X86 RouterOS 7.18 设置笔记三：防火墙设置(IPV4)

原创已于 2025-03-14 15:50:18 修改 · 412 阅读

5 ·

CC 4.0 BY-SA版权

文章标签：

#笔记 #php #开发语言

于 2025-03-05 18:02:15 首次发布

X86 j4125 4网口小主机折腾笔记五：PVE安装ROS RouterOS
X86 RouterOS 7.18 设置笔记二：网络基础设置(IPV4)
X86 RouterOS 7.18 设置笔记三：防火墙设置(IPV4)

目录标题

实现的目标
添加WAN口LAN口地址列表
添加防火墙规则

实现的目标

添加地址列表
设置防火墙
创建端口映射

添加WAN口LAN口地址列表

/ip firewall address-list add address=192.168.1.1 comment="local_moden_ipv4" list="local_moden_ipv4"
/ip firewall address-list add address=192.168.0.0/24 comment="local LAN ipv4" list="local_LAN_ipv4"

在这里插入图片描述

添加防火墙规则

/ip firewall filter add action=accept chain=forward connection-state=established,related,untracked
# /ip firewall filter add action=accept chain=input connection-state=established,related
/ip firewall filter add action=accept chain=forward in-interface=bridge1
/ip firewall filter add action=accept chain=input in-interface=bridge1
/ip firewall filter add action=drop chain=input src-address-list=BlockIP in-interface=pppoe-out1
/ip firewall filter add action=drop chain=input connection-state=invalid in-interface=pppoe-out1
/ip firewall filter add action=drop chain=input protocol=icmp in-interface=pppoe-out1
##5391是Winbox登陆端口，可以加上想隐藏的端口。如果在NAT有映射，端口无法隐藏## 
/ip firewall filter add action=drop chain=input protocol=tcp dst-port=53,5391 in-interface=pppoe-out1
/ip firewall filter add action=drop chain=input protocol=udp dst-port=53,5391 in-interface=pppoe-out1
/ip firewall filter add action=add-src-to-address-list chain=input address-list=BlockIP address-list-timeout=1w protocol=tcp dst-port=!53,853,5391 tcp-flags=rst in-interface=pppoe-out1 psd=21,5s,3,1
/ip firewall filter add action=add-src-to-address-list chain=input address-list=BlockIP address-list-timeout=1w protocol=tcp dst-port=!53,853,5391 tcp-flags=syn in-interface=pppoe-out1 psd=21,5s,3,1
##UPD协议 dst-port=!53,853,5391 可以加上wireguard端口，防止触发PSD，造成IP被Block##
/ip firewall filter add action=add-src-to-address-list chain=input address-list=BlockIP address-list-timeout=1w protocol=udp dst-port=!53,853,5391 in-interface=pppoe-out1 psd=21,5s,3,1
/ip firewall filter add action=drop chain=input src-address-list=BlockIP