API tools faq
paste
Advertisement
mfr3108

Setting Mikrotik 20 Mbps Anti Ngelag Mantap

mfr3108
Sep 20th, 2019
2,172
0
Never
1
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 77.38 KB | None | 0 0
raw download clone embed print report
  1. # sep/21/2019 05:52:49 by RouterOS 6.45.6
  2. # software id = XXXX-XXXX
  3. #
  4. #
  5. # Perhatian Sebelum Copas perhatikan baik2 dahulu Topologinya
  6. # " xxx " perlu disesuaikan
  7.  
  8. /interface bridge
  9. add arp=reply-only name=bridge-AP
  10. /interface ethernet
  11. set [ find default-name=ether1 ] comment="Connected to Modem" name=\
  12. ether1-Modem
  13. set [ find default-name=ether2 ] arp=disabled comment="Connected to Hotspot" \
  14. name=ether2-Lan
  15. /interface list
  16. add name=MODEM
  17. add name=LAN
  18. /ip hotspot profile
  19. set [ find default=yes ] dns-name=xxx.hotspot html-directory=\
  20. "xxx Hotspot" http-cookie-lifetime=6h
  21. add dns-name=xxx.hotspot html-directory="xxx Hotspot" \
  22. http-cookie-lifetime=6h name=hsprof1 use-radius=yes
  23. /ip pool
  24. add name=dhcp_pool0 ranges=192.168.88.21-192.168.88.254
  25. /ip dhcp-server
  26. add add-arp=yes address-pool=dhcp_pool0 disabled=no interface=bridge-AP name=\
  27. dhcp1
  28. /ip hotspot
  29. add address-pool=dhcp_pool0 addresses-per-mac=1 disabled=no interface=\
  30. bridge-AP name=hotspot1 profile=hsprof1
  31. /queue type
  32. add kind=pcq name=pcq-upload-bigger pcq-classifier=src-address
  33. add kind=pcq name=pcq-download-bigger pcq-classifier=dst-address
  34. /queue interface
  35. set ether1-Modem queue=ethernet-default
  36. set ether2-Lan queue=ethernet-default
  37. /queue simple
  38. add comment="Indihome 20Mbps ( Kecepatan berbeda settingan disesuaikan aja )" \
  39. limit-at=4M/20M max-limit=4M/20M name=MAX-SPEED priority=1/1 queue=\
  40. default-small/default target=bridge-AP total-queue=default
  41. add comment="Browsing Connection" limit-at=1M/2M max-limit=2M/15M name=\
  42. Max-Bigger packet-marks=Bigger parent=MAX-SPEED priority=2/2 queue=\
  43. pcq-upload-bigger/pcq-download-bigger target=bridge-AP
  44. add limit-at=256k/512k max-limit=512k/2M name=Zzz-Bigger parent=Max-Bigger \
  45. target=bridge-AP
  46. add comment="Game Connection" limit-at=2M/5M max-limit=4M/20M name=\
  47. Max-Default parent=MAX-SPEED priority=1/1 queue=\
  48. pcq-upload-default/pcq-download-default target=bridge-AP
  49. add limit-at=256k/512k max-limit=512k/2M name=Zzz-Default parent=Max-Default \
  50. target=bridge-AP
  51. add limit-at=256k/512k max-limit=512k/2M name=ZZZ-SPEED parent=MAX-SPEED \
  52. queue=default-small/hotspot-default target=bridge-AP
  53. /ip hotspot user profile
  54. set [ find default=yes ] idle-timeout=1h5m insert-queue-before=Zzz-Default \
  55. keepalive-timeout=5m mac-cookie-timeout=6h on-login=\
  56. ":put (\",,0,,,noexp,Disable,\")" parent-queue=Max-Default queue-type=\
  57. default-small rate-limit=512k/2M shared-users=10 transparent-proxy=yes
  58. add idle-timeout=1h5m insert-queue-before=Zzz-Default keepalive-timeout=5m \
  59. mac-cookie-timeout=6h name=trial on-login=\
  60. ":put (\",,0,,,noexp,Disable,\")" parent-queue=Max-Default queue-type=\
  61. default-small rate-limit=512k/2M shared-users=10 transparent-proxy=yes
  62. add idle-timeout=1h5m insert-queue-before=Zzz-Default keepalive-timeout=5m \
  63. mac-cookie-timeout=6h name=Harian on-login=":put (\",remc,2000,24h,0,,Disa\
  64. ble,\"); {:local date [ /system clock get date ];:local year [ :pick \$dat\
  65. e 7 11 ];:local month [ :pick \$date 0 3 ];:local comment [ /ip hotspot us\
  66. er get [/ip hotspot user find where name=\"\$user\"] comment]; :local ucod\
  67. e [:pic \$comment 0 2]; :if (\$ucode = \"vc\" or \$ucode = \"up\" or \$com\
  68. ment = \"\") do={ /sys sch add name=\"\$user\" disable=no start-date=\$dat\
  69. e interval=\"24h\"; :delay 2s; :local exp [ /sys sch get [ /sys sch find w\
  70. here name=\"\$user\" ] next-run]; :local getxp [len \$exp]; :if (\$getxp =\
  71. \_15) do={ :local d [:pic \$exp 0 6]; :local t [:pic \$exp 7 16]; :local s\
  72. \_(\"/\"); :local exp (\"\$d\$s\$year \$t\"); /ip hotspot user set comment\
  73. =\$exp [find where name=\"\$user\"];}; :if (\$getxp = 8) do={ /ip hotspot \
  74. user set comment=\"\$date \$exp\" [find where name=\"\$user\"];}; :if (\$g\
  75. etxp > 15) do={ /ip hotspot user set comment=\$exp [find where name=\"\$us\
  76. er\"];}; /sys sch remove [find where name=\"\$user\"]; :local mac \$\"mac-\
  77. address\"; :local time [/system clock get time ]; /system script add name=\
  78. \"\$date-|-\$time-|-\$user-|-2000-|-\$address-|-\$mac-|-24h-|-Harian-|-\$c\
  79. omment\" owner=\"\$month\$year\" source=\$date comment=mikhmon}}" \
  80. parent-queue=Max-Default queue-type=default-small rate-limit=512k/2m \
  81. transparent-proxy=yes
  82. add idle-timeout=1h5m insert-queue-before=Zzz-Default keepalive-timeout=5m \
  83. mac-cookie-timeout=6h name=Mingguan on-login=":put (\",remc,10000,7d,0,,Di\
  84. sable,\"); {:local date [ /system clock get date ];:local year [ :pick \$d\
  85. ate 7 11 ];:local month [ :pick \$date 0 3 ];:local comment [ /ip hotspot \
  86. user get [/ip hotspot user find where name=\"\$user\"] comment]; :local uc\
  87. ode [:pic \$comment 0 2]; :if (\$ucode = \"vc\" or \$ucode = \"up\" or \$c\
  88. omment = \"\") do={ /sys sch add name=\"\$user\" disable=no start-date=\$d\
  89. ate interval=\"7d\"; :delay 2s; :local exp [ /sys sch get [ /sys sch find \
  90. where name=\"\$user\" ] next-run]; :local getxp [len \$exp]; :if (\$getxp \
  91. = 15) do={ :local d [:pic \$exp 0 6]; :local t [:pic \$exp 7 16]; :local s\
  92. \_(\"/\"); :local exp (\"\$d\$s\$year \$t\"); /ip hotspot user set comment\
  93. =\$exp [find where name=\"\$user\"];}; :if (\$getxp = 8) do={ /ip hotspot \
  94. user set comment=\"\$date \$exp\" [find where name=\"\$user\"];}; :if (\$g\
  95. etxp > 15) do={ /ip hotspot user set comment=\$exp [find where name=\"\$us\
  96. er\"];}; /sys sch remove [find where name=\"\$user\"]; :local mac \$\"mac-\
  97. address\"; :local time [/system clock get time ]; /system script add name=\
  98. \"\$date-|-\$time-|-\$user-|-10000-|-\$address-|-\$mac-|-7d-|-Mingguan-|-\
  99. \$comment\" owner=\"\$month\$year\" source=\$date comment=mikhmon}}" \
  100. parent-queue=Max-Default queue-type=default-small rate-limit=512k/2m \
  101. transparent-proxy=yes
  102. add idle-timeout=1h5m insert-queue-before=Zzz-Default keepalive-timeout=5m \
  103. mac-cookie-timeout=6h name=Bulanan on-login=":put (\",remc,35000,30d,0,,Di\
  104. sable,\"); {:local date [ /system clock get date ];:local year [ :pick \$d\
  105. ate 7 11 ];:local month [ :pick \$date 0 3 ];:local comment [ /ip hotspot \
  106. user get [/ip hotspot user find where name=\"\$user\"] comment]; :local uc\
  107. ode [:pic \$comment 0 2]; :if (\$ucode = \"vc\" or \$ucode = \"up\" or \$c\
  108. omment = \"\") do={ /sys sch add name=\"\$user\" disable=no start-date=\$d\
  109. ate interval=\"30d\"; :delay 2s; :local exp [ /sys sch get [ /sys sch find\
  110. \_where name=\"\$user\" ] next-run]; :local getxp [len \$exp]; :if (\$getx\
  111. p = 15) do={ :local d [:pic \$exp 0 6]; :local t [:pic \$exp 7 16]; :local\
  112. \_s (\"/\"); :local exp (\"\$d\$s\$year \$t\"); /ip hotspot user set comme\
  113. nt=\$exp [find where name=\"\$user\"];}; :if (\$getxp = 8) do={ /ip hotspo\
  114. t user set comment=\"\$date \$exp\" [find where name=\"\$user\"];}; :if (\
  115. \$getxp > 15) do={ /ip hotspot user set comment=\$exp [find where name=\"\
  116. \$user\"];}; /sys sch remove [find where name=\"\$user\"]; :local mac \$\"\
  117. mac-address\"; :local time [/system clock get time ]; /system script add n\
  118. ame=\"\$date-|-\$time-|-\$user-|-35000-|-\$address-|-\$mac-|-30d-|-Bulanan\
  119. -|-\$comment\" owner=\"\$month\$year\" source=\$date comment=mikhmon}}" \
  120. parent-queue=Max-Default queue-type=default-small rate-limit=512k/2m \
  121. transparent-proxy=yes
  122. /system logging action
  123. set 0 memory-lines=1
  124. /tool user-manager customer
  125. set admin access=\
  126. own-routers,own-users,own-profiles,own-limits,config-payment-gw
  127. /interface bridge port
  128. add bridge=bridge-AP interface=ether2-Lan
  129. /ip firewall connection tracking
  130. set enabled=yes
  131. /ip neighbor discovery-settings
  132. set discover-interface-list=none
  133. /interface list member
  134. add interface=ether1-Modem list=MODEM
  135. add interface=bridge-AP list=LAN
  136. /ip address
  137. add address=192.168.1.2/24 comment="Connected to Modem" interface=\
  138. ether1-Modem network=192.168.1.0
  139. add address=192.168.88.1/24 comment="Connected to Hotspot" interface=\
  140. bridge-AP network=192.168.88.0
  141. /ip arp
  142. add address=192.168.88.6 comment=AP interface=bridge-AP mac-address=\
  143. B0:4E:26:E1:6C:66
  144. /ip cloud
  145. set update-time=no
  146. /ip dhcp-server network
  147. add address=192.168.88.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.88.1 \
  148. netmask=32
  149. /ip dns
  150. set servers=8.8.8.8,8.8.4.4
  151. /ip firewall address-list
  152. add address=0.0.0.0/8 list=private-lokal
  153. add address=10.0.0.0/8 list=private-lokal
  154. add address=100.64.0.0/10 list=private-lokal
  155. add address=127.0.0.0/8 list=private-lokal
  156. add address=169.254.0.0/16 list=private-lokal
  157. add address=172.16.0.0/12 list=private-lokal
  158. add address=192.0.0.0/24 list=private-lokal
  159. add address=192.0.2.0/24 list=private-lokal
  160. add address=192.168.0.0/16 list=private-lokal
  161. add address=198.18.0.0/15 list=private-lokal
  162. add address=198.51.100.0/24 list=private-lokal
  163. add address=203.0.113.0/24 list=private-lokal
  164. add address=224.0.0.0/3 list=private-lokal
  165. add address=118.98.0.0/17 list=ggc-telkom
  166. add address=118.97.0.0/16 list=ggc-telkom
  167. add address=www.arcai.com list=netcut
  168. /ip firewall filter
  169. add action=accept chain=input comment="allow IPsec NAT" dst-port=4500 \
  170. protocol=udp
  171. add action=accept chain=input comment="allow IKE" dst-port=500 protocol=udp
  172. add action=accept chain=input comment="allow l2tp" dst-port=1701 protocol=udp
  173. add action=accept chain=input comment="allow pptp" dst-port=1723 protocol=tcp
  174. add action=accept chain=input comment="allow sstp" dst-port=443 protocol=tcp
  175. add action=drop chain=forward comment="Blok Akses Masuk Ke Modem" disabled=\
  176. yes dst-address=192.168.1.1 dst-port=80 protocol=tcp
  177. add action=drop chain=forward disabled=yes dst-address=192.168.1.1 protocol=\
  178. icmp
  179. add action=reject chain=input comment="Block Penyebaran Virus Ransomeware" \
  180. dst-port=139,445,3389 protocol=tcp
  181. add action=reject chain=input dst-port=139,445,3389,20004,7533,5678 protocol=\
  182. udp
  183. add action=reject chain=forward dst-port=137,138,445,3389 protocol=tcp
  184. add action=reject chain=forward dst-port=137,138 protocol=udp
  185. add action=reject chain=forward comment="Blocking Windows Update" content=\
  186. update.microsoft.com
  187. add action=reject chain=forward content=download.microsoft.com
  188. add action=reject chain=forward content=download.windowsupdate.com
  189. add action=reject chain=forward content=windowsupdate.com
  190. add action=reject chain=forward content=wustat.windows.com
  191. add action=reject chain=forward content=ntservicepack.microsoft.com
  192. add action=reject chain=forward content=stats.microsoft.com
  193. add action=reject chain=forward content=wustat.windows.com
  194. add action=reject chain=forward content=windowsupdate.microsoft.com
  195. add action=drop chain=forward comment="TORRENT No 2: block outgoing DHT" \
  196. content=d1:ad2:id20: dst-port=1025-65535 packet-size=95-190 protocol=udp
  197. add action=drop chain=forward comment=\
  198. "TORRENT No 3: block outgoing TCP announce" content="info_hash=" \
  199. dst-port=2710,80,443,6969,1337,6961,5944,1096,8080,8089 protocol=tcp
  200. add action=drop chain=forward comment=\
  201. "TORRENT No 4: prohibits download .torrent files. " content=\
  202. "\r\
  203. \nContent-Type: application/x-bittorrent" protocol=tcp src-port=80
  204. add action=drop chain=forward comment=\
  205. "TORRENT No 5: 6771 block LOCAL Broadcast" content="\r\
  206. \nInfohash:" dst-port=6771 protocol=udp
  207. add action=drop chain=forward comment="Blocking Microsoft Spying" \
  208. src-address-list=TelemetrySpy
  209. add action=drop chain=input comment="Drop Invalid connections" \
  210. connection-state=invalid
  211. add action=add-src-to-address-list address-list="port scanners" \
  212. address-list-timeout=2w chain=input comment="Port scanners to list " \
  213. protocol=tcp psd=21,3s,3,1
  214. add action=add-src-to-address-list address-list="port scanners" \
  215. address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
  216. protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
  217. add action=add-src-to-address-list address-list="port scanners" \
  218. address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp \
  219. tcp-flags=fin,syn
  220. add action=add-src-to-address-list address-list="port scanners" \
  221. address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp \
  222. tcp-flags=syn,rst
  223. add action=add-src-to-address-list address-list="port scanners" \
  224. address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=\
  225. tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
  226. add action=add-src-to-address-list address-list="port scanners" \
  227. address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp \
  228. tcp-flags=fin,syn,rst,psh,ack,urg
  229. add action=add-src-to-address-list address-list="port scanners" \
  230. address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp \
  231. tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
  232. add action=drop chain=input comment="Dropping port scanners" \
  233. src-address-list="port scanners"
  234. add action=accept chain=input comment="Allow Established connections" \
  235. connection-state=established
  236. add action=accept chain=input comment="Allow Related connections" \
  237. connection-state=related
  238. add action=drop chain=forward comment="Drop Invalid connections" \
  239. connection-state=invalid
  240. add action=jump chain=forward comment="Bad packets filtering" jump-target=tcp \
  241. protocol=tcp
  242. add action=jump chain=forward jump-target=udp protocol=udp
  243. add action=jump chain=forward jump-target=icmp protocol=icmp
  244. add action=drop chain=tcp comment="deny TFTP" dst-port=69 protocol=tcp
  245. add action=drop chain=tcp comment="deny RPC portmapper" dst-port=111 \
  246. protocol=tcp
  247. add action=drop chain=tcp comment="deny RPC portmapper" dst-port=135 \
  248. protocol=tcp
  249. add action=drop chain=tcp comment="deny NBT" dst-port=137-139 protocol=tcp
  250. add action=drop chain=tcp comment="deny cifs" dst-port=445 protocol=tcp
  251. add action=drop chain=tcp comment="deny NFS" dst-port=2049 protocol=tcp
  252. add action=drop chain=tcp comment="deny NetBus" dst-port=12345-12346 \
  253. protocol=tcp
  254. add action=drop chain=tcp comment="deny NetBus" dst-port=20034 protocol=tcp
  255. add action=drop chain=tcp comment="deny BackOriffice" dst-port=3133 protocol=\
  256. tcp
  257. add action=drop chain=tcp comment="deny DHCP" dst-port=67-68 protocol=tcp
  258. add action=drop chain=udp comment="deny TFTP" dst-port=69 protocol=udp
  259. add action=drop chain=udp comment="deny PRC portmapper" dst-port=111 \
  260. protocol=udp
  261. add action=drop chain=udp comment="deny PRC portmapper" dst-port=135 \
  262. protocol=udp
  263. add action=drop chain=udp comment="deny NBT" dst-port=137-139 protocol=udp
  264. add action=drop chain=udp comment="deny NFS" dst-port=2049 protocol=udp
  265. add action=drop chain=udp comment="deny BackOriffice" dst-port=3133 protocol=\
  266. udp
  267. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=\
  268. 0:0-255 limit=5,5:packet protocol=icmp
  269. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=3:0 \
  270. protocol=icmp
  271. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=3:3 \
  272. limit=5,5:packet protocol=icmp
  273. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=3:4 \
  274. limit=5,5:packet protocol=icmp
  275. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=\
  276. 8:0-255 limit=5,5:packet protocol=icmp
  277. add action=accept chain=icmp comment="limit packets 5/secs" icmp-options=\
  278. 11:0-255 limit=5,5:packet protocol=icmp
  279. add action=drop chain=icmp comment="Drop other icmp packets"
  280. add action=accept chain=forward comment="Allow Established connections" \
  281. connection-state=established
  282. add action=drop chain=forward comment=NetCut src-address-list=NetcutUser
  283. /ip firewall mangle
  284. add action=mark-connection chain=prerouting dst-port=80,8080,443 \
  285. new-connection-mark=Bigger-Connection passthrough=yes protocol=tcp
  286. add action=mark-connection chain=prerouting dst-port=80,8080,443 \
  287. new-connection-mark=Bigger-Connection passthrough=yes protocol=udp
  288. add action=mark-packet chain=prerouting connection-mark=Bigger-Connection \
  289. new-packet-mark=Bigger passthrough=no
  290. add action=add-src-to-address-list address-list=NetcutUser \
  291. address-list-timeout=1h5m chain=prerouting comment="Deteksi Netcut" \
  292. dst-address-list=netcut dst-port=80 protocol=tcp
  293. add action=change-ttl chain=postrouting comment=\
  294. "Membatasi sharing koneksi dengan 'Change TTL'" new-ttl=set:1 \
  295. out-interface=bridge-AP passthrough=no
  296. /ip firewall nat
  297. add action=masquerade chain=srcnat comment="masquerade hotspot network" \
  298. src-address=192.168.88.0/24
  299. add action=redirect chain=dstnat comment="Block DNS Luar" dst-port=53 \
  300. protocol=tcp to-ports=53
  301. add action=redirect chain=dstnat dst-port=53 protocol=udp to-ports=53
  302. /ip firewall raw
  303. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  304. none-dynamic chain=prerouting comment=Vainglory dst-address-list=\
  305. !private-lokal dst-port=7000-8020 protocol=tcp src-address-list=\
  306. private-lokal
  307. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  308. none-dynamic chain=prerouting comment=Vainglory content=.superevil.net \
  309. dst-address-list=!private-lokal src-address-list=private-lokal
  310. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  311. none-dynamic chain=prerouting comment="Mobile Legends" dst-address-list=\
  312. !private-lokal dst-port=30000-30150 protocol=tcp src-address-list=\
  313. private-lokal
  314. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  315. none-dynamic chain=prerouting comment="Mobile Legends" content=\
  316. .youngjoygame.com dst-address-list=!private-lokal src-address-list=\
  317. private-lokal
  318. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  319. none-dynamic chain=prerouting comment="PUBG Mobile" dst-address-list=\
  320. !private-lokal dst-port=10012,17500 protocol=tcp src-address-list=\
  321. private-lokal
  322. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  323. none-dynamic chain=prerouting comment="PUBG Mobile" dst-address-list=\
  324. !private-lokal dst-port="10491,10010,10013,10612,20002,20001,20000,12235,1\
  325. 3748,13972,13894,11455,10096,10039" protocol=udp src-address-list=\
  326. private-lokal
  327. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  328. none-dynamic chain=prerouting comment="PUBG Mobile" content=.igamecj.com \
  329. dst-address-list=!private-lokal src-address-list=private-lokal
  330. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  331. none-dynamic chain=prerouting comment="PUBG Mobile" content=\
  332. tencentgames.helpshift.com dst-address-list=!private-lokal \
  333. src-address-list=private-lokal
  334. add action=add-dst-to-address-list address-list=games address-list-timeout=\
  335. none-dynamic chain=prerouting comment=Garena content=.garenanow.com \
  336. dst-address-list=!private-lokal src-address-list=private-lokal
  337. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  338. none-dynamic chain=prerouting comment=ig content=.cdninstagram.com \
  339. dst-address-list=!private-lokal src-address-list=private-lokal
  340. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  341. none-dynamic chain=prerouting comment=ig content=.instagram.com \
  342. dst-address-list=!private-lokal src-address-list=private-lokal
  343. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  344. none-dynamic chain=prerouting comment=WA content=.whatsapp.net \
  345. dst-address-list=!private-lokal src-address-list=private-lokal
  346. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  347. none-dynamic chain=prerouting comment=WA content=.whatsapp.com \
  348. dst-address-list=!private-lokal src-address-list=private-lokal
  349. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  350. none-dynamic chain=prerouting comment=life360 content=.life360.com \
  351. dst-address-list=!private-lokal src-address-list=private-lokal
  352. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  353. none-dynamic chain=prerouting comment=fb content=.facebook.com \
  354. dst-address-list=!private-lokal src-address-list=private-lokal
  355. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  356. none-dynamic chain=prerouting comment=fb content=.facebook.net \
  357. dst-address-list=!private-lokal src-address-list=private-lokal
  358. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  359. none-dynamic chain=prerouting comment=fb content=.fbcdn.net \
  360. dst-address-list=!private-lokal src-address-list=private-lokal
  361. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  362. none-dynamic chain=prerouting comment=twitter content=.twitter.com \
  363. dst-address-list=!private-lokal src-address-list=private-lokal
  364. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  365. none-dynamic chain=prerouting comment=twitter content=.twimg.com \
  366. dst-address-list=!private-lokal src-address-list=private-lokal
  367. add action=add-dst-to-address-list address-list=sosmed address-list-timeout=\
  368. none-dynamic chain=prerouting comment=tiktok content=.tiktokv.com \
  369. dst-address-list=!private-lokal src-address-list=private-lokal
  370. add action=jump chain=prerouting comment="Jump to handle virus from TCP port" \
  371. jump-target=tcp-virus log=yes protocol=tcp
  372. add action=jump chain=prerouting comment="Jump to handle virus from UDP port" \
  373. jump-target=udp-virus log=yes protocol=udp
  374. add action=drop chain=tcp-virus comment="Socks D Troie, Death" dst-port=1-2 \
  375. log=yes protocol=tcp
  376. add action=drop chain=tcp-virus comment=\
  377. "Agent 31, Hacker's Paradise, Agent 40421" dst-port=30-31 log=yes \
  378. protocol=tcp
  379. add action=drop chain=tcp-virus comment=\
  380. "More than 3 kno log=ye swn worms and trojans use this port" dst-port=37 \
  381. log=yes protocol=tcp
  382. add action=drop chain=tcp-virus comment="Deep Throat Fore play" dst-port=41 \
  383. log=yes protocol=tcp
  384. add action=drop chain=tcp-virus comment=DRAT dst-port=48 log=yes protocol=tcp
  385. add action=drop chain=tcp-virus comment=DRAT dst-port=50 log=yes protocol=tcp
  386. add action=drop chain=tcp-virus comment="DM Setup" dst-port=58-59 log=yes \
  387. protocol=tcp
  388. add action=drop chain=tcp-virus comment=W32.Evala.Worm dst-port=69-70 log=yes \
  389. protocol=tcp
  390. add action=drop chain=tcp-virus comment="CDK, Firehotcker" dst-port=79 log=\
  391. yes protocol=tcp
  392. add action=drop chain=tcp-virus comment="Beagle.S RemoconChubo" dst-port=81 \
  393. log=yes protocol=tcp
  394. add action=drop chain=tcp-virus comment=\
  395. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  396. 85-90 log=yes protocol=tcp
  397. add action=drop chain=tcp-virus comment=\
  398. "Common Port for phishing scam sit, Hiddenport, NCX" dst-port=99 log=yes \
  399. protocol=tcp
  400. add action=drop chain=tcp-virus comment="More than 3 kno log=yes wn worms and \
  401. trojans usethis port , Invisible Identd Deamon, Kazimas" dst-port=113 \
  402. log=yes protocol=tcp
  403. add action=drop chain=tcp-virus comment=Happy99 dst-port=119 log=yes \
  404. protocol=tcp
  405. add action=drop chain=tcp-virus comment=\
  406. "Jammer Killah, Attack Bot, God Msage" dst-port=121 log=yes protocol=tcp
  407. add action=drop chain=tcp-virus comment="Password Generator Protocol" \
  408. dst-port=129 log=yes protocol=tcp
  409. add action=drop chain=tcp-virus comment=Farnaz dst-port=133 log=yes protocol=\
  410. tcp
  411. add action=drop chain=tcp-virus comment=\
  412. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  413. 136-138 log=yes protocol=tcp
  414. add action=drop chain=tcp-virus comment=NetTaxi dst-port=142 log=yes \
  415. protocol=tcp
  416. add action=drop chain=tcp-virus comment="Infector 1.3" dst-port=146 log=yes \
  417. protocol=tcp
  418. add action=drop chain=tcp-virus comment=Backage dst-port=334 log=yes \
  419. protocol=tcp
  420. add action=drop chain=tcp-virus comment=Backage dst-port=411 log=yes \
  421. protocol=tcp
  422. add action=drop chain=tcp-virus comment=\
  423. "W32.kibuv.b, Breach, Incognito, tcp Wrappers" dst-port=420-421 log=yes \
  424. protocol=tcp
  425. add action=drop chain=tcp-virus comment=\
  426. "Fatal Connections - Hacker's Paradise" dst-port=455-456 log=yes \
  427. protocol=tcp
  428. add action=drop chain=tcp-virus comment="Hacker's Paradise" dst-port=456 log=\
  429. yes protocol=tcp
  430. add action=drop chain=tcp-virus comment="Grlogin, RPC backDoor" dst-port=\
  431. 513-514 log=yes protocol=tcp
  432. add action=drop chain=tcp-virus comment=W32.kibuv.worm dst-port=530 log=yes \
  433. protocol=tcp
  434. add action=drop chain=tcp-virus comment="Rasmin, Net666" dst-port=531 log=yes \
  435. protocol=tcp
  436. add action=drop chain=tcp-virus comment=\
  437. "Stealth Spy, Phaze, 7-11 Trojan, Ini-Killer, Phase Zero, Phase-0" \
  438. dst-port=555 log=yes protocol=tcp
  439. add action=drop chain=tcp-virus comment=\
  440. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=559 \
  441. log=yes protocol=tcp
  442. add action=drop chain=tcp-virus comment="Sober worm Variants" dst-port=587 \
  443. log=yes protocol=tcp
  444. add action=drop chain=tcp-virus comment="W.32.Sasser worm" dst-port=593 log=\
  445. yes protocol=tcp
  446. add action=drop chain=tcp-virus comment="Secret Service" dst-port=605 log=yes \
  447. protocol=tcp
  448. add action=drop chain=tcp-virus comment="Attack FTP, Back Construction, BLA Tr\
  449. ojan, no log=yeskno log=yesk, satans" dst-port=666 log=yes protocol=tcp
  450. add action=drop chain=tcp-virus comment=SnipperNet dst-port=667 log=yes \
  451. protocol=tcp
  452. add action=drop chain=tcp-virus comment="Dp Trojan" dst-port=669 log=yes \
  453. protocol=tcp
  454. add action=drop chain=tcp-virus comment=GayOL dst-port=692 log=yes protocol=\
  455. tcp
  456. add action=drop chain=tcp-virus comment="BackDoor.Netcrack.B - AimSpy" \
  457. dst-port=777-778 log=yes protocol=tcp
  458. add action=drop chain=tcp-virus comment=WinHole dst-port=808 log=yes \
  459. protocol=tcp
  460. add action=drop chain=tcp-virus comment="Common Port for phishing scam sit" \
  461. dst-port=880 log=yes protocol=tcp
  462. add action=drop chain=tcp-virus comment=Backdoor.Devil dst-port=901-902 log=\
  463. yes protocol=tcp
  464. add action=drop chain=tcp-virus comment="Dark Shadow" dst-port=911 log=yes \
  465. protocol=tcp
  466. add action=drop chain=tcp-virus comment=\
  467. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  468. 999-1001 log=yes protocol=tcp
  469. add action=drop chain=tcp-virus comment="Doly Trojan" dst-port=1011-1016 log=\
  470. yes protocol=tcp
  471. add action=drop chain=tcp-virus comment=Backdoor.lingosky dst-port=1024-1025 \
  472. log=yes protocol=tcp
  473. add action=drop chain=tcp-virus comment="NetSpy, Multidropper" dst-port=\
  474. 1033-1035 log=yes protocol=tcp
  475. add action=drop chain=tcp-virus comment=Rasmin dst-port=1045 log=yes \
  476. protocol=tcp
  477. add action=drop chain=tcp-virus comment="/sbin/initd - MiniCommand" dst-port=\
  478. 1049-1050 log=yes protocol=tcp
  479. add action=drop chain=tcp-virus comment="The Thief, AckCmd" dst-port=\
  480. 1053-1054 log=yes protocol=tcp
  481. add action=drop chain=tcp-virus comment="Backdoor.Zagaban, WinHole" dst-port=\
  482. 1080-1083 log=yes protocol=tcp
  483. add action=drop chain=tcp-virus comment=Xtreme dst-port=1090 log=yes \
  484. protocol=tcp
  485. add action=drop chain=tcp-virus comment=\
  486. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  487. 1111 log=yes protocol=tcp
  488. add action=drop chain=tcp-virus comment=Orion dst-port=1150-1151 log=yes \
  489. protocol=tcp
  490. add action=drop chain=tcp-virus comment="Psyber Stream Server" dst-port=1170 \
  491. log=yes protocol=tcp
  492. add action=drop chain=tcp-virus comment=SoftWAR,Infector dst-port=1207-1208 \
  493. log=yes protocol=tcp
  494. add action=drop chain=tcp-virus comment=Kaos dst-port=1212 log=yes protocol=\
  495. tcp
  496. add action=drop chain=tcp-virus comment=Backdoor.Sazo dst-port=1218 log=yes \
  497. protocol=tcp
  498. add action=drop chain=tcp-virus comment=\
  499. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  500. 1234 log=yes protocol=tcp
  501. add action=drop chain=tcp-virus comment="VooDoo Doll" dst-port=1245 log=yes \
  502. protocol=tcp
  503. add action=drop chain=tcp-virus comment="Scarab, Project next" dst-port=\
  504. 1255-1256 log=yes protocol=tcp
  505. add action=drop chain=tcp-virus comment="Maverick's Matrix" dst-port=1269 \
  506. log=yes protocol=tcp
  507. add action=drop chain=tcp-virus comment="The Matrix" dst-port=1272 log=yes \
  508. protocol=tcp
  509. add action=drop chain=tcp-virus comment=NETrojan dst-port=1313 log=yes \
  510. protocol=tcp
  511. add action=drop chain=tcp-virus comment="Millenium Worm" dst-port=1338 log=\
  512. yes protocol=tcp
  513. add action=drop chain=tcp-virus comment="Bo dll" dst-port=1349 log=yes \
  514. protocol=tcp
  515. add action=drop chain=tcp-virus comment="GoFriller, Backdoor G-1" dst-port=\
  516. 1394 log=yes protocol=tcp
  517. add action=drop chain=tcp-virus comment="remote Storm" dst-port=1441 log=yes \
  518. protocol=tcp
  519. add action=drop chain=tcp-virus comment=FTP99CMP dst-port=1492 log=yes \
  520. protocol=tcp
  521. add action=drop chain=tcp-virus comment="FunkProxy " dst-port=1505 log=yes \
  522. protocol=tcp
  523. add action=drop chain=tcp-virus comment="Psyber Streaming server" dst-port=\
  524. 1509 log=yes protocol=tcp
  525. add action=drop chain=tcp-virus comment="Remote Hack" dst-port=1568 log=yes \
  526. protocol=tcp
  527. add action=drop chain=tcp-virus comment="Backdoor.Miffice, Bize.Worm" \
  528. dst-port=1533-1534 log=yes protocol=tcp
  529. add action=drop chain=tcp-virus comment="Shivka-Burka, Direct Connection" \
  530. dst-port=1600 log=yes protocol=tcp
  531. add action=drop chain=tcp-virus comment="ICA Browser" dst-port=1604 log=yes \
  532. protocol=tcp
  533. add action=drop chain=tcp-virus comment=Exploiter dst-port=1703 log=yes \
  534. protocol=tcp
  535. add action=drop chain=tcp-virus comment=Scarab dst-port=1777 log=yes \
  536. protocol=tcp
  537. add action=drop chain=tcp-virus comment=Loxbot.d dst-port=1751 log=yes \
  538. protocol=tcp
  539. add action=drop chain=tcp-virus comment=Backdoor.NetControle dst-port=1772 \
  540. log=yes protocol=tcp
  541. add action=drop chain=tcp-virus comment=SpySender dst-port=1807 log=yes \
  542. protocol=tcp
  543. add action=drop chain=tcp-virus comment=\
  544. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  545. 1863 log=yes protocol=tcp
  546. add action=drop chain=tcp-virus comment="Fake FTP. WM FTP Server" dst-port=\
  547. 1966-1967 log=yes protocol=tcp
  548. add action=drop chain=tcp-virus comment="Shockrave, Bowl" dst-port=1981 log=\
  549. yes protocol=tcp
  550. add action=drop chain=tcp-virus comment="OpC BO" dst-port=1969 log=yes \
  551. protocol=tcp
  552. add action=drop chain=tcp-virus comment=\
  553. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  554. 1999-2005 log=yes protocol=tcp
  555. add action=drop chain=tcp-virus comment=Ripper dst-port=2023 log=yes \
  556. protocol=tcp
  557. add action=drop chain=tcp-virus comment=W32.korgo.a dst-port=2041 log=yes \
  558. protocol=tcp
  559. add action=drop chain=tcp-virus comment="Backdoor.TJServ - WinHole" dst-port=\
  560. 2080 log=yes protocol=tcp
  561. add action=drop chain=tcp-virus comment=Backdoor.Expjan dst-port=2090 log=yes \
  562. protocol=tcp
  563. add action=drop chain=tcp-virus comment=Bugs dst-port=2115 log=yes protocol=\
  564. tcp
  565. add action=drop chain=tcp-virus comment="Deep Throat" dst-port=2140 log=yes \
  566. protocol=tcp
  567. add action=drop chain=tcp-virus comment="Illusion Mailer" dst-port=2155 log=\
  568. yes protocol=tcp
  569. add action=drop chain=tcp-virus comment=Nirvana dst-port=2255 log=yes \
  570. protocol=tcp
  571. add action=drop chain=tcp-virus comment="Hvl RAT, Dumaru" dst-port=2283 log=\
  572. yes protocol=tcp
  573. add action=drop chain=tcp-virus comment=Xplorer dst-port=2300 log=yes \
  574. protocol=tcp
  575. add action=drop chain=tcp-virus comment="Studio 54" dst-port=2311 log=yes \
  576. protocol=tcp
  577. add action=drop chain=tcp-virus comment=backdoor.shellbot dst-port=2322 log=\
  578. yes protocol=tcp
  579. add action=drop chain=tcp-virus comment=\
  580. "backdoor.shellbot, Eyeveg.worm.c, contact" dst-port=2330-2339 log=yes \
  581. protocol=tcp
  582. add action=drop chain=tcp-virus comment=vbs.shania dst-port=2414 log=yes \
  583. protocol=tcp
  584. add action=drop chain=tcp-virus comment=Beagle.N dst-port=2556 log=yes \
  585. protocol=tcp
  586. add action=drop chain=tcp-virus comment=Striker dst-port=2565 log=yes \
  587. protocol=tcp
  588. add action=drop chain=tcp-virus comment=WinCrash dst-port=2583 log=yes \
  589. protocol=tcp
  590. add action=drop chain=tcp-virus comment="The Prayer 1.2 -1.3" dst-port=2716 \
  591. log=yes protocol=tcp
  592. add action=drop chain=tcp-virus comment="Phase Zero" dst-port=2721 log=yes \
  593. protocol=tcp
  594. add action=drop chain=tcp-virus comment=Beagle.J dst-port=2745 log=yes \
  595. protocol=tcp
  596. add action=drop chain=tcp-virus comment=W32.hllw.deadhat.b dst-port=2766 log=\
  597. yes protocol=tcp
  598. add action=drop chain=tcp-virus comment=SubSeven dst-port=2773-2774 log=yes \
  599. protocol=tcp
  600. add action=drop chain=tcp-virus comment="Phineas Phucker" dst-port=2801 log=\
  601. yes protocol=tcp
  602. add action=drop chain=tcp-virus comment=Backdoor.Brador.A dst-port=2989 log=\
  603. yes protocol=tcp
  604. add action=drop chain=tcp-virus comment="Remote Shut" dst-port=3000 log=yes \
  605. protocol=tcp
  606. add action=drop chain=tcp-virus comment=WinCrash dst-port=3024 log=yes \
  607. protocol=tcp
  608. add action=drop chain=tcp-virus comment=Backdoor.Wortbot dst-port=3028 log=\
  609. yes protocol=tcp
  610. add action=drop chain=tcp-virus comment="W32.Mytob.cz@mm, MicroSpy" dst-port=\
  611. 3030-3031 log=yes protocol=tcp
  612. add action=drop chain=tcp-virus comment=W32.korgo.a dst-port=3067 log=yes \
  613. protocol=tcp
  614. add action=drop chain=tcp-virus comment=\
  615. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  616. 3127-3198 log=yes protocol=tcp
  617. add action=drop chain=tcp-virus comment=W32.HLLW.Dax dst-port=3256 log=yes \
  618. protocol=tcp
  619. add action=drop chain=tcp-virus comment=\
  620. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  621. 3332 log=yes protocol=tcp
  622. add action=drop chain=tcp-virus comment=w32.Mytob.kp@MM dst-port=3385 log=yes \
  623. protocol=tcp
  624. add action=drop chain=tcp-virus comment=W32.mockbot.a.worm dst-port=3410 log=\
  625. yes protocol=tcp
  626. add action=drop chain=tcp-virus comment="Backdoor.Fearic, Terror Trojan" \
  627. dst-port=3456 log=yes protocol=tcp
  628. add action=drop chain=tcp-virus comment="Eclipse 2000" dst-port=3459 log=yes \
  629. protocol=tcp
  630. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=3547 log=\
  631. yes protocol=tcp
  632. add action=drop chain=tcp-virus comment="Portal of Doom" dst-port=3700 log=\
  633. yes protocol=tcp
  634. add action=drop chain=tcp-virus comment=Backdoor.helios dst-port=3737 log=yes \
  635. protocol=tcp
  636. add action=drop chain=tcp-virus comment=PsychWard dst-port=3777 log=yes \
  637. protocol=tcp
  638. add action=drop chain=tcp-virus comment=Eclypse dst-port=3791 log=yes \
  639. protocol=tcp
  640. add action=drop chain=tcp-virus comment=Eclypse dst-port=3801 log=yes \
  641. protocol=tcp
  642. add action=drop chain=tcp-virus comment=SkyDance,Backdoor.OptixPro.13.C \
  643. dst-port=4000-4001 log=yes protocol=tcp
  644. add action=drop chain=tcp-virus comment=WinCrash dst-port=4092 log=yes \
  645. protocol=tcp
  646. add action=drop chain=tcp-virus comment=Backdoor.rcserv dst-port=4128 log=yes \
  647. protocol=tcp
  648. add action=drop chain=tcp-virus comment=\
  649. "Backdoor.Nemog.D - Virtual Hacking Machine" dst-port=4242 log=yes \
  650. protocol=tcp
  651. add action=drop chain=tcp-virus comment=Backdoor.smokodoor dst-port=4300 log=\
  652. yes protocol=tcp
  653. add action=drop chain=tcp-virus comment=BoBo dst-port=4321 log=yes protocol=\
  654. tcp
  655. add action=drop chain=tcp-virus comment=Phatbot dst-port=4387 log=yes \
  656. protocol=tcp
  657. add action=drop chain=tcp-virus comment=\
  658. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  659. 4444 log=yes protocol=tcp
  660. add action=drop chain=tcp-virus comment=W32.mytob.db dst-port=4512 log=yes \
  661. protocol=tcp
  662. add action=drop chain=tcp-virus comment="File Nail" dst-port=4567 log=yes \
  663. protocol=tcp
  664. add action=drop chain=tcp-virus comment="ICQ Trojan" dst-port=4590 log=yes \
  665. protocol=tcp
  666. add action=drop chain=tcp-virus comment=Backdoor.Nemog.D dst-port=4646 log=\
  667. yes protocol=tcp
  668. add action=drop chain=tcp-virus comment=Backdoor.Nemog.D dst-port=4661 log=\
  669. yes protocol=tcp
  670. add action=drop chain=tcp-virus comment=Beagle.U dst-port=4751 log=yes \
  671. protocol=tcp
  672. add action=drop chain=tcp-virus comment=Backdoor.tuxder dst-port=4820 log=yes \
  673. protocol=tcp
  674. add action=drop chain=tcp-virus comment=W32.Opanki dst-port=4888 log=yes \
  675. protocol=tcp
  676. add action=drop chain=tcp-virus comment=W32.RaHack dst-port=4899 log=yes \
  677. protocol=tcp
  678. add action=drop chain=tcp-virus comment="Common Port for phishing scam sit" \
  679. dst-port=4903 log=yes protocol=tcp
  680. add action=drop chain=tcp-virus comment="ICQ Trogen" dst-port=4950 log=yes \
  681. protocol=tcp
  682. add action=drop chain=tcp-virus comment="Sokets de Trois v1./Bubbel, cd00r" \
  683. dst-port=5000-5002 log=yes protocol=tcp
  684. add action=drop chain=tcp-virus comment=Solo,Ootlt dst-port=5010-5011 log=yes \
  685. protocol=tcp
  686. add action=drop chain=tcp-virus comment="WM Remote Keylogger" dst-port=5025 \
  687. log=yes protocol=tcp
  688. add action=drop chain=tcp-virus comment="Net Metropolitan 1.0" dst-port=\
  689. 5031-5032 log=yes protocol=tcp
  690. add action=drop chain=tcp-virus comment=Backdoor.laphex.client dst-port=5152 \
  691. log=yes protocol=tcp
  692. add action=drop chain=tcp-virus comment=\
  693. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  694. 5190 log=yes protocol=tcp
  695. add action=drop chain=tcp-virus comment=Firehotcker dst-port=5321 log=yes \
  696. protocol=tcp
  697. add action=drop chain=tcp-virus comment=Baackage,NetDemon dst-port=5333 log=\
  698. yes protocol=tcp
  699. add action=drop chain=tcp-virus comment="WC Remote Administration Tool" \
  700. dst-port=5343 log=yes protocol=tcp
  701. add action=drop chain=tcp-virus comment="Blade Runner" dst-port=5400-5402 \
  702. log=yes protocol=tcp
  703. add action=drop chain=tcp-virus comment=\
  704. "Backdoor.DarkSky.B, Backconstruction" dst-port=5418-5419 log=yes \
  705. protocol=tcp
  706. add action=drop chain=tcp-virus comment="Xtcp, Illusion Mailer" dst-port=5512 \
  707. log=yes protocol=tcp
  708. add action=drop chain=tcp-virus comment="The Flu" dst-port=5534 log=yes \
  709. protocol=tcp
  710. add action=drop chain=tcp-virus comment=\
  711. "More than 3 kno log=yes wn worms and trojans use this port " dst-port=\
  712. 5550-5558 log=yes protocol=tcp
  713. add action=drop chain=tcp-virus comment=Robo-Hack dst-port=5569 log=yes \
  714. protocol=tcp
  715. add action=drop chain=tcp-virus comment=Backdoor.EasyServ dst-port=5588 log=\
  716. yes protocol=tcp
  717. add action=drop chain=tcp-virus comment="PC Crasher" dst-port=5637-5638 log=\
  718. yes protocol=tcp
  719. add action=drop chain=tcp-virus comment=WinCrash dst-port=5714 log=yes \
  720. protocol=tcp
  721. add action=drop chain=tcp-virus comment=WinCrash dst-port=5741-5742 log=yes \
  722. protocol=tcp
  723. add action=drop chain=tcp-virus comment="Portmap Remote Root Linux Exploit" \
  724. dst-port=5760 log=yes protocol=tcp
  725. add action=drop chain=tcp-virus comment=Backdoor.Evivinc dst-port=5800 log=\
  726. yes protocol=tcp
  727. add action=drop chain=tcp-virus comment="Y3K RAT" dst-port=5880 log=yes \
  728. protocol=tcp
  729. add action=drop chain=tcp-virus comment="Y3K RAT" dst-port=5882 log=yes \
  730. protocol=tcp
  731. add action=drop chain=tcp-virus comment="Y3K RAT" dst-port=5888-5889 log=yes \
  732. protocol=tcp
  733. add action=drop chain=tcp-virus comment=LovGate.ak dst-port=6000 log=yes \
  734. protocol=tcp
  735. add action=drop chain=tcp-virus comment="Bad Blood" dst-port=6006 log=yes \
  736. protocol=tcp
  737. add action=drop chain=tcp-virus comment=W32.mockbot.a.worm dst-port=6129 log=\
  738. yes protocol=tcp
  739. add action=drop chain=tcp-virus comment="Common Port for phishing scam sit" \
  740. dst-port=6180 log=yes protocol=tcp
  741. add action=drop chain=tcp-virus comment=Trojan.Tilser dst-port=6187 log=yes \
  742. protocol=tcp
  743. add action=drop chain=tcp-virus comment="Secret Service" dst-port=6272 log=\
  744. yes protocol=tcp
  745. add action=drop chain=tcp-virus comment="The Thing" dst-port=6400 log=yes \
  746. protocol=tcp
  747. add action=drop chain=tcp-virus comment=Backdoor.Nemog.D dst-port=6565 log=\
  748. yes protocol=tcp
  749. add action=drop chain=tcp-virus comment=backdoor.sdbot.ag dst-port=6631 log=\
  750. yes protocol=tcp
  751. add action=drop chain=tcp-virus comment="TEMan, Weia-Meia" dst-port=6661 log=\
  752. yes protocol=tcp
  753. add action=drop chain=tcp-virus comment=\
  754. "Netbus Worm, winSATAN, Dark FTP, Schedule Agent" dst-port=6666-6667 log=\
  755. yes protocol=tcp
  756. add action=drop chain=tcp-virus comment="Vampyre, Deep Throat" dst-port=\
  757. 6669-6671 log=yes protocol=tcp
  758. add action=drop chain=tcp-virus comment="Sub Seven, Backdoor.G" dst-port=\
  759. 6711-6713 log=yes protocol=tcp
  760. add action=drop chain=tcp-virus comment="Mstream attack-handler" dst-port=\
  761. 6723 log=yes protocol=tcp
  762. add action=drop chain=tcp-virus comment="Deep Throat" dst-port=6771 log=yes \
  763. protocol=tcp
  764. add action=drop chain=tcp-virus comment="Sub Seven, Backdoor.G, W32/Bagle@MM" \
  765. dst-port=6776-6777 log=yes protocol=tcp
  766. add action=drop chain=tcp-virus comment=NetSky.U dst-port=6789 log=yes \
  767. protocol=tcp
  768. add action=drop chain=tcp-virus comment="Delta source DarkStar" dst-port=6883 \
  769. log=yes protocol=tcp
  770. add action=drop chain=tcp-virus comment="Shxt Heap " dst-port=6912 log=yes \
  771. protocol=tcp
  772. add action=drop chain=tcp-virus comment=Indoctrination dst-port=6939 log=yes \
  773. protocol=tcp
  774. add action=drop chain=tcp-virus comment=\
  775. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  776. 6969 log=yes protocol=tcp
  777. add action=drop chain=tcp-virus comment="Gate Crasher" dst-port=6970 log=yes \
  778. protocol=tcp
  779. add action=drop chain=tcp-virus comment="w32.mytob.mx@mm, Remote Grab, explo i\
  780. t translation server, kazimas, remote grab" dst-port=7000-7001 log=yes \
  781. protocol=tcp
  782. add action=drop chain=tcp-virus comment="Unkno log=yes wn Trojan" dst-port=\
  783. 7028 log=yes protocol=tcp
  784. add action=drop chain=tcp-virus comment=W32.Spybot.ycl dst-port=7043 log=yes \
  785. protocol=tcp
  786. add action=drop chain=tcp-virus comment=SubSeven dst-port=7215 log=yes \
  787. protocol=tcp
  788. add action=drop chain=tcp-virus comment="Net Monitor" dst-port=7300-7308 log=\
  789. yes protocol=tcp
  790. add action=drop chain=tcp-virus comment=Backdoor.netshadow dst-port=7329 log=\
  791. yes protocol=tcp
  792. add action=drop chain=tcp-virus comment=Backdoor.phoenix dst-port=7410 log=\
  793. yes protocol=tcp
  794. add action=drop chain=tcp-virus comment="Host Control" dst-port=7424 log=yes \
  795. protocol=tcp
  796. add action=drop chain=tcp-virus comment="QaZ -Remote Accs Trojan" dst-port=\
  797. 7597 log=yes protocol=tcp
  798. add action=drop chain=tcp-virus comment=Backdoor.GRM dst-port=7614 log=yes \
  799. protocol=tcp
  800. add action=drop chain=tcp-virus comment=Glacier dst-port=7626 log=yes \
  801. protocol=tcp
  802. add action=drop chain=tcp-virus comment="GodMsaage, Tini" dst-port=7777 log=\
  803. yes protocol=tcp
  804. add action=drop chain=tcp-virus comment=ICKiller dst-port=7789 log=yes \
  805. protocol=tcp
  806. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=7823 log=\
  807. yes protocol=tcp
  808. add action=drop chain=tcp-virus comment="The ReVeNgEr" dst-port=7891 log=yes \
  809. protocol=tcp
  810. add action=drop chain=tcp-virus comment=W32.kibuv.b dst-port=7955 log=yes \
  811. protocol=tcp
  812. add action=drop chain=tcp-virus comment=Mstream dst-port=7983 log=yes \
  813. protocol=tcp
  814. add action=drop chain=tcp-virus comment=w32.mytob.lz@mm dst-port=7999-8000 \
  815. log=yes protocol=tcp
  816. add action=drop chain=tcp-virus comment=Backdoor.Ptakks.b dst-port=8012 log=\
  817. yes protocol=tcp
  818. add action=drop chain=tcp-virus comment="W32.Spybot.pen " dst-port=8076 log=\
  819. yes protocol=tcp
  820. add action=drop chain=tcp-virus comment=Backdoor.Asniffer dst-port=8090 log=\
  821. yes protocol=tcp
  822. add action=drop chain=tcp-virus comment=W32.PejayBot dst-port=8126 log=yes \
  823. protocol=tcp
  824. add action=drop chain=tcp-virus comment="BackOrifice 2000" dst-port=8787 log=\
  825. yes protocol=tcp
  826. add action=drop chain=tcp-virus comment=Backdoor.Monator dst-port=8811 log=\
  827. yes protocol=tcp
  828. add action=drop chain=tcp-virus comment=Beagle.B@mm dst-port=8866 log=yes \
  829. protocol=tcp
  830. add action=drop chain=tcp-virus comment="BackOrifice 2000" dst-port=8879 log=\
  831. yes protocol=tcp
  832. add action=drop chain=tcp-virus comment=W32.Axatak dst-port=8888-8889 log=yes \
  833. protocol=tcp
  834. add action=drop chain=tcp-virus comment="BackHack - Rcon, Recon, Xcon" \
  835. dst-port=8988-8989 log=yes protocol=tcp
  836. add action=drop chain=tcp-virus comment="W32.randex.ccf - netministrator" \
  837. dst-port=9000 log=yes protocol=tcp
  838. add action=drop chain=tcp-virus comment=Backdoor.nibu.k dst-port=9125 log=yes \
  839. protocol=tcp
  840. add action=drop chain=tcp-virus comment=InCommand dst-port=9400 log=yes \
  841. protocol=tcp
  842. add action=drop chain=tcp-virus comment=W32.kibuv.worm dst-port=9604 log=yes \
  843. protocol=tcp
  844. add action=drop chain=tcp-virus comment=Backdoor.gholame dst-port=9696-9697 \
  845. log=yes protocol=tcp
  846. add action=drop chain=tcp-virus comment="BackDoor.RC3.B, Portal of Doom" \
  847. dst-port=9872-9878 log=yes protocol=tcp
  848. add action=drop chain=tcp-virus comment=\
  849. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  850. 9898-10002 log=yes protocol=tcp
  851. add action=drop chain=tcp-virus comment=iNi-Killer dst-port=9989 log=yes \
  852. protocol=tcp
  853. add action=drop chain=tcp-virus comment="W.32.Sasser Worm" dst-port=9996 log=\
  854. yes protocol=tcp
  855. add action=drop chain=tcp-virus comment="The Prayer" dst-port=9999 log=yes \
  856. protocol=tcp
  857. add action=drop chain=tcp-virus comment=OpwinTRojan dst-port=10005 log=yes \
  858. protocol=tcp
  859. add action=drop chain=tcp-virus comment="Chee worm" dst-port=10008 log=yes \
  860. protocol=tcp
  861. add action=drop chain=tcp-virus comment=w32.mytob.jw@mm dst-port=10027 log=\
  862. yes protocol=tcp
  863. add action=drop chain=tcp-virus comment="Portal of Doom" dst-port=10067 log=\
  864. yes protocol=tcp
  865. add action=drop chain=tcp-virus comment=Mydoom.B dst-port=10080 log=yes \
  866. protocol=tcp
  867. add action=drop chain=tcp-virus comment="backdoor.ranky.o, backdoor.staprew, b\
  868. ackdoor.tuimer, gift trojan, brainspy, silencer" dst-port=10100-10103 \
  869. log=yes protocol=tcp
  870. add action=drop chain=tcp-virus comment="Acid Shivers" dst-port=10520 log=yes \
  871. protocol=tcp
  872. add action=drop chain=tcp-virus comment=Coma dst-port=10607 log=yes protocol=\
  873. tcp
  874. add action=drop chain=tcp-virus comment=Ambush dst-port=10666 log=yes \
  875. protocol=tcp
  876. add action=drop chain=tcp-virus comment="Senna Spy" dst-port=11000 log=yes \
  877. protocol=tcp
  878. add action=drop chain=tcp-virus comment="Host Control" dst-port=11050-11051 \
  879. log=yes protocol=tcp
  880. add action=drop chain=tcp-virus comment="Progenic Trojan - Secret Agent" \
  881. dst-port=11223 log=yes protocol=tcp
  882. add action=drop chain=tcp-virus comment="Dipnet / oddBob Trojan" dst-port=\
  883. 11768 log=yes protocol=tcp
  884. add action=drop chain=tcp-virus comment="Latinus Server" dst-port=11831 log=\
  885. yes protocol=tcp
  886. add action=drop chain=tcp-virus comment=Backdoor.Satancrew dst-port=12000 \
  887. log=yes protocol=tcp
  888. add action=drop chain=tcp-virus comment=Backdoor.Berbew.j dst-port=12065 log=\
  889. yes protocol=tcp
  890. add action=drop chain=tcp-virus comment=GJamer dst-port=12076 log=yes \
  891. protocol=tcp
  892. add action=drop chain=tcp-virus comment="Hack'99, KeyLogger" dst-port=12223 \
  893. log=yes protocol=tcp
  894. add action=drop chain=tcp-virus comment="Netbus, Ultor's Trojan" dst-port=\
  895. 12345-12346 log=yes protocol=tcp
  896. add action=drop chain=tcp-virus comment=Whack-a-Mole dst-port=12361-12363 \
  897. log=yes protocol=tcp
  898. add action=drop chain=tcp-virus comment=NetBus dst-port=12456 log=yes \
  899. protocol=tcp
  900. add action=drop chain=tcp-virus comment="Whack Job" dst-port=12631 log=yes \
  901. protocol=tcp
  902. add action=drop chain=tcp-virus comment="Eclypse 2000" dst-port=12701 log=yes \
  903. protocol=tcp
  904. add action=drop chain=tcp-virus comment="Mstream attack-handler" dst-port=\
  905. 12754 log=yes protocol=tcp
  906. add action=drop chain=tcp-virus comment="Senna Spy" dst-port=13000 log=yes \
  907. protocol=tcp
  908. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=13173 log=\
  909. yes protocol=tcp
  910. add action=drop chain=tcp-virus comment=W32.Sober.D dst-port=13468 log=yes \
  911. protocol=tcp
  912. add action=drop chain=tcp-virus comment="Kuang2 the Virus" dst-port=13700 \
  913. log=yes protocol=tcp
  914. add action=drop chain=tcp-virus comment=Trojan.Mitglieder.h dst-port=14247 \
  915. log=yes protocol=tcp
  916. add action=drop chain=tcp-virus comment="Mstream attack-handler" dst-port=\
  917. 15104 log=yes protocol=tcp
  918. add action=drop chain=tcp-virus comment="Dipnet / oddBob Trojan" dst-port=\
  919. 15118 log=yes protocol=tcp
  920. add action=drop chain=tcp-virus comment=Backdoor.Cyn dst-port=15432 log=yes \
  921. protocol=tcp
  922. add action=drop chain=tcp-virus comment=Backdoor.Lastdoor dst-port=16322 log=\
  923. yes protocol=tcp
  924. add action=drop chain=tcp-virus comment=Mosucker dst-port=16484 log=yes \
  925. protocol=tcp
  926. add action=drop chain=tcp-virus comment="Backdoor.Haxdoor.D - Stacheldraht" \
  927. dst-port=16660-16661 log=yes protocol=tcp
  928. add action=drop chain=tcp-virus comment=\
  929. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  930. 16959 log=yes protocol=tcp
  931. add action=drop chain=tcp-virus comment="Kuang2.B Trojan" dst-port=17300 log=\
  932. yes protocol=tcp
  933. add action=drop chain=tcp-virus comment=W32.Imav.a dst-port=17940 log=yes \
  934. protocol=tcp
  935. add action=drop chain=tcp-virus comment=Backdoor.Gaster dst-port=19937 log=\
  936. yes protocol=tcp
  937. add action=drop chain=tcp-virus comment="Millennium - AcidkoR" dst-port=\
  938. 20001-20002 log=yes protocol=tcp
  939. add action=drop chain=tcp-virus comment="NetBus 2 Pro" dst-port=20034 log=yes \
  940. protocol=tcp
  941. add action=drop chain=tcp-virus comment=Chupacabra dst-port=20203 log=yes \
  942. protocol=tcp
  943. add action=drop chain=tcp-virus comment="Bla Trojan" dst-port=20331 log=yes \
  944. protocol=tcp
  945. add action=drop chain=tcp-virus comment="Shaft Client to handlers" dst-port=\
  946. 20432-20433 log=yes protocol=tcp
  947. add action=drop chain=tcp-virus comment=Trojan.Adnap dst-port=20480 log=yes \
  948. protocol=tcp
  949. add action=drop chain=tcp-virus comment=Trojan.Mitglieder.E dst-port=20742 \
  950. log=yes protocol=tcp
  951. add action=drop chain=tcp-virus comment=W32.dasher.b dst-port=21211 log=yes \
  952. protocol=tcp
  953. add action=drop chain=tcp-virus comment=\
  954. "Exploiter - Kid Terror - Schwndler - Winsp00fer" dst-port=21554 log=yes \
  955. protocol=tcp
  956. add action=drop chain=tcp-virus comment=\
  957. "Prosiak - Ruler - Donald Dick - RUX The TIc.K" dst-port=22222 log=yes \
  958. protocol=tcp
  959. add action=drop chain=tcp-virus comment="Yet Ano log=yesther Trojan" \
  960. dst-port=37651 log=yes protocol=tcp
  961. add action=drop chain=tcp-virus comment=\
  962. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  963. 39999 log=yes protocol=tcp
  964. add action=drop chain=tcp-virus comment="The Spy" dst-port=40412 log=yes \
  965. protocol=tcp
  966. add action=drop chain=tcp-virus comment="Agent 40421 - Masters Paradise" \
  967. dst-port=40421-40426 log=yes protocol=tcp
  968. add action=drop chain=tcp-virus comment="Master's Paradise" dst-port=43210 \
  969. log=yes protocol=tcp
  970. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=44280 log=\
  971. yes protocol=tcp
  972. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=44390 log=\
  973. yes protocol=tcp
  974. add action=drop chain=tcp-virus comment="Delta Source" dst-port=47252 log=yes \
  975. protocol=tcp
  976. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=47387 log=\
  977. yes protocol=tcp
  978. add action=drop chain=tcp-virus comment=Backdoor.antilam.20 dst-port=47891 \
  979. log=yes protocol=tcp
  980. add action=drop chain=tcp-virus comment="Sokets de Trois v2." dst-port=50505 \
  981. log=yes protocol=tcp
  982. add action=drop chain=tcp-virus comment=Fore dst-port=50776 log=yes protocol=\
  983. tcp
  984. add action=drop chain=tcp-virus comment=Backdoor.Cyn dst-port=51234 log=yes \
  985. protocol=tcp
  986. add action=drop chain=tcp-virus comment=W32.kalel.a@mm dst-port=51435 log=yes \
  987. protocol=tcp
  988. add action=drop chain=tcp-virus comment="Remote Windows Shutdown" dst-port=\
  989. 53001 log=yes protocol=tcp
  990. add action=drop chain=tcp-virus comment="subSeven -Subseven 2.1 Gold" \
  991. dst-port=54283 log=yes protocol=tcp
  992. add action=drop chain=tcp-virus comment=\
  993. "More than 3 kno log=yes wn worms and trojans use this port " dst-port=\
  994. 54320-54321 log=yes protocol=tcp
  995. add action=drop chain=tcp-virus comment=\
  996. "WM Trojan Generator - File manager Trojan" dst-port=55165-55166 log=yes \
  997. protocol=tcp
  998. add action=drop chain=tcp-virus comment=Backdoor.Osirdoor dst-port=56565 log=\
  999. yes protocol=tcp
  1000. add action=drop chain=tcp-virus comment="NetRaider Trojan" dst-port=57341 \
  1001. log=yes protocol=tcp
  1002. add action=drop chain=tcp-virus comment=BackDoor.Tron dst-port=58008-58009 \
  1003. log=yes protocol=tcp
  1004. add action=drop chain=tcp-virus comment="Butt Funnel" dst-port=58339 log=yes \
  1005. protocol=tcp
  1006. add action=drop chain=tcp-virus comment=BackDoor.Redkod dst-port=58666 log=\
  1007. yes protocol=tcp
  1008. add action=drop chain=tcp-virus comment=BackDoor.DuckToy dst-port=59211 log=\
  1009. yes protocol=tcp
  1010. add action=drop chain=tcp-virus comment="Deep Throat" dst-port=60000 log=yes \
  1011. protocol=tcp
  1012. add action=drop chain=tcp-virus comment=Trinity dst-port=60001 log=yes \
  1013. protocol=tcp
  1014. add action=drop chain=tcp-virus comment=Trojan.Fulamer.25 dst-port=60006 log=\
  1015. yes protocol=tcp
  1016. add action=drop chain=tcp-virus comment="Xzip 6000068" dst-port=60068 log=yes \
  1017. protocol=tcp
  1018. add action=drop chain=tcp-virus comment=Connection dst-port=60411 log=yes \
  1019. protocol=tcp
  1020. add action=drop chain=tcp-virus comment=Backdoor.mite dst-port=61000 log=yes \
  1021. protocol=tcp
  1022. add action=drop chain=tcp-virus comment="Bunker-Hill Trojan" dst-port=61348 \
  1023. log=yes protocol=tcp
  1024. add action=drop chain=tcp-virus comment=Telecommando dst-port=61466 log=yes \
  1025. protocol=tcp
  1026. add action=drop chain=tcp-virus comment="Bunker-Hill Trojan" dst-port=61603 \
  1027. log=yes protocol=tcp
  1028. add action=drop chain=tcp-virus comment="Bunker-Hill Trojan" dst-port=63485 \
  1029. log=yes protocol=tcp
  1030. add action=drop chain=tcp-virus comment="Phatbot, W32.hllw.gaobot.dk" \
  1031. dst-port=63808-63809 log=yes protocol=tcp
  1032. add action=drop chain=tcp-virus comment=Taskmin dst-port=64101 log=yes \
  1033. protocol=tcp
  1034. add action=drop chain=tcp-virus comment=Backdoor.Amitis.B dst-port=64429 log=\
  1035. yes protocol=tcp
  1036. add action=drop chain=tcp-virus comment=\
  1037. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  1038. 65000 log=yes protocol=tcp
  1039. add action=drop chain=tcp-virus comment=Eclypse dst-port=65390 log=yes \
  1040. protocol=tcp
  1041. add action=drop chain=tcp-virus comment=Jade dst-port=65421 log=yes protocol=\
  1042. tcp
  1043. add action=drop chain=tcp-virus comment="The Traitor (th3tr41t0r)" dst-port=\
  1044. 65432 log=yes protocol=tcp
  1045. add action=drop chain=tcp-virus comment=Phatbot dst-port=65506 log=yes \
  1046. protocol=tcp
  1047. add action=drop chain=tcp-virus comment=/sbin/init dst-port=65534 log=yes \
  1048. protocol=tcp
  1049. add action=drop chain=tcp-virus comment="Adore Worm/Linux - RC1 Trojan" \
  1050. dst-port=65535 log=yes protocol=tcp
  1051. add action=drop chain=tcp-virus comment=Cafeini dst-port=51966 log=yes \
  1052. protocol=tcp
  1053. add action=drop chain=tcp-virus comment="Acid baterry 2000" dst-port=52317 \
  1054. log=yes protocol=tcp
  1055. add action=drop chain=tcp-virus comment=Enterprise dst-port=50130 log=yes \
  1056. protocol=tcp
  1057. add action=drop chain=tcp-virus comment="Online Keylogger" dst-port=49301 \
  1058. log=yes protocol=tcp
  1059. add action=drop chain=tcp-virus comment=Exploiter dst-port=44575 log=yes \
  1060. protocol=tcp
  1061. add action=drop chain=tcp-virus comment=Prosiak dst-port=44444 log=yes \
  1062. protocol=tcp
  1063. add action=drop chain=tcp-virus comment="Remote Boot Tool - RBT" dst-port=\
  1064. 41666 log=yes protocol=tcp
  1065. add action=drop chain=tcp-virus comment=Storm dst-port=41337 log=yes \
  1066. protocol=tcp
  1067. add action=drop chain=tcp-virus comment=Mantis dst-port=37237 log=yes \
  1068. protocol=tcp
  1069. add action=drop chain=tcp-virus comment="Donald Dick" dst-port=34444 log=yes \
  1070. protocol=tcp
  1071. add action=drop chain=tcp-virus comment="Son of PsychWard" dst-port=33577 \
  1072. log=yes protocol=tcp
  1073. add action=drop chain=tcp-virus comment="Son of PsychWard" dst-port=33777 \
  1074. log=yes protocol=tcp
  1075. add action=drop chain=tcp-virus comment="Peanut Brittle, Project Next" \
  1076. dst-port=32100 log=yes protocol=tcp
  1077. add action=drop chain=tcp-virus comment="Donald Dick" dst-port=32001 log=yes \
  1078. protocol=tcp
  1079. add action=drop chain=tcp-virus comment="Hack'a'Tack" dst-port=31785 log=yes \
  1080. protocol=tcp
  1081. add action=drop chain=tcp-virus comment=Intruse dst-port=30947 log=yes \
  1082. protocol=tcp
  1083. add action=drop chain=tcp-virus comment="Lamers Death" dst-port=30003 log=yes \
  1084. protocol=tcp
  1085. add action=drop chain=tcp-virus comment="Infector - ErrOr32" dst-port=\
  1086. 30000-30001 log=yes protocol=tcp
  1087. add action=drop chain=tcp-virus comment=ovasOn dst-port=29369 log=yes \
  1088. protocol=tcp
  1089. add action=drop chain=tcp-virus comment=NetTrojan dst-port=29104 log=yes \
  1090. protocol=tcp
  1091. add action=drop chain=tcp-virus comment=Exploiter dst-port=28678 log=yes \
  1092. protocol=tcp
  1093. add action=drop chain=tcp-virus comment="Bad Blood - Ramen - Seeker - SubSev e\
  1094. n - SubSeven 2.1 Gold - Subseven 2.14 DefCon8 - SubSeven Muie - Ttfloader" \
  1095. dst-port=27374 log=yes protocol=tcp
  1096. add action=drop chain=tcp-virus comment=Voicpy dst-port=26681 log=yes \
  1097. protocol=tcp
  1098. add action=drop chain=tcp-virus comment=Moonpie dst-port=25982 log=yes \
  1099. protocol=tcp
  1100. add action=drop chain=tcp-virus comment=Moonpie dst-port=25685-25686 log=yes \
  1101. protocol=tcp
  1102. add action=drop chain=tcp-virus comment=Infector dst-port=24000 log=yes \
  1103. protocol=tcp
  1104. add action=drop chain=tcp-virus comment=InetSpy dst-port=23777 log=yes \
  1105. protocol=tcp
  1106. add action=drop chain=tcp-virus comment="Evil FTP - Ugly FTP - Whack Job" \
  1107. dst-port=23456 log=yes protocol=tcp
  1108. add action=drop chain=tcp-virus comment=Asylum dst-port=23432 log=yes \
  1109. protocol=tcp
  1110. add action=drop chain=tcp-virus comment=Amanda dst-port=23032 log=yes \
  1111. protocol=tcp
  1112. add action=drop chain=tcp-virus comment=Logged dst-port=23232 log=yes \
  1113. protocol=tcp
  1114. add action=drop chain=tcp-virus comment="Girl friend - Kid Error" dst-port=\
  1115. 21544 log=yes protocol=tcp
  1116. add action=drop chain=tcp-virus comment="VP killer" dst-port=20023 log=yes \
  1117. protocol=tcp
  1118. add action=drop chain=tcp-virus comment=Mosucker dst-port=20005 log=yes \
  1119. protocol=tcp
  1120. add action=drop chain=tcp-virus comment="ICQ Revenge" dst-port=19864 log=yes \
  1121. protocol=tcp
  1122. add action=drop chain=tcp-virus comment=Nephron dst-port=17777 log=yes \
  1123. protocol=tcp
  1124. add action=drop chain=tcp-virus comment=Audiodoor dst-port=17593 log=yes \
  1125. protocol=tcp
  1126. add action=drop chain=tcp-virus comment=Infector dst-port=17569 log=yes \
  1127. protocol=tcp
  1128. add action=drop chain=tcp-virus comment=CrazzyNet dst-port=17499-17500 log=\
  1129. yes protocol=tcp
  1130. add action=drop chain=tcp-virus comment=KidTerror dst-port=17449 log=yes \
  1131. protocol=tcp
  1132. add action=drop chain=tcp-virus comment=Mosaic dst-port=17166 log=yes \
  1133. protocol=tcp
  1134. add action=drop chain=tcp-virus comment=Priority dst-port=16969 log=yes \
  1135. protocol=tcp
  1136. add action=drop chain=tcp-virus comment="ICQ Revenge" dst-port=16772 log=yes \
  1137. protocol=tcp
  1138. add action=drop chain=tcp-virus comment=CDK dst-port=15858 log=yes protocol=\
  1139. tcp
  1140. add action=drop chain=tcp-virus comment=SubZero dst-port=15382 log=yes \
  1141. protocol=tcp
  1142. add action=drop chain=tcp-virus comment="Host Control" dst-port=15092 log=yes \
  1143. protocol=tcp
  1144. add action=drop chain=tcp-virus comment=NetDemon dst-port=15000 log=yes \
  1145. protocol=tcp
  1146. add action=drop chain=tcp-virus comment="PC Invader" dst-port=14500-14503 \
  1147. log=yes protocol=tcp
  1148. add action=drop chain=tcp-virus comment=Chupacabra dst-port=13473 log=yes \
  1149. protocol=tcp
  1150. add action=drop chain=tcp-virus comment="Hack '99 KeyLogger" dst-port=13223 \
  1151. log=yes protocol=tcp
  1152. add action=drop chain=tcp-virus comment=PsychWard dst-port=13013-13014 log=\
  1153. yes protocol=tcp
  1154. add action=drop chain=tcp-virus comment="Hacker Brasil - HBR" dst-port=13010 \
  1155. log=yes protocol=tcp
  1156. add action=drop chain=tcp-virus comment=Buttman dst-port=12624 log=yes \
  1157. protocol=tcp
  1158. add action=drop chain=tcp-virus comment=BioNet dst-port=12349 log=yes \
  1159. protocol=tcp
  1160. add action=drop chain=tcp-virus comment="Host Control" dst-port=10528 log=yes \
  1161. protocol=tcp
  1162. add action=drop chain=tcp-virus comment=Syphilis dst-port=10085-10086 log=yes \
  1163. protocol=tcp
  1164. add action=drop chain=tcp-virus comment=DigitalRootbeer dst-port=2600 log=yes \
  1165. protocol=tcp
  1166. add action=drop chain=tcp-virus comment="Doly Trojan" dst-port=2345 log=yes \
  1167. protocol=tcp
  1168. add action=return chain=tcp-virus comment="Back to previous menu" log=yes
  1169. add action=drop chain=udp-virus comment="Socks D Troie, Death" dst-port=1 \
  1170. log=yes protocol=udp
  1171. add action=drop chain=udp-virus comment="Netbios - DoS attacks msinit" \
  1172. dst-port=136-139 log=yes protocol=udp
  1173. add action=drop chain=udp-virus comment=Infector dst-port=146 log=yes \
  1174. protocol=udp
  1175. add action=drop chain=udp-virus comment="N0kN0k Trojan" dst-port=666 log=yes \
  1176. protocol=udp
  1177. add action=drop chain=udp-virus comment=\
  1178. "Maverick's Matrix 1.2-2.0 - remote storm" dst-port=1025 log=yes \
  1179. protocol=udp
  1180. add action=drop chain=tcp-virus comment=Backdoor.Simali dst-port=22311 log=\
  1181. yes protocol=tcp
  1182. add action=drop chain=tcp-virus comment=Backdoor-ADM dst-port=22784 log=yes \
  1183. protocol=tcp
  1184. add action=drop chain=tcp-virus comment=W32.hllw.nettrash dst-port=\
  1185. 23005-23006 log=yes protocol=tcp
  1186. add action=drop chain=tcp-virus comment=backdoor.berbew.j dst-port=23232 log=\
  1187. yes protocol=tcp
  1188. add action=drop chain=tcp-virus comment=Trojan.Framar dst-port=23435 log=yes \
  1189. protocol=tcp
  1190. add action=drop chain=tcp-virus comment="Donald Dick" dst-port=23476-23477 \
  1191. log=yes protocol=tcp
  1192. add action=drop chain=tcp-virus comment=w32.mytob.km@mm dst-port=23523 log=\
  1193. yes protocol=tcp
  1194. add action=drop chain=tcp-virus comment="Delta Source" dst-port=26274 log=yes \
  1195. protocol=tcp
  1196. add action=drop chain=tcp-virus comment=Backdoor.optix.04 dst-port=27379 log=\
  1197. yes protocol=tcp
  1198. add action=drop chain=tcp-virus comment="Sub-7 2.1" dst-port=27573 log=yes \
  1199. protocol=tcp
  1200. add action=drop chain=tcp-virus comment="Trin00 DoS Attack" dst-port=27665 \
  1201. log=yes protocol=tcp
  1202. add action=drop chain=tcp-virus comment=Backdoor.Sdbot.ai dst-port=29147 log=\
  1203. yes protocol=tcp
  1204. add action=drop chain=tcp-virus comment=Backdoor.NTHack dst-port=29292 log=\
  1205. yes protocol=tcp
  1206. add action=drop chain=tcp-virus comment="Latinus Server" dst-port=29559 log=\
  1207. yes protocol=tcp
  1208. add action=drop chain=tcp-virus comment="The Unexplained" dst-port=29891 log=\
  1209. yes protocol=tcp
  1210. add action=drop chain=tcp-virus comment=Backdoor.Antilam.20 dst-port=29999 \
  1211. log=yes protocol=tcp
  1212. add action=drop chain=tcp-virus comment="AOL Trojan" dst-port=30029 log=yes \
  1213. protocol=tcp
  1214. add action=drop chain=tcp-virus comment=NetSphere dst-port=30100-30103 log=\
  1215. yes protocol=tcp
  1216. add action=drop chain=tcp-virus comment="NetSphere Final" dst-port=30133 log=\
  1217. yes protocol=tcp
  1218. add action=drop chain=tcp-virus comment="Sockets de Troi" dst-port=30303 log=\
  1219. yes protocol=tcp
  1220. add action=drop chain=tcp-virus comment=Kuang2 dst-port=30999 log=yes \
  1221. protocol=tcp
  1222. add action=drop chain=tcp-virus comment=\
  1223. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  1224. 31335-31339 log=yes protocol=tcp
  1225. add action=drop chain=tcp-virus comment=BOWhack dst-port=31666 log=yes \
  1226. protocol=tcp
  1227. add action=drop chain=tcp-virus comment="Hack'a'Tack" dst-port=31785-31792 \
  1228. log=yes protocol=tcp
  1229. add action=drop chain=tcp-virus comment=backdoor.berbew.j dst-port=32121 log=\
  1230. yes protocol=tcp
  1231. add action=drop chain=tcp-virus comment="Acid Battery" dst-port=32418 log=yes \
  1232. protocol=tcp
  1233. add action=drop chain=tcp-virus comment=Backdoor.Alets.B dst-port=32440 log=\
  1234. yes protocol=tcp
  1235. add action=drop chain=tcp-virus comment="Trinity Trojan" dst-port=33270 log=\
  1236. yes protocol=tcp
  1237. add action=drop chain=tcp-virus comment=trojan.lodeight.b dst-port=33322 log=\
  1238. yes protocol=tcp
  1239. add action=drop chain=tcp-virus comment=Prosiak dst-port=33333 log=yes \
  1240. protocol=tcp
  1241. add action=drop chain=tcp-virus comment="Spirit 2001 a" dst-port=33911 log=\
  1242. yes protocol=tcp
  1243. add action=drop chain=tcp-virus comment="BigGluck, TN" dst-port=34324 log=yes \
  1244. protocol=tcp
  1245. add action=drop chain=udp-virus comment="BackOrifice DLL Comm" dst-port=1349 \
  1246. log=yes protocol=udp
  1247. add action=drop chain=udp-virus comment="FunkProxy " dst-port=1505 log=yes \
  1248. protocol=udp
  1249. add action=drop chain=udp-virus comment="ICA Browser" dst-port=1604 log=yes \
  1250. protocol=udp
  1251. add action=drop chain=udp-virus comment=BackDoor.Fearic dst-port=2000 log=yes \
  1252. protocol=udp
  1253. add action=drop chain=udp-virus comment="Mini Backlash" dst-port=2130 log=yes \
  1254. protocol=udp
  1255. add action=drop chain=udp-virus comment="Deep Throat" dst-port=2140 log=yes \
  1256. protocol=udp
  1257. add action=drop chain=udp-virus comment=BackDoor.Botex dst-port=2222 log=yes \
  1258. protocol=udp
  1259. add action=drop chain=udp-virus comment=voicpy dst-port=2339 log=yes \
  1260. protocol=udp
  1261. add action=drop chain=udp-virus comment=Rat dst-port=2989 log=yes protocol=\
  1262. udp
  1263. add action=drop chain=udp-virus comment=\
  1264. "Deep Throat - Foreplay - Mini Backflash" dst-port=3150 log=yes protocol=\
  1265. udp
  1266. add action=drop chain=udp-virus comment=Backdoor.Fearic dst-port=3456 log=yes \
  1267. protocol=udp
  1268. add action=drop chain=udp-virus comment=Eclypse dst-port=3801 log=yes \
  1269. protocol=udp
  1270. add action=drop chain=udp-virus comment="WityWorm - BlackICE/ISS" dst-port=\
  1271. 4000 log=yes protocol=udp
  1272. add action=drop chain=udp-virus comment="Remote Shell Trojan" dst-port=5503 \
  1273. log=yes protocol=udp
  1274. add action=drop chain=udp-virus comment="Y3K RAT" dst-port=5882 log=yes \
  1275. protocol=udp
  1276. add action=drop chain=udp-virus comment="Y3K RAT" dst-port=5888 log=yes \
  1277. protocol=udp
  1278. add action=drop chain=udp-virus comment="Mstream Agent-handler" dst-port=6838 \
  1279. log=yes protocol=udp
  1280. add action=drop chain=udp-virus comment="Unkno log=yes wn Trojan" dst-port=\
  1281. 7028 log=yes protocol=udp
  1282. add action=drop chain=udp-virus comment="Host Control" dst-port=7424 log=yes \
  1283. protocol=udp
  1284. add action=drop chain=udp-virus comment="MStream handler-agent" dst-port=7983 \
  1285. log=yes protocol=udp
  1286. add action=drop chain=udp-virus comment="BackOrifice 2000" dst-port=8787 log=\
  1287. yes protocol=udp
  1288. add action=drop chain=udp-virus comment="BackOrifice 2000" dst-port=8879 log=\
  1289. yes protocol=udp
  1290. add action=drop chain=udp-virus comment="MStream Agent-handler" dst-port=9325 \
  1291. log=yes protocol=udp
  1292. add action=drop chain=udp-virus comment="Portal of Doom" dst-port=10067 log=\
  1293. yes protocol=udp
  1294. add action=drop chain=udp-virus comment="Portal of Doom" dst-port=10167 log=\
  1295. yes protocol=udp
  1296. add action=drop chain=udp-virus comment="Mstream handler-agent" dst-port=\
  1297. 10498 log=yes protocol=udp
  1298. add action=drop chain=udp-virus comment=Ambush dst-port=10666 log=yes \
  1299. protocol=udp
  1300. add action=drop chain=udp-virus comment="DUN Control" dst-port=12623 log=yes \
  1301. protocol=udp
  1302. add action=drop chain=udp-virus comment="Shaft handler to Agent" dst-port=\
  1303. 18753 log=yes protocol=udp
  1304. add action=drop chain=udp-virus comment="Shaft handler to Agent" dst-port=\
  1305. 20433 log=yes protocol=udp
  1306. add action=drop chain=udp-virus comment=GirlFriend dst-port=21554 log=yes \
  1307. protocol=udp
  1308. add action=drop chain=udp-virus comment="Donald Dick" dst-port=23476 log=yes \
  1309. protocol=udp
  1310. add action=drop chain=udp-virus comment="Delta Source" dst-port=26274 log=yes \
  1311. protocol=udp
  1312. add action=drop chain=udp-virus comment="Sub-7 2.1" dst-port=27374 log=yes \
  1313. protocol=udp
  1314. add action=drop chain=udp-virus comment=Trin00/TFN2K dst-port=27444 log=yes \
  1315. protocol=udp
  1316. add action=drop chain=udp-virus comment="Sub-7 2.1" dst-port=27573 log=yes \
  1317. protocol=udp
  1318. add action=drop chain=udp-virus comment=NetSphere dst-port=30103 log=yes \
  1319. protocol=udp
  1320. add action=drop chain=udp-virus comment=\
  1321. "More than 3 kno log=yes wn worms and trojans use this port" dst-port=\
  1322. 31335-31338 log=yes protocol=udp
  1323. add action=drop chain=udp-virus comment="Hack`a'Tack" dst-port=31787-31791 \
  1324. log=yes protocol=udp
  1325. add action=drop chain=udp-virus comment="Trin00 for windows" dst-port=34555 \
  1326. log=yes protocol=udp
  1327. add action=drop chain=udp-virus comment="Trin00 for windows" dst-port=35555 \
  1328. log=yes protocol=udp
  1329. add action=drop chain=udp-virus comment="Delta Source" dst-port=47262 log=yes \
  1330. protocol=udp
  1331. add action=drop chain=udp-virus comment="OnLine keyLogger" dst-port=49301 \
  1332. log=yes protocol=udp
  1333. add action=drop chain=udp-virus comment="Back Orifice" dst-port=54320-54321 \
  1334. log=yes protocol=udp
  1335. add action=drop chain=udp-virus comment="NetRaider Trojan" dst-port=57341 \
  1336. log=yes protocol=udp
  1337. add action=drop chain=udp-virus comment="The Traitor - th3tr41t0r" dst-port=\
  1338. 65432 log=yes protocol=udp
  1339. add action=return chain=udp-virus comment="Back to previous menu" log=yes
  1340. add action=return chain=virus comment="Back to previous rul" log=yes
  1341. add action=drop chain=tcp-virus comment=Vampire dst-port=1020 log=yes \
  1342. protocol=tcp
  1343. add action=drop chain=tcp-virus comment=Bla dst-port=1042 log=yes protocol=\
  1344. tcp
  1345. add action=drop chain=tcp-virus comment="RAT, Blood Ft Evoltion" dst-port=\
  1346. 1095-1099 log=yes protocol=tcp
  1347. add action=drop chain=tcp-virus comment="Sub Seven" dst-port=1243 log=yes \
  1348. protocol=tcp
  1349. add action=drop chain=tcp-virus comment=Trino dst-port=1524 log=yes \
  1350. log-prefix=yes protocol=tcp
  1351. add action=drop chain=tcp-virus comment=backdoor.no dst-port=7740-7749 log=\
  1352. yes log-prefix=yes protocol=tcp
  1353. add action=drop chain=tcp-virus comment=Backdoor.Lifefourno dst-port=36183 \
  1354. log=yes log-prefix=yes protocol=tcp
  1355. add action=drop chain=udp-virus comment=no dst-port=1200-1201 log=yes \
  1356. log-prefix=yes protocol=udp
  1357. /ip hotspot user
  1358. add name=xxx password=xxx server=hotspot1
  1359. add disabled=yes name=xxx password=xxx profile=trial server=\
  1360. hotspot1
  1361. add name=op password=op server=hotspot1
  1362. add name=fkk524 password=fkk524 profile=Bulanan server=hotspot1
  1363. add name=idv546 password=idv546 profile=Bulanan server=hotspot1
  1364. add name=vcs528 password=vcs528 profile=Bulanan server=hotspot1
  1365. add name=bgz678 password=bgz678 profile=Bulanan server=hotspot1
  1366. add name=rch555 password=rch555 profile=Bulanan server=hotspot1
  1367. add name=dah399 password=dah399 profile=Bulanan server=hotspot1
  1368. add name=vmu888 password=vmu888 profile=Bulanan server=hotspot1
  1369. add name=mfz549 password=mfz549 profile=Bulanan server=hotspot1
  1370. add name=bty469 password=bty469 profile=Bulanan server=hotspot1
  1371. add name=nep798 password=nep798 profile=Bulanan server=hotspot1
  1372. /ip proxy
  1373. set cache-administrator=xxx.hotspot max-cache-object-size=20000KiB \
  1374. max-cache-size=80000KiB max-fresh-time=1w
  1375. /ip proxy access
  1376. add action=deny dst-host=internetpositif.uzone.id redirect-to=google.com
  1377. add action=deny dst-host=mercusuar.uzone.id redirect-to=google.com
  1378. add action=deny dst-host=welcome.indihome.co.id redirect-to=google.com
  1379. add action=deny dst-host=192.168.1.1 redirect-to=google.com
  1380. /ip route
  1381. add check-gateway=ping distance=1 gateway=192.168.1.1
  1382. /ip service
  1383. set telnet disabled=yes
  1384. set ftp disabled=yes
  1385. set www disabled=yes
  1386. set ssh disabled=yes
  1387. set api-ssl disabled=yes
  1388. /radius
  1389. add address=127.0.0.1 secret=123456 service=hotspot
  1390. /system clock
  1391. set time-zone-autodetect=no time-zone-name=Asia/Jakarta
  1392. /system identity
  1393. set name="xxx Hotspot"
  1394. /system logging
  1395. add action=disk prefix=-> topics=hotspot,info,debug
  1396. /system ntp client
  1397. set enabled=yes primary-ntp=202.65.114.202 secondary-ntp=212.26.18.41 \
  1398. server-dns-names=asia.pool.ntp.org
  1399. /system scheduler
  1400. add comment="Monitor Profile Mingguan" interval=2m40s name=Mingguan on-event="\
  1401. :local dateint do={:local montharray ( \"jan\",\"feb\",\"mar\",\"apr\",\"m\
  1402. ay\",\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\",\"dec\" );:local days\
  1403. \_[ :pick \$d 4 6 ];:local month [ :pick \$d 0 3 ];:local year [ :pick \$d\
  1404. \_7 11 ];:local monthint ([ :find \$montharray \$month]);:local month (\$m\
  1405. onthint + 1);:if ( [len \$month] = 1) do={:local zero (\"0\");:return [:to\
  1406. num (\"\$year\$zero\$month\$days\")];} else={:return [:tonum (\"\$year\$mo\
  1407. nth\$days\")];}}; :local timeint do={ :local hours [ :pick \$t 0 2 ]; :loc\
  1408. al minutes [ :pick \$t 3 5 ]; :return (\$hours * 60 + \$minutes) ; }; :loc\
  1409. al date [ /system clock get date ]; :local time [ /system clock get time ]\
  1410. ; :local today [\$dateint d=\$date] ; :local curtime [\$timeint t=\$time] \
  1411. ; :foreach i in [ /ip hotspot user find where profile=\"Mingguan\" ] do={ \
  1412. :local comment [ /ip hotspot user get \$i comment]; :local name [ /ip hots\
  1413. pot user get \$i name]; :local gettime [:pic \$comment 12 20]; :if ([:pic \
  1414. \$comment 3] = \"/\" and [:pic \$comment 6] = \"/\") do={:local expd [\$da\
  1415. teint d=\$comment] ; :local expt [\$timeint t=\$gettime] ; :if ((\$expd < \
  1416. \$today and \$expt < \$curtime) or (\$expd < \$today and \$expt > \$curtim\
  1417. e) or (\$expd = \$today and \$expt < \$curtime)) do={ [ /ip hotspot user r\
  1418. emove \$i ]; [ /ip hotspot active remove [find where user=\$name] ];}}}" \
  1419. policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
  1420. start-date=sep/21/2019 start-time=05:34:57
  1421. add comment="Monitor Profile Bulanan" interval=2m14s name=Bulanan on-event=":l\
  1422. ocal dateint do={:local montharray ( \"jan\",\"feb\",\"mar\",\"apr\",\"may\
  1423. \",\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\",\"dec\" );:local days [\
  1424. \_:pick \$d 4 6 ];:local month [ :pick \$d 0 3 ];:local year [ :pick \$d 7\
  1425. \_11 ];:local monthint ([ :find \$montharray \$month]);:local month (\$mon\
  1426. thint + 1);:if ( [len \$month] = 1) do={:local zero (\"0\");:return [:tonu\
  1427. m (\"\$year\$zero\$month\$days\")];} else={:return [:tonum (\"\$year\$mont\
  1428. h\$days\")];}}; :local timeint do={ :local hours [ :pick \$t 0 2 ]; :local\
  1429. \_minutes [ :pick \$t 3 5 ]; :return (\$hours * 60 + \$minutes) ; }; :loca\
  1430. l date [ /system clock get date ]; :local time [ /system clock get time ];\
  1431. \_:local today [\$dateint d=\$date] ; :local curtime [\$timeint t=\$time] \
  1432. ; :foreach i in [ /ip hotspot user find where profile=\"Bulanan\" ] do={ :\
  1433. local comment [ /ip hotspot user get \$i comment]; :local name [ /ip hotsp\
  1434. ot user get \$i name]; :local gettime [:pic \$comment 12 20]; :if ([:pic \
  1435. \$comment 3] = \"/\" and [:pic \$comment 6] = \"/\") do={:local expd [\$da\
  1436. teint d=\$comment] ; :local expt [\$timeint t=\$gettime] ; :if ((\$expd < \
  1437. \$today and \$expt < \$curtime) or (\$expd < \$today and \$expt > \$curtim\
  1438. e) or (\$expd = \$today and \$expt < \$curtime)) do={ [ /ip hotspot user r\
  1439. emove \$i ]; [ /ip hotspot active remove [find where user=\$name] ];}}}" \
  1440. policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
  1441. start-date=sep/21/2019 start-time=05:41:35
  1442. add comment="Monitor Profile Harian" interval=2m27s name=Harian on-event=":loc\
  1443. al dateint do={:local montharray ( \"jan\",\"feb\",\"mar\",\"apr\",\"may\"\
  1444. ,\"jun\",\"jul\",\"aug\",\"sep\",\"oct\",\"nov\",\"dec\" );:local days [ :\
  1445. pick \$d 4 6 ];:local month [ :pick \$d 0 3 ];:local year [ :pick \$d 7 11\
  1446. \_];:local monthint ([ :find \$montharray \$month]);:local month (\$monthi\
  1447. nt + 1);:if ( [len \$month] = 1) do={:local zero (\"0\");:return [:tonum (\
  1448. \"\$year\$zero\$month\$days\")];} else={:return [:tonum (\"\$year\$month\$\
  1449. days\")];}}; :local timeint do={ :local hours [ :pick \$t 0 2 ]; :local mi\
  1450. nutes [ :pick \$t 3 5 ]; :return (\$hours * 60 + \$minutes) ; }; :local da\
  1451. te [ /system clock get date ]; :local time [ /system clock get time ]; :lo\
  1452. cal today [\$dateint d=\$date] ; :local curtime [\$timeint t=\$time] ; :fo\
  1453. reach i in [ /ip hotspot user find where profile=\"Harian\" ] do={ :local \
  1454. comment [ /ip hotspot user get \$i comment]; :local name [ /ip hotspot use\
  1455. r get \$i name]; :local gettime [:pic \$comment 12 20]; :if ([:pic \$comme\
  1456. nt 3] = \"/\" and [:pic \$comment 6] = \"/\") do={:local expd [\$dateint d\
  1457. =\$comment] ; :local expt [\$timeint t=\$gettime] ; :if ((\$expd < \$today\
  1458. \_and \$expt < \$curtime) or (\$expd < \$today and \$expt > \$curtime) or \
  1459. (\$expd = \$today and \$expt < \$curtime)) do={ [ /ip hotspot user remove \
  1460. \$i ]; [ /ip hotspot active remove [find where user=\$name] ];}}}" \
  1461. policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
  1462. start-date=sep/21/2019 start-time=05:38:35
  1463. add comment=--AutoBlockNetcut-- interval=10m name=--AutoBlockNetcut-- \
  1464. on-event="local a [/ip firewall address-list get [find list=\"NetcutUser\"\
  1465. ] address]\r\
  1466. \nlocal b [/ip hotspot active get [find address=\$a] mac-address]\r\
  1467. \nif (\$a != \"\") do={[\r\
  1468. \n/ip hotspot ip-binding add mac-address=\"\$b\" address=\"\$a\" type=bloc\
  1469. ked\r\
  1470. \n/ip firewall address-list remove [find address=\"\$a\"]\r\
  1471. \n/system scheduler add name (\$a) interval=\"01:00:00\" on \"/ip hotspot\
  1472. \_ip-binding remove [find mac-address=\$b]\r\
  1473. \n/system scheduler remove [find name=\$a]\"\r\
  1474. \n]}" policy=\
  1475. ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
  1476. start-date=sep/21/2019 start-time=03:14:40
  1477. /tool mac-server
  1478. set allowed-interface-list=none
  1479. /tool mac-server mac-winbox
  1480. set allowed-interface-list=none
  1481. /tool mac-server ping
  1482. set enabled=no
  1483. /tool netwatch
  1484. add down-script="/queue simple remove [find name=hs-<hotspot1>]" host=\
  1485. 192.168.88.1 interval=1s up-script=\
  1486. "/queue simple remove [find name=hs-<hotspot1>]"
  1487. /tool user-manager database
  1488. set db-path=/user-manager
Advertisement
Comments
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!