Правила firewall

Тема в разделе "Общий форум", создана пользователем psysop, 10 апр 2017.

  1. psysop

    psysop Новый участник

    Добрый день!

    Не могу разобраться где ошибка в конфигурации firewall, при активации последнего правила пропадает интернет:-(

    #Mikrotik RB2011UiAS-2HnD-IN

    /ip firewall address-list

    add address=0.0.0.0/8 disabled=no list=BOGON
    add address=10.0.0.0/8 disabled=no list=BOGON
    add address=100.64.0.0/10 disabled=no list=BOGON
    add address=127.0.0.0/8 disabled=no list=BOGON
    add address=169.254.0.0/16 disabled=no list=BOGON
    add address=172.16.0.0/12 disabled=no list=BOGON
    add address=192.0.0.0/24 disabled=no list=BOGON
    add address=192.0.2.0/24 disabled=no list=BOGON
    add address=192.168.0.0/16 disabled=no list=BOGON
    add address=198.18.0.0/15 disabled=no list=BOGON
    add address=198.51.100.0/24 disabled=no list=BOGON
    add address=203.0.113.0/24 disabled=no list=BOGON
    add address=224.0.0.0/4 disabled=no list=BOGON
    add address=240.0.0.0/4 disabled=no list=BOGON

    /ip firewall filter

    # Блокируем всех из чёрного списка
    add action=drop chain=input comment="Drop blocklist" dst-address-list=blocklist
    add action=drop chain=forward comment="Drop blocklist" dst-address-list=blocklist

    # Блокируем Bogon
    add action=drop chain=input comment=Bogon_Wan_Drop in-interface=internet \
    src-address-list=BOGON

    # Блокируем DNS запросы на внешний интерфейс
    add action=drop chain=input comment="Drop DNS" dst-port=53 in-interface=internet protocol=udp
    add action=drop chain=input dst-port=53 in-interface=internet protocol=tcp
    add chain=input action=drop in-interface=internet protocol=udp dst-port=53

    # Блокируем взлом Windows
    add action=drop chain=input comment="Block hole Windows" dst-port=135,137-139,445,593,4444 protocol=tcp
    add action=drop chain=forward dst-port=135,137-139,445,593,4444 protocol=tcp
    add action=drop chain=input dst-port=135,137-139 protocol=udp
    add action=drop chain=forward dst-port=135,137-139 protocol=udp

    # Блокируем некоторые порты
    add action=drop chain=tcp dst-port=69 protocol=tcp
    add action=drop chain=tcp dst-port=111 protocol=tcp
    add action=drop chain=tcp dst-port=2049 protocol=tcp
    add action=drop chain=tcp dst-port=12345-12346 protocol=tcp
    add action=drop chain=tcp dst-port=20034 protocol=tcp
    add action=drop chain=tcp dst-port=3133 protocol=tcp
    add action=drop chain=tcp dst-port=67-68 protocol=tcp
    add action=drop chain=udp dst-port=69 protocol=udp
    add action=drop chain=udp dst-port=111 protocol=udp
    add action=drop chain=udp dst-port=2049 protocol=udp
    add action=drop chain=udp dst-port=3133 protocol=udp

    # Фильтруем полезный ICMP
    add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="ICMP echo reply"
    add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="ICMP net unreachable"
    add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="ICMP host unreachable"
    add chain=icmp protocol=icmp icmp-options=3:4 action=accept comment="ICMP host unreachable fragmentation required"
    add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="ICMP allow source quench"
    add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="ICMP allow echo request"
    add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="ICMP allow time exceed"
    add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="ICMP allow parameter bad"
    add chain=icmp action=drop comment="ICMP deny all other types"

    # Защита от брутфорса SSH
    add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \
    protocol=tcp src-address-list=ssh_blacklist
    add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=3d chain=input connection-state=new dst-port=22 \
    protocol=tcp src-address-list=ssh_stage3
    add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout= \
    30m chain=input connection-state=new dst-port=22 protocol=tcp \
    src-address-list=ssh_stage2
    add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout= \
    30m chain=input connection-state=new dst-port=22 protocol=tcp \
    src-address-list=ssh_stage1
    add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout= \
    30m chain=input connection-state=new dst-port=22 protocol=tcp

    # Защита от сканера портов
    add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="Port scanners to list" disabled=no

    # Комбинации TCP флагов, указывающих на использование сканера портов
    add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="NMAP FIN Stealth scan"
    add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="SYN/FIN scan"
    add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="SYN/RST scan"
    add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="FIN/PSH/URG scan"
    add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="ALL/ALL scan"
    add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="NMAP NULL scan"

    # Запрет подключений сканеров портов
    add chain=input src-address-list=port_scanners action=drop comment="dropping port scanners" disabled=no
    add chain=forward src-address-list=port_scanners action=drop comment="dropping port scanners" disabled=no

    # OUTPUT
    add chain=output action=accept out-interface=ether1 comment="accept everything to internet"
    add chain=output action=accept out-interface=!ether1 comment="accept everything to non internet"
    add chain=output action=accept comment="accept everything"

    # FORWARD
    #fasttrack-connection forward
    add action=fasttrack-connection chain=forward connection-state=established,related

    # jumping
    add chain=forward protocol=tcp action=jump jump-target=tcp
    add chain=forward protocol=udp action=jump jump-target=udp
    add chain=forward protocol=icmp action=jump jump-target=icmp

    # accept forward from local to internet
    add chain=forward action=accept in-interface=!internet out-interface=internet comment="accept from local to internet"

    #Разрешаем все уже установленные подключения (connection state=established)
    add chain=input connection-state=established action=accept comment="allow established connections"

    # Разрешаем все зависимые подключения (connection state=related)
    add chain=input connection-state=related action=accept comment="allow related connections"

    # Разрешаем подключение только из нашей локальной сети
    add action=accept chain=input src-address=192.168.0.0/24

    # Разрешаем внешние подключения для собственных нужд
    add action=accept chain=input dst-port=22 in-interface=internet protocol=tcp comment="Allow SSH"
    add action=accept chain=input dst-port=80 in-interface=internet protocol=tcp comment="Allow HTTP"
    add action=accept chain=input dst-port=161 in-interface=internet protocol=udp comment="Allow SNMP"
    add action=accept chain=input dst-port=443 in-interface=internet protocol=tcp comment="Allow HTTPS"
    add action=accept chain=input dst-port=1194 in-interface=internet protocol=tcp comment="Allow OpenVPN"
    add action=accept chain=input dst-port=1194 in-interface=internet protocol=udp
    add chain=input comment="Allow L2TP" dst-port=1701 in-interface=internet protocol=tcp
    add chain=input comment="Allow L2TP" dst-port=1701 in-interface=internet protocol=udp
    add chain=input comment="Allow PPTP" dst-port=1723 in-interface=internet protocol=tcp
    add chain=input comment="Allow GRE" in-interface=internet protocol=gre

    #Запрещаем недействительные соединения для цепочек input
    add chain=input connection-state=invalid action=drop comment="drop invalid connections"

    # Запрет транзита '''битых''' и '''неправильных''' пакетов
    add chain=forward connection-state=invalid action=drop comment="Drop Invalid connections"

    # Заперт установки новых транзитных входящих соединений на WAN порту
    add action=drop chain=forward comment="Drop new forward WAN" connection-state=new in-interface=internet

    # Запрет всех входящих на маршрутизатор
    add chain=input in-interface=internet action=drop comment="Drop everything else"

    # drop all other forward
    add chain=forward action=drop comment="drop everything else"

    /ip firewall nat
    add action=masquerade chain=srcnat out-interface=internet
     
  2. Илья Князев

    Илья Князев Администратор Команда форума

    В бридже use-ip-firewall включено?
    И неплохо на forward разрешить. established, related