MikroTik RouterOS (часть 3) - [37] :: В помощь системному администратору

Цитата:

а можно правила увидеть по всем 4 пунктам

1. маркировать пакеты штатными средствами
/ip firewall mangle
add action=mark-packet chain=prerouting comment=all-p2p disabled=no new-packet-mark=p2p p2p=all-p2p passthrough=no
add action=mark-packet chain=prerouting comment="\B5TP-1" disabled=no layer7-protocol="\B5TP-1" new-packet-mark=p2p passthrough=no
add action=mark-packet chain=prerouting comment="\B5TP-2" disabled=yes layer7-protocol="\B5TP-2" new-packet-mark=p2p passthrough=no
add action=mark-packet chain=prerouting comment=DHT disabled=no layer7-protocol=DHT new-packet-mark=p2p passthrough=no
add action=mark-packet chain=prerouting comment=BitTorrent disabled=yes layer7-protocol=bittorrent new-packet-mark=p2p passthrough=no

2. маркировать пакеты по сигнатуре Layer7
/ip firewall layer7-protocol
add comment="" name="\B5TP-1" regexp="\\x7F\\xFF\\xFF\\xFF\\xAB"
add comment="" name=DHT regexp="^d1:[a|r]d2:id20:.*:y1:[q|r]e"
add comment="" name="\B5TP-2" regexp="\\\\x7F\\\\xFF\\\\xFF\\\\xFF\\\\xAB"
add comment="" name=bittorrent regexp="^(\\x13bittorrent protocol|azver\\x01\$|get /scrape\\\?info_hash=|get /announce\\\?info_hash=|ge\
t\r\
\n/ann\?uk=|get\r\
\n/client/bitcomet/|get /data\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[RP]"

Порядок секций в файерволе:
/ip firewall filter

3. Разрешить ВСЕ! (и торренты тоже) из листа "full" (себе любимому, корешу и т.д.) !!
add action=accept chain=forward comment=full disabled=no src-address-list=full
add action=accept chain=forward comment=full disabled=no dst-address-list=full

3. Разрешить порт 8080

4. IP с которых ходят эти пакеты добавить в black-list (на 3 дня!)
add action=add-src-to-address-list address-list=torrent address-list-timeout=3d chain=forward comment=p2p-packet disabled=no \
packet-mark=p2p src-address=192.168.0.0/16
add action=add-dst-to-address-list address-list=torrent address-list-timeout=3d chain=forward comment=p2p-packet disabled=no \
dst-address=192.168.0.0/16 packet-mark=p2p
add action=log chain=forward comment=p2p-packet disabled=yes log-prefix="" packet-mark=p2p
add action=drop chain=input comment=all-p2p disabled=no p2p=all-p2p
add action=drop chain=input comment=p2p-mark disabled=no packet-mark=p2p
add action=drop chain=forward comment=all-p2p disabled=no p2p=all-p2p
add action=drop chain=forward comment=p2p-mark disabled=no packet-mark=p2p

5. black-list'у БАН! (drop порты с 1000 по 65535 кроме 8080)
add action=drop chain=forward comment="!!!_BAN_!!! -> torr" disabled=no dst-address-list=torrent protocol=tcp src-port=1000-65535
add action=drop chain=forward comment="!!!_BAN_!!! -> torr" disabled=no dst-address-list=torrent protocol=udp src-port=1000-65535
add action=drop chain=forward comment="!!!_BAN_!!! torr ->" disabled=no dst-port=1000-65535 protocol=tcp src-address-list=torrent
add action=drop chain=forward comment="!!!_BAN_!!! torr ->" disabled=no dst-port=1000-65535 protocol=udp src-address-list=torrent

Модерирует : lynx, Crash_Master, dg, emx, ShriEkeR
ShriEkeR (05-01-2012 00:59):	Версия для печати • Подписаться • Добавить в закладки
Страницы: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147