Russian Users MikroTik | Форум пользователей MikroTik

Код: Выделить всё

/ip firewall export

Код: Выделить всё

# jul/24/2018 14:20:55 by RouterOS 6.38.7
# software id = 0BJT-J3AQ
#
/ip firewall filter
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related" \
    connection-state=established,related disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new disabled=yes in-interface=ether1-WAN
add action=accept chain=input disabled=yes protocol=icmp
add action=accept chain=input connection-state=established disabled=yes
add action=accept chain=input connection-state=related disabled=yes
add action=drop chain=input disabled=yes in-interface=pppoe-out1
add action=accept chain=input disabled=yes in-interface-list=!all src-address=\
    192.168.0.0/24
add action=accept chain=input comment="RULE 1 PING" disabled=yes protocol=icmp
add action=accept chain=forward comment="RULE 1-2 PING" disabled=yes protocol=\
    icmp
add action=accept chain=input comment="RULE2 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \D3\
    \D1\D2\C0\CD\CE\C2\CB\C5\CD\CD\DB\D5 \CF\CE\C4\CA\CB\DE\D7\C5\CD\C8\C9" \
    connection-state=established disabled=yes
add action=accept chain=forward comment="RULE3 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \
    \D3\D1\D2\C0\CD\CE\C2\CB\C5\CD\CD\DB\D5 \CF\CE\C4\CA\CB\DE\D7\C5\CD\C8\C9" \
    connection-state=established disabled=yes
add action=accept chain=input comment="RULE4 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \D1\
    \C2\DF\C7\C0\CD\CD\DB\D5 \CF\CE\C4\CA\CB\DE\D7\C5\CD\C8\C9" \
    connection-state=related disabled=yes
add action=accept chain=forward comment="RULE5 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \
    \D1\C2\DF\C7\C0\CD\CD\DB\D5 \CF\CE\C4\CA\CB\DE\D7\C5\CD\C8\C9" \
    connection-state=related disabled=yes
add action=accept chain=input comment="RULE6 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \CF\
    \CE\C4\CA\CB\DE\D7\C5\CD\C8\DF \C8\C7 \CB\CE\CA\C0\CB\DC\CD\CE\C9 \D1\C5\D2\
    \C8" disabled=yes in-interface=!ether1-WAN in-interface-list=all \
    src-address=192.168.0.0/24
add action=drop chain=input comment="RULE7 \C7\C0\CF\D0\C5\D9\C5\CD\C8\C5 \CE\D8\
    \C8\C1\CE\D7\CD\DB\D5 \D1\CE\C5\C4\C8\CD\C5\CD\C8\C9" connection-state=\
    invalid disabled=yes
add action=drop chain=forward comment="RULE8 \C7\C0\CF\D0\C5\D9\C5\CD\C8\C5 \CE\
    \D8\C8\C1\CE\D7\CD\DB\D5 \D1\CE\C5\C4\C8\CD\C5\CD\C8\C9" connection-state=\
    invalid disabled=yes
add action=drop chain=input comment="RULE9 \C7\C0\CF\D0\C5\D2 \C2\D1\C5\D5 \CE\
    \D1\D2\C0\CB\DC\CD\DB\D5 \D1\CE\C5\C4\C8\CD\C5\CD\C8\C9 \C8\C7 \C2\CD\C5\D8\
    \CD\C5\C9 \D1\C5\D2\C8" disabled=yes in-interface=ether1-WAN
add action=accept chain=forward comment="RULE10 \D0\C0\C7\D0\C5\D8\C5\CD\C8\C5 \
    \D2\D0\C0\D4\C8\CA\C0 \C8\C7 \CB\CE\CA\C0\CB\DC\CD\CE\C9 \D1\C5\D2\C8 \C2 \
    \C8\CD\D2\C5\D0\CD\C5\D2" disabled=yes in-interface=!ether1-WAN \
    out-interface=ether1-WAN
add action=drop chain=forward comment="RULE11 \C7\C0\CF\D0\C5\D2 \C2\D1\C5\D5 \
    \CE\D1\D2\C0\CB\DC\CD\DB\D5 \CF\CE\C4\CA\CB\DE\D7\C5\CD\C8\C9" disabled=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=\
    pppoe-out1
add action=dst-nat chain=dstnat dst-port=80 protocol=tcp to-addresses=\
    192.168.0.104 to-ports=80
add action=dst-nat chain=dstnat dst-port=81 protocol=tcp to-addresses=\
    192.168.0.105 to-ports=80
add action=masquerade chain=srcnat dst-address=192.168.0.105 dst-port=81 \
    out-interface=bridge1 port=81 protocol=tcp src-address=192.168.0.0/24
add action=dst-nat chain=dstnat dst-address-type=local dst-port=81 protocol=tcp \
    to-addresses=192.168.0.105 to-ports=81