API tools faq
paste
ganggumalam

firewall raw iseng

ganggumalam
Dec 7th, 2017
208
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.52 KB | None | 0 0
raw download clone embed print report
  1. /interface list
  2.  
  3. add name=lan
  4. add name=wan
  5. add name=iptv-src
  6. add name=iptv-dst
  7.  
  8. /interface list member
  9.  
  10. add list=lan interface=br0-lan
  11. add list=wan interface=pppoe-rt
  12. add list=iptv-src interface=ether1
  13. add list=iptv-dst interface=br0-lan
  14.  
  15. /ip firewall address-list
  16.  
  17. add list=DNS address=195.34.224.1
  18. add list=DNS address=195.34.224.2
  19. add list=DNS address=8.8.8.8
  20. add list=DNS address=8.8.4.4
  21.  
  22. /ip firewall filter
  23.  
  24. add chain=input action=jump jump-target=fastaccept connection-state=established,related
  25. add chain=input action=jump jump-target=fastaccept in-interface-list=lan
  26. add chain=input action=jump jump-target=fastaccept in-interface-list=iptv-src dst-address-type=multicast
  27. add chain=input action=accept in-interface-list=wan protocol=tcp src-port=53 src-address-list=DNS
  28. add chain=input action=accept in-interface-list=wan protocol=udp src-port=53 src-address-list=DNS
  29. add chain=input action=jump jump-target=fastaccept protocol=tcp dst-port=8291
  30. add chain=input action=jump jump-target=fastaccept protocol=icmp
  31. add chain=input action=tarpit protocol=tcp
  32. add chain=input action=drop
  33.  
  34. add chain=forward action=jump jump-target=fastaccept connection-state=established,related
  35. add chain=forward action=jump jump-target=fastaccept in-interface-list=lan out-interface-list=lan
  36. add chain=forward action=jump jump-target=fastaccept in-interface-list=iptv-src out-interface-list=iptv-dst dst-address-type=multicast
  37. add chain=forward action=jump jump-target=fastaccept in-interface-list=iptv-dst out-interface-list=iptv-src dst-address-type=multicast
  38. add chain=forward action=drop dst-address-type=multicast
  39. add chain=forward action=jump jump-target=fastaccept in-interface-list=lan out-interface-list=wan
  40. add chain=forward action=jump jump-target=fastaccept in-interface-list=wan out-interface-list=lan connection-nat-state=dstnat
  41. add chain=forward action=tarpit protocol=tcp
  42. add chain=forward action=drop
  43.  
  44. add chain=output action=accept out-interface-list=wan protocol=tcp dst-port=53 dst-address-list=DNS
  45. add chain=output action=accept out-interface-list=wan protocol=udp dst-port=53 dst-address-list=DNS
  46. add chain=output action=jump jump-target=fastaccept
  47.  
  48. add chain=fastaccept action=fasttrack-connection
  49. add chain=fastaccept action=accept
  50.  
  51. /ip firewall raw
  52.  
  53. add chain=prerouting action=jump jump-target=accept-notrack dst-address-type=local in-interface-list=wan protocol=tcp src-port=53 src-address-list=DNS
  54. add chain=prerouting action=jump jump-target=accept-notrack dst-address-type=local in-interface-list=wan protocol=udp src-port=53 src-address-list=DNS
  55. add chain=prerouting action=jump jump-target=accept-notrack dst-address-type=local in-interface-list=lan protocol=tcp dst-port=53
  56. add chain=prerouting action=jump jump-target=accept-notrack dst-address-type=local in-interface-list=lan protocol=udp dst-port=53
  57. add chain=prerouting action=accept dst-address-type=multicast in-interface-list=iptv-src
  58. add chain=prerouting action=accept dst-address-type=multicast in-interface-list=iptv-dst
  59. add chain=prerouting action=drop dst-address-type=multicast
  60.  
  61. add chain=output action=jump jump-target=accept-notrack src-address-type=local out-interface-list=wan protocol=tcp dst-port=53 dst-address-list=DNS
  62. add chain=output action=jump jump-target=accept-notrack src-address-type=local out-interface-list=wan protocol=udp dst-port=53 dst-address-list=DNS
  63. add chain=output action=jump jump-target=accept-notrack src-address-type=local out-interface-list=lan protocol=tcp src-port=53
  64. add chain=output action=jump jump-target=accept-notrack src-address-type=local out-interface-list=lan protocol=udp src-port=53
  65. add chain=output action=jump jump-target=out-mcast-uplink dst-address-type=multicast out-interface-list=iptv-src
  66. add chain=output action=accept dst-address-type=multicast out-interface-list=iptv-dst
  67. add chain=output action=drop dst-address-type=multicast
  68.  
  69. add chain=accept-notrack action=notrack
  70. add chain=accept-notrack action=accept
  71.  
  72. add chain=out-mcast-uplink action=drop protocol=!igmp
  73. add chain=out-mcast-uplink action=accept dst-address=224.0.0.2
  74. add chain=out-mcast-uplink action=drop dst-address=224.0.0.0/23
  75. add chain=out-mcast-uplink action=drop dst-address=239.255.255.0/24
  76. add chain=out-mcast-uplink action=drop dst-address=239.192.152.0/24
  77. add chain=out-mcast-uplink action=drop dst-address=239.2.0.0/24
  78. add chain=out-mcast-uplink action=accept
  79.  
  80. /ip firewall mangle
  81.  
  82. add chain=prerouting action=change-dscp new-dscp=63 passthrough=no dst-address-type=multicast in-interface-list=iptv-src
  83. add chain=prerouting action=change-dscp new-dscp=63 passthrough=no dst-address-type=multicast in-interface-list=iptv-dst
  84.  
  85. add chain=postrouting action=change-dscp new-dscp=63 passthrough=no dst-address-type=multicast out-interface-list=iptv-src
  86. add chain=postrouting action=change-dscp new-dscp=63 passthrough=no dst-address-type=multicast out-interface-list=iptv-dst
  87.  
  88. /ip firewall nat
  89.  
  90. add chain=srcnat action=masquerade out-interface-list=wan
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!