2026年3月8日星期日  
 
网站首页Mikrotik技术华为技术运维管理网络理论文章文档下载
首页 >> Mikrotik技术 >>
更新时间:2024-01-27点击次数:405
ROS防止内外部端口扫描的防火墙策略
/ip firewall filter
add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=”port_scanners” address-list-timeout=2w comment=”Port scanners to list ” disabled=no 
add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=”port_scanners” address-list-timeout=2w comment=”NMAP FIN Stealth scan” disabled=no 
add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list=”port_scanners” address-list-timeout=2w comment=”FIN/PSH/URG scan” disabled=no 
add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list=”port_scanners” address-list-timeout=2w comment=”ALL/ALL scan” disabled=no 
add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=”port_scanners” address-list-timeout=2w comment=”NMAP NULL scan” disabled=no 
add chain=input src-address-list=”port_scanners” action=drop comment=”dropping port scanners” disabled=no