=input comment=\
"9.5 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"9.6 --------- end of OpenVPN Protection" dst-port=1194 \
in-interface-list=WAN protocol=tcp
add action=jump chain=forward comment=\
"10.1 - NAS ports request check jump for TCP" connection-state=new \
dst-port=5000,5001,6690,80,443,5005,5006 in-interface-list=WAN \
jump-target=check-bruteforce protocol=tcp
add action=jump chain=forward comment=\
"10.2 - NAS ports request check jump for UDP" connection-state=new \
dst-port=5000,5001 in-interface-list=WAN jump-target=check-bruteforce \
protocol=udp
add action=drop chain=forward comment="10.3 - Drop the bruteforcer" \
connection-state=new log=yes log-prefix="--DROP NAS_PORTs brute forcer--" \
src-address-list=bruteforcer
add action=add-src-to-address-list address-list=bruteforcer \
address-list-timeout=10m chain=check-bruteforce comment=\
"10.4 - Lock the bruteforcer" connection-state=new src-address-list=\
bruteforce-stage-6
add action=add-src-to-address-list address-list=bruteforce-stage-6 \
address-list-timeout=30s chain=check-bruteforce comment=\
"10.5 - bruteforcer check - Stage 6" connection-state=new \
src-address-list=bruteforce-stage-5
add action=add-src-to-address-list address-list=bruteforce-stage-5 \
address-list-timeout=30s chain=check-bruteforce comment=\
"10.6 - bruteforcer check - Stage 5" connection-state=new \
src-address-list=bruteforce-stage-4
add action=add-src-to-address-list address-list=bruteforce-stage-4 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.7 - bruteforcer check - Stage 4" connection-state=new \
src-address-list=bruteforce-stage-3
add action=add-src-to-address-list address-list=bruteforce-stage-3 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.8 - bruteforcer check - Stage 3" connection-state=new \
src-address-list=bruteforce-stage-2
add action=add-src-to-address-list address-list=bruteforce-stage-2 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.9- bruteforcer check - Stage 2" connection-state=new \
src-address-list=bruteforce-stage-1
add action=add-src-to-address-list address-list=bruteforce-stage-1 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.10 - bruteforcer check - Stage 1" connection-state=new
add action=accept chain=forward comment=\
"10.11 - NAS ports request accept for TCP " connection-state=new \
dst-port=5000,5001,6690,80,443,5005,5006 protocol=tcp
add action=accept chain=forward comment=\
"10.12 - NAS ports request accept for UDP " connection-state=new \
dst-port=5000,5001 protocol=udp
add action=drop chain=input comment="11.1 - Brute Force Port 53 protection" \
dst-port=53 in-interface-list=WAN log=yes log-prefix=\
query_in_drop_53_port protocol=udp
add action=accept chain=input comment="12.1 Enable Ping the router (Accept ICM\
P Internet Control Message Protocol )" in-interface-list=WAN limit=\
50/5s,2:packet protocol=icmp
add action=accept chain=forward comment=\
"12.2 Enable Ping device behind the router" protocol=icmp
add action=drop chain=input comment="12.3 - Drop IN echo request. Disabling PI\
NG by rejecting the PONG (echo)" icmp-options=8:0 in-interface-list=WAN \
protocol=icmp src-address-list=!AllowIPRemoteManagement
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d chain=input comment="13.4 - Trap for TCP traffic. \
Deny all attemps to connect to standart services standart ports" \
connection-nat-state=!dstnat dst-port=\
5060,5061,4569,3389,8291,22,23,389,445,53 in-interface-list=WAN protocol=\
tcp src-address-list=!NotTrapsIP
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d chain=input comment="13.5 - Trap for UDP traffic" \
connection-nat-state=!dstnat dst-port=5060,4569,389,53,161 \
in-interface-list=WAN protocol=udp src-address-list=!NotTrapsIP
add action=drop chain=input comment="15.1 Drop all not coming from LAN" \
in-interface-list=!LAN
/ip firewall mangle
add action=accept chain=prerouting
/ip firewall nat
add action=masquerade chain=srcnat comment=Masquerade ipsec-policy=out,none \
out-interface-list=WAN src-address=192.168.88.0/24
/ip firewall raw
add action=drop chain=prerouting comment="Drop Address from Trap" \
src-address-list=TrapAddress
/ip firewall service-port
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=ether1 type=external
/system clock
set time-zone-name=Europe/Moscow
# software id = S2BU-TDH7
#
# model = CRS112-8P-4S
# serial number = HE108QB2Y4J
/interface bridge
add admin-mac=XX:XX:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=sfp12 ] advertise=10M-full,100M-full,1000M-full \
rx-flow-control=auto tx-flow-control=auto
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1 ranges=192.168.88.1-192.168.88.255
add name=dhcp ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add add-arp=yes address-pool=dhcp disabled=no interface=bridge name=dhcp1
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=sfp9
add bridge=bridge comment=defconf interface=sfp10
add bridge=bridge comment=defconf interface=sfp11
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
192.168.88.0
add address=192.168.XX.XX/24 interface=ether1 network=192.168.XX.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 \
ntp-server=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=91.206.148.2,91.206.149.2
/ip firewall address-list
add address=192.168.88.0/24 list=NotTrapsIP
add address=192.168.88.0/24 list=AllowIPRemoteManagement
/ip firewall filter
add action=fasttrack-connection chain=forward comment="1,0 fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"2.1 Accept Forward Established,Related and Untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="2.2 --------- drop invalid Forward" \
connection-state=invalid
add action=accept chain=input comment=\
"2.3 --------- accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="2.4 --------- drop invalid Input" \
connection-state=invalid
add action=accept chain=forward comment="3.1 Accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="3.2 Accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=drop chain=forward comment="4.1 drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list=ddos-blacklist \
address-list-timeout=1d chain=input comment="5.1 DDoS attack filter" \
connection-limit=100,32 in-interface-list=WAN protocol=tcp
add action=tarpit chain=input comment="5.2 --------- end of DDoS" \
connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=jump chain=forward comment="6.1 DDoS Protect - SYN Flood" \
connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input comment="6.2 --------- --------- SYN Flood" \
connection-state=new in-interface-list=WAN jump-target=SYN-Protect \
protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect comment=\
"6.3 --------- --------- SYN Flood" connection-state=new limit=\
200,5:packet protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect comment=\
"6.4 --------- end of SYN Flood" connection-state=new protocol=tcp \
tcp-flags=syn
add action=drop chain=input comment="7.1 PSD \96 Port Scan Detection" \
src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" \
address-list-timeout=none-dynamic chain=input comment=\
"7.2 --------- PSD" in-interface-list=WAN protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=1w chain=input comment=\
"7.3 PSD \96 Port Scan Detection. Trap for port scanning" \
in-interface-list=WAN protocol=tcp psd=10,10s,3,1 src-address-list=\
!NotTrapsIP
add action=drop chain=input comment=\
"8.1 WinBox Port LockOut protection -DROP" src-address-list=\
"Black List Winbox"
add action=add-src-to-address-list address-list="Black List WinBox" \
address-list-timeout=none-dynamic chain=input comment=\
"8.2 --------- --------- WinBox Protection Stage 4" connection-state=\
new dst-port=80,8291 in-interface-list=WAN log=yes log-prefix=\
"BLACK WINBOX" protocol=tcp src-address-list="WinBox Stage 3"
add action=add-src-to-address-list address-list="WinBox Stage 3" \
address-list-timeout=1m chain=input comment=\
"8.3 --------- --------- WinBox Protection Stage 3" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 2"
add action=add-src-to-address-list address-list="WinBox Stage 2" \
address-list-timeout=1m chain=input comment=\
"8.4 --------- --------- WinBox Protection Stage 2" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 1"
add action=add-src-to-address-list address-list="WinBox Stage 1" \
address-list-timeout=1m chain=input comment=\
"8.5 --------- --------- WinBox Protection Stage 1" connection-state=\
new dst-port=80,8291 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"8.6 --------- end of WinBox Protection ACCEPT" dst-port=80,8291 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="9.1 OpenVPN Port Connections protection" \
src-address-list="Black List OpenVPN"
add action=add-src-to-address-list address-list="Black List OpenVPN" \
address-list-timeout=none-dynamic chain=input comment=\
"9.2 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN log=yes log-prefix="BLACK OpenVPN" \
protocol=tcp src-address-list="OpenVPN Stage 3"
add action=add-src-to-address-list address-list="OpenVPN Stage 3" \
address-list-timeout=1m chain=input comment=\
"9.3 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 2"
add action=add-src-to-address-list address-list="OpenVPN Stage 2" \
address-list-timeout=1m chain=input comment=\
"9.4 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 1"
add action=add-src-to-address-list address-list="OpenVPN Stage 1" \
address-list-timeout=1m chain=input comment=\
"9.5 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"9.6 --------- end of OpenVPN Protection" dst-port=1194 \
in-interface-list=WAN protocol=tcp
add action=jump chain=forward comment=\
"10.1 - NAS ports request check jump for TCP" connection-state=new \
dst-port=5000,5001,6690,80,443,5005,5006 in-interface-list=WAN \
jump-target=check-bruteforce protocol=tcp
add action=jump chain=forward comment=\
"10.2 - NAS ports request check jump for UDP" connection-state=new \
dst-port=5000,5001 in-interface-list=WAN jump-target=check-bruteforce \
protocol=udp
add action=drop chain=forward comment="10.3 - Drop the bruteforcer" \
connection-state=new log=yes log-prefix="--DROP NAS_PORTs brute forcer--" \
src-address-list=bruteforcer
add action=add-src-to-address-list address-list=bruteforcer \
address-list-timeout=10m chain=check-bruteforce comment=\
"10.4 - Lock the bruteforcer" connection-state=new src-address-list=\
bruteforce-stage-6
add action=add-src-to-address-list address-list=bruteforce-stage-6 \
address-list-timeout=30s chain=check-bruteforce comment=\
"10.5 - bruteforcer check - Stage 6" connection-state=new \
src-address-list=bruteforce-stage-5
add action=add-src-to-address-list address-list=bruteforce-stage-5 \
address-list-timeout=30s chain=check-bruteforce comment=\
"10.6 - bruteforcer check - Stage 5" connection-state=new \
src-address-list=bruteforce-stage-4
add action=add-src-to-address-list address-list=bruteforce-stage-4 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.7 - bruteforcer check - Stage 4" connection-state=new \
src-address-list=bruteforce-stage-3
add action=add-src-to-address-list address-list=bruteforce-stage-3 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.8 - bruteforcer check - Stage 3" connection-state=new \
src-address-list=bruteforce-stage-2
add action=add-src-to-address-list address-list=bruteforce-stage-2 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.9- bruteforcer check - Stage 2" connection-state=new \
src-address-list=bruteforce-stage-1
add action=add-src-to-address-list address-list=bruteforce-stage-1 \
address-list-timeout=1m chain=check-bruteforce comment=\
"10.10 - bruteforcer check - Stage 1" connection-state=new
add action=accept chain=forward comment=\
"10.11 - NAS ports request accept for TCP " connection-state=new \
dst-port=5000,5001,6690,80,443,5005,5006 protocol=tcp
add action=accept chain=forward comment=\
"10.12 - NAS ports request accept for UDP " connection-state=new \
dst-port=5000,5001 protocol=udp
add action=drop chain=input comment="11.1 - Brute Force Port 53 protection" \
dst-port=53 in-interface-list=WAN log=yes log-prefix=\
query_in_drop_53_port protocol=udp
add action=accept chain=input comment="12.1 Enable Ping the router (Accept ICM\
P Internet Control Message Protocol )" in-interface-list=WAN limit=\
50/5s,2:packet protocol=icmp
add action=accept chain=forward comment=\
"12.2 Enable Ping device behind the router" protocol=icmp
add action=drop chain=input comment="12.3 - Drop IN echo request. Disabling PI\
NG by rejecting the PONG (echo)" icmp-options=8:0 in-interface-list=WAN \
protocol=icmp src-address-list=!AllowIPRemoteManagement
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d chain=input comment="13.4 - Trap for TCP traffic. \
Deny all attemps to connect to standart services standart ports" \
connection-nat-state=!dstnat dst-port=\
5060,5061,4569,3389,8291,22,23,389,445,53 in-interface-list=WAN protocol=\
tcp src-address-list=!NotTrapsIP
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d chain=input comment="13.5 - Trap for UDP traffic" \
connection-nat-state=!dstnat dst-port=5060,4569,389,53,161 \
in-interface-list=WAN protocol=udp src-address-list=!NotTrapsIP
add action=drop chain=input comment="15.1 Drop all not coming from LAN" \
in-interface-list=!LAN
/ip firewall mangle
add action=accept chain=prerouting
/ip firewall nat
add action=masquerade chain=srcnat comment=Masquerade ipsec-policy=out,none \
out-interface-list=WAN src-address=192.168.88.0/24
/ip firewall raw
add action=drop chain=prerouting comment="Drop Address from Trap" \
src-address-list=TrapAddress
/ip firewall service-port
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set allow-disable-external-interface=yes enabled=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=ether1 type=external
/system clock
set time-zone-name=Europe/Moscow