Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /ip firewall filter
- add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
- established,related,untracked
- add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid log-prefix=B1_
- add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
- add action=accept chain=input in-interface-list=WAN log-prefix=Input_VPN protocol=udp src-port=1701,500,4500
- add action=accept chain=input protocol=ipsec-esp
- add action=drop chain=input comment="drop all not coming from LAN" in-interface-list=!LAN ipsec-policy=in,none \
- log-prefix=B2_
- add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
- add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
- add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
- add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
- established,related,untracked
- add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log-prefix=B3_
- add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
- connection-state=new in-interface-list=WAN
Advertisement
Add Comment
Please, Sign In to add comment
