Board logo

標題: RB951G-2HnD —— Default firewall and nat rules (v6.42.12) [打印本頁]
作者: 角色    時間: 2019-3-4 09:29     標題: RB951G-2HnD —— Default firewall and nat rules (v6.42.12)

本帖最後由 角色 於 2019-3-4 13:29 編輯

The following are the default firewall and nat rules for RB951G-2HnD of firmware v6.42.12:

filter rules
  1. /ip firewall filter
  2. add action=accept chain=input comment=\
  3.     "defconf: accept established,related,untracked" connection-state=\
  4.     established,related,untracked
  5. add action=drop chain=input comment="defconf: drop invalid" connection-state=\
  6.     invalid
  7. add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
  8. add action=drop chain=input comment="defconf: drop all not coming from LAN" \
  9.     in-interface-list=!LAN
  10. add action=accept chain=forward comment="defconf: accept in ipsec policy" \
  11.     ipsec-policy=in,ipsec
  12. add action=accept chain=forward comment="defconf: accept out ipsec policy" \
  13.     ipsec-policy=out,ipsec
  14. add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
  15.     connection-state=established,related
  16. add action=accept chain=forward comment=\
  17.     "defconf: accept established,related, untracked" connection-state=\
  18.     established,related,untracked
  19. add action=drop chain=forward comment="defconf: drop invalid" connection-state=\
  20.     invalid
  21. add action=drop chain=forward comment=\
  22.     "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
  23.     connection-state=new in-interface-list=WAN
複製代碼
.

Nat rules:
  1. /ip firewall nat
  2. add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
  3.     out,none out-interface-list=WAN
複製代碼
.



歡迎光臨 電訊茶室 (http://telecom-cafe.com/forum/) Powered by Discuz! 7.2