API tools faq
paste
unps

Untitled

unps
Sep 15th, 2020
177
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.06 KB | None | 0 0
raw download clone embed print report
  1. # sep/15/2020 17:08:09 by RouterOS 6.45.9
  2. # model = 951G-2HnD
  3.  
  4. /ip firewall address-list add address=91.xxx.xxx.xxx list=Trust_IP
  5. /ip firewall filter add action=accept chain=input comment=OpenVPN dst-port=1194 in-interface=pppoe-out-utk protocol=tcp
  6. /ip firewall filter add action=accept chain=input comment=L2TP port=500,1701,4500 protocol=udp
  7. /ip firewall filter add action=accept chain=input protocol=ipsec-esp
  8. /ip firewall filter add action=accept chain=input dst-port=8291 protocol=tcp src-address-list=Trust_IP
  9. /ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
  10. /ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
  11. /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  12. /ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
  13. /ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
  14. /ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
  15. /ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
  16. /ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
  17. /ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
  18. /ip firewall filter add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
  19. /ip firewall nat add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface-list=WAN
  20. /ip firewall service-port set ftp disabled=yes
  21. /ip firewall service-port set tftp disabled=yes
  22. /ip firewall service-port set irc disabled=yes
  23. /ip firewall service-port set h323 disabled=yes
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!