Scribd Logo
Upload

Welcome to Scribd!

  • 388 views

    Basic Universal Firewall Script

    Uploaded by

    Cesar Rolando Gomez Rodas
    This document provides instructions for setting up a basic universal firewall script. It includes creating an address list for IPs that will have full access, then defines firewall filter rules to protect against Syn floods, ICMP floods, port scans, email spam and more. The rules add dropping IPs to address lists if they trigger the filters, and allow access for established/related connections and DNS. The firewall is configured to jump or accept ICMP and give full access to the defined support address list.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Basic Universal Firewall Script

    Uploaded by

    Cesar Rolando Gomez Rodas
    388 views3 pages
    This document provides instructions for setting up a basic universal firewall script. It includes creating an address list for IPs that will have full access, then defines firewall filter rules to protect against Syn floods, ICMP floods, port scans, email spam and more. The rules add dropping IPs to address lists if they trigger the filters, and allow access for established/related connections and DNS. The firewall is configured to jump or accept ICMP and give full access to the defined support address list.

    Original Description:

    Configuracion Basica de Firewall Mikrotik

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides instructions for setting up a basic universal firewall script. It includes creating an address list for IPs that will have full access, then defines firewall filter rules to protect against Syn floods, ICMP floods, port scans, email spam and more. The rules add dropping IPs to address lists if they trigger the filters, and allow access for established/related connections and DNS. The firewall is configured to jump or accept ICMP and give full access to the defined support address list.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    388 views3 pages

    Basic Universal Firewall Script

    Uploaded by

    Cesar Rolando Gomez Rodas
    This document provides instructions for setting up a basic universal firewall script. It includes creating an address list for IPs that will have full access, then defines firewall filter rules to protect against Syn floods, ICMP floods, port scans, email spam and more. The rules add dropping IPs to address lists if they trigger the filters, and allow access for established/related connections and DNS. The firewall is configured to jump or accept ICMP and give full access to the defined support address list.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 3

    Basic universal firewall script.

    HANDS ON! First we need to create our ADDRESS LIST with all IPs we will use most times
    Below you need to change x.x.x.x/x for your technical subnet. This subnet will have full
    access to the router.

    /ip firewall address-list add address=10.0.10.1/30 disabled=no list=support

    Now we have protection against: SynFlood, ICMP Flood, Port Scan, Email Spam and much
    more. For more information read the comments.

    ip firewall filter

    /ip firewall filter

    add action=add-src-to-address-list address-list=Syn_Flooder address-list-


    timeout=30m chain=input comment="Add Syn Flood IP to the list" connection-
    limit=30,32 protocol=\

    tcp tcp-flags=syn

    add action=drop chain=input comment="Drop to syn flood list" src-address-


    list=Syn_Flooder

    add action=add-src-to-address-list address-list=Port_Scanner address-list-


    timeout=1w chain=input comment="Port Scanner Detect" protocol=tcp
    psd=21,3s,3,1

    add action=drop chain=input comment="Drop to port scan list" src-address-


    list=Port_Scanner

    add action=jump chain=input comment="Jump for icmp input flow" jump-


    target=ICMP protocol=icmp

    add action=accept chain=input comment="Allows access to winbox from the WAN


    # DO NOT ENABLE THIS RULE IF YOU DO NOT WANT TO ACCESS FROM THE
    INTERNET" disabled=yes \

    dst-port=8291 in-interface="ISP ether10" protocol=tcp

    add action=drop chain=input comment="Block all access to the winbox - except


    to support list # DO NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE
    SUPPORT ADDRESS LIST" \
    disabled=yes dst-port=8291 protocol=tcp src-address-list=!support

    add action=jump chain=forward comment="Jump for icmp forward flow" jump-


    target=ICMP protocol=icmp

    add action=drop chain=forward comment="Drop to bogon list" dst-address-


    list=bogons

    add action=drop chain=forward comment="Avoid spammers action" dst-


    port=25,587 protocol=tcp src-address-list=spammers

    add action=accept chain=input comment="Accept DNS - UDP" port=53


    protocol=udp

    add action=accept chain=input comment="Accept DNS - TCP" port=53


    protocol=tcp

    add action=accept chain=input comment="Accept to established connections"


    connection-state=established

    add action=accept chain=input comment="Accept to related connections"


    connection-state=related

    add action=accept chain=input comment="Full access to SUPPORT address list"


    src-address-list=support

    add action=drop chain=input comment="Drop anything else! # DO NOT ENABLE


    THIS RULE BEFORE YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED"
    disabled=yes

    add action=accept chain=ICMP comment="Echo reply" icmp-options=0:0


    protocol=icmp

    add action=accept chain=ICMP comment="Time Exceeded" icmp-options=11:0


    protocol=icmp

    add action=accept chain=ICMP comment="Destination unreachable" icmp-


    options=3:0-1 protocol=icmp

    add action=accept chain=ICMP comment=PMTUD icmp-options=3:4


    protocol=icmp

    add action=drop chain=ICMP comment="Drop to the other ICMPs" protocol=icmp

    I think this is basic. You can add or remove anything else according to your needs. I
    hope it helps!

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy