نکته ها و ترفندها برای مبتدی ها

فایروال

تنظیمات اولیه فایروال برای روتر میکروتیک

برای جلوگیری از حملات مختلف و کانکشن های اشتباه به روتر باید یک سری پیکربندی های اولیه انجام داد

برای مثال ( اینترفیس WAN شبکه اینترنت شما و اینترفیس LAN شبکه داخلی شما با آی پی ۱۹۲.۱۶۸.۸۸.۰/۲۴ میباشد)

ابتدا ایجاد لیستی از آی پی های غیر صحیح ( Bagon IP )


/ip firewall address-list
add address=0.0.0.0/8 comment=RFC6890 list=NotPublic
add address=10.0.0.0/8 comment=RFC6890 list=NotPublic
add address=100.64.0.0/10 comment=RFC6890 list=NotPublic
add address=127.0.0.0/8 comment=RFC6890 list=NotPublic
add address=169.254.0.0/16 comment=RFC6890 list=NotPublic
add address=172.16.0.0/12 comment=RFC6890 list=NotPublic
add address=192.0.0.0/24 comment=RFC6890 list=NotPublic
add address=192.0.2.0/24 comment=RFC6890 list=NotPublic
add address=192.168.0.0/16 comment=RFC6890 list=NotPublic
add address=192.88.99.0/24 comment=RFC3068 list=NotPublic
add address=198.18.0.0/15 comment=RFC6890 list=NotPublic
add address=198.51.100.0/24 comment=RFC6890 list=NotPublic
add address=203.0.113.0/24 comment=RFC6890 list=NotPublic
add address=224.0.0.0/4 comment=RFC4601 list=NotPublic
add address=240.0.0.0/4 comment=RFC6890 list=NotPublic


مرحله بعد اضافه کردن رول های در فایروال برای محافظت در برابر کانکشن های ورودی


/ip firewall filter
add chain=input comment="Accept established and related packets" connection-state=established,related
add chain=input comment="Accept all connections from local network" in-interface=LAN
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid
add action=drop chain=input comment="Drop all packets which are not destined to routes IP address" dst-address-type=!local
add action=drop chain=input comment="Drop all packets which does not have unicast source IP address" src-address-type=!unicast
add action=drop chain=input comment="Drop all packets from public internet which should not exist in public network" in-interface=WAN src-address-list=NotPublic


ایجاد فیلتر رول فایروال برای محافظت از شبکه محلی شما را از اتصالات خارجی


/ip firewall filter
add chain=forward comment="Accept established and related packets" connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" connection-state=invalid
add action=drop chain=forward comment="Drop new connections from internet which are not dst-natted" connection-nat-state=!dstnat connection-state=new in-interface=WAN
add action=drop chain=forward comment="Drop all packets from public internet which should not exist in public network" in-interface=WAN src-address-list=NotPublic
add action=drop chain=forward comment="Drop all packets from local network to internet which should not exist in public network" dst-address-list=NotPublic in-interface=LAN
add action=drop chain=forward comment="Drop all packets in local network which does not have local network address" in-interface=LAN src-address=!192.168.88.0/24