ROS防止内外部端口扫描的防火墙策略

ROS端口扫描防火墙策略配置详解

最新推荐文章于 2024-01-14 01:50:05 发布

原创最新推荐文章于 2024-01-14 01:50:05 发布 · 4.6k 阅读

3 ·

CC 4.0 BY-SA版权

未使用代码前：

可以轻易的扫描出ROS端口

使用后截图：
ROS防止内外部端口扫描的防火墙策略 - 恋上你的眼睛 - 心情日记

再扫描一下：

空白一片，啥也没有。

脚本代码如下：
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list \
    address-list="port scanners" address-list-timeout=2w comment="Port \
    scanners to list " disabled=no
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="NMAP FIN Stealth scan" disabled=no
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="FIN/PSH/URG scan" disabled=no
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="ALL/ALL scan" disabled=no
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \
    action=add-src-to-address-list address-list="port scanners" \
    address-list-timeout=2w comment="NMAP NULL scan" disabled=no
add chain=input src-address-list="port scanners" action=drop comment="dropping \
    port scanners" disabled=no

ROS防止内外部端口扫描的防火墙策略 - 恋上你的眼睛 - 心情日记