Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- # jan/02/1970 00:55:49 by RouterOS 6.40.4
- # software id = LTZV-18MX
- #
- # model = RouterBOARD 952Ui-5ac2nD
- # serial number = 9249084C7F4A
- /ip firewall filter
- add action=accept chain=input comment=\
- "defconf: accept established,related,untracked" connection-state=\
- established,related,untracked
- add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 protocol=\
- udp
- add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
- add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
- add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
- add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
- add action=drop chain=input comment="defconf: drop invalid" connection-state=\
- invalid
- add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
- add action=drop chain=input comment="defconf: drop all not coming from LAN" \
- in-interface-list=!LAN
- add action=accept chain=forward comment="defconf: accept in ipsec policy" \
- ipsec-policy=in,ipsec
- add action=accept chain=forward comment="defconf: accept out ipsec policy" \
- ipsec-policy=out,ipsec
- add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
- connection-state=established,related
- add action=accept chain=forward comment=\
- "defconf: accept established,related, untracked" connection-state=\
- established,related,untracked
- add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
- invalid
- add action=drop chain=forward comment=\
- "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
- connection-state=new in-interface-list=WAN
- /ip firewall nat
- add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
- out,none out-interface-list=WAN
- add action=masquerade chain=srcnat comment="masq. vpn traffic" src-address=\
- 192.168.89.0/24
- [admin@MikroTik] /ip firewall>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement