Russian Users MikroTik | Форум пользователей MikroTik

# nov/14/2014 16:45:05 by RouterOS 6.21.1
# software id = TRW2-UE2H
#
/interface bridge
add name=LAN
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment=LAN
set [ find default-name=sfp1 ] disabled=yes
/ip neighbor discovery
set ether1 comment=WAN
set ether2 comment=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=mikrotik supplicant-identity="" \
wpa2-pre-shared-key=1234567
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no l2mtu=2290 mode=\
ap-bridge security-profile=profile ssid=mikrotik
/ip pool
add name=dhcp_pool1 ranges=192.168.1.2-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=LAN lease-time=3d name=\
dhcp1
/port
set 0 name=serial0
/ppp profile
add change-tcp-mss=yes name=kztrns only-one=yes use-compression=yes \
use-encryption=yes use-mpls=no use-vj-compression=yes
/interface pppoe-client
add ac-name="" add-default-route=yes allow=pap,chap,mschap1,mschap2 \
default-route-distance=1 dial-on-demand=no disabled=no interface=ether1 \
keepalive-timeout=60 max-mru=1480 max-mtu=1480 mrru=1600 name=Kaztranscom \
password=WiZpCNVw profile=kztrns service-name="" use-peer-dns=no user=\
Ast_kaz
/system logging action
set 2 remember=yes
/interface bridge port
add bridge=LAN interface=ether2
add bridge=LAN interface=ether3
add bridge=LAN interface=ether4
add bridge=LAN interface=ether5
add bridge=LAN interface=wlan1
/ip address
add address=192.168.1.1/24 interface=LAN network=192.168.1.0
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=drop chain=forward p2p=all-p2p
add action=drop chain=forward comment="torrent-DHT-Out-Magnet d1:ad2:id20:" \
content=d1:ad2:id20: dst-port=1025-65535 in-interface=ether1 packet-size=\
95-190 protocol=udp
add action=drop chain=forward comment="torrent /announce..." content=\
"info_hash=" dst-port=2710,80 in-interface=ether1 protocol=tcp
add action=drop chain=forward comment=".torrent \r\
\nContent-type..." content="\r\
\nContent-Type: application/x-bittorent" out-interface=ether1 protocol=\
tcp src-port=80
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 \
protocol=tcp src-address-list=ftp_blacklist
add chain=output content="530 Login incorrect" dst-limit=\
1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist \
address-list-timeout=3h chain=output content="530 Login incorrect" \
protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \
protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp
add action=drop chain=input comment="drop telnet brute forcers" dst-port=23 \
protocol=tcp src-address-list=black_list
add action=add-src-to-address-list address-list=black_list \
address-list-timeout=1d chain=input connection-state=new dst-port=23 \
protocol=tcp src-address-list=telnet_stage3
add action=add-src-to-address-list address-list=telnet_stage3 \
address-list-timeout=1m chain=input connection-state=new dst-port=23 \
protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 \
address-list-timeout=1m chain=input connection-state=new dst-port=23 \
protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 \
address-list-timeout=1m chain=input connection-state=new dst-port=23 \
protocol=tcp
# inactive time
add action=drop chain=input log=yes log-prefix=dota port=27000-28999 \
protocol=udp time=9h-13h,mon,tue,wed,thu,fri
# inactive time
add action=drop chain=input log=yes log-prefix=dota port=27000-28999 \
protocol=tcp time=9h-13h,mon,tue,wed,thu,fri
add action=drop chain=input log=yes log-prefix=dota port=27000-28999 \
protocol=udp time=14h30m-18h,mon,tue,wed,thu,fri
add action=drop chain=input log=yes log-prefix=dota port=27000-28999 \
protocol=tcp time=14h30m-18h,mon,tue,wed,thu,fri
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.1.0/24
/ip upnp
set allow-disable-external-interface=no
/snmp
set trap-community=public
/system clock
set time-zone-name=Etc/GMT+6
/system identity
set name=mikrotik