2016年8月

RouterOS 中 RAW 表的基本规则配置一例

RouterOS6.36rc21 开始支持 raw——

*) firewall - added pre-connection tracking filter - "raw"  table, that allow to protect connection-tracking from unnecessary traffic;

料想其与 iptables 的该特性优势一致(可提升性能),
于是尝试将以前写在主表的部分规则移到了 raw 表:

/ip firewall raw
add chain=prerouting action=drop packet-size=1492-65535 log=no protocol=icmp comment="Drop oversized unfragmented packets"
add chain=prerouting action=drop in-interface=all-ppp icmp-options=8:0 log=no protocol=icmp comment="Drop pings from WAN"
add cchain=prerouting action=drop in-interface=all-ppp dst-port=53 log=no protocol=tcp comment="Drop tcp DNS queries from WAN"
add chain=prerouting action=drop in-interface=all-ppp icmp-options=8:0 log=no protocol=icmp comment="Drop udp DNS queries from WAN"
add chain=prerouting action=drop tcp-flags=fin,syn log=no protocol=tcp comment="SYN-FIN attack protection"
add chain=prerouting action=drop tcp-flags=syn,rst log=no protocol=tcp comment="SYN-RST attack protection"
add chain=prerouting action=drop tcp-flags=fin,psh,urg,!syn,!rst,!ack log=no protocol=tcp comment="X-Mas attack protection"
add chain=prerouting action=drop tcp-flags=fin,!syn,!rst,!psh,!ack,!urg log=no protocol=tcp comment="NMAP FIN attack protection"
add chain=prerouting action=drop tcp-flags=fin,syn,rst,ack,urg,!psh log=no protocol=tcp comment="NMAP Push attack protection"
add chain=prerouting action=drop tcp-flags=fin,psh,urg,!syn,!rst,!ack log=no protocol=tcp comment="NMAP FIN/PSH/URG attack protection"
add chain=prerouting action=drop tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg log=no protocol=tcp comment="NULLflags attack protection"
add chain=prerouting action=drop tcp-flags=fin,syn,rst,psh,ack,urg log=no protocol=tcp comment="ALLflags attack protection"