SASA DESIGN

/ip firewall filter

add action=jump chain=forward comment=”“ disabled=no in-interface=intif jump-target=INTERNET

add action=jump chain=forward comment=”“ disabled=no jump-target=ppp.out

add action=accept chain=forward comment=”“ disabled=no in-interface=outif1

add action=accept chain=forward comment=”“ disabled=no in-interface=outif2

add action=drop chain=forward comment=”“ disabled=no

add action=accept chain=INTERNET comment=”Wytreshno PC” disabled=no src-address=192.168.0.2

add action=accept chain=INTERNET comment=”Laptop” disabled=no src-address=192.168.0.3

add action=accept chain=ppp.out comment=”PPP Klienti” disabled=no src-address=10.3.0.0/16

add action=accept chain=input comment=”Accept established connections” connection-state=established disabled=no

add action=accept chain=input comment=”Accept related connections” connection-state=related disabled=no

add action=drop chain=input comment=”Drop invalid connections” connection-state=invalid disabled=no

add action=accept chain=input comment=UDP disabled=no protocol=udp

add action=accept chain=input comment=”Allow limited pings” disabled=no limit=50/5s,2 protocol=icmp

add action=drop chain=input comment=”Drop excess pings” disabled=no protocol=icmp

add action=accept chain=input comment=”SSH for secure shell” disabled=no dst-port=22 protocol=tcp

add action=accept chain=input comment=winbox disabled=no dst-port=8291 protocol=tcp

add action=accept chain=input comment=”Other Access Networks” disabled=no src-address=192.168.0.0/16

add action=accept chain=input comment=”Vytreshna mreja” disabled=no src-address=10.0.0.0/24

add action=log chain=input comment=”Log na wsichko” disabled=no log-prefix=”DROP INPUT”

add action=drop chain=input comment=”Drop na wsichko” disabled=no

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”Port scanners to list ” disabled=no protocol=tcp psd=21,3s,3,1

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”NMAP FIN Stealth scan” disabled=no protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”SYN/FIN scan” disabled=no protocol=tcp tcp-flags=fin,syn

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”SYN/RST scan” disabled=no protocol=tcp tcp-flags=syn,rst

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”FIN/PSH/URG scan” disabled=no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”ALL/ALL scan” disabled=no protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg

add action=add-src-to-address-list address-list=”port scanners” address-list-timeout=2w chain=input comment=”NMAP NULL scan” disabled=no protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg

add action=drop chain=input comment=”dropping port scanners” disabled=no src-address-list=”port scanners”

add action=drop chain=virus comment=”Drop Blaster Worm” disabled=no dst-port=135-139 protocol=tcp

add action=drop chain=virus comment=”Drop Messenger Worm” disabled=no dst-port=135-139 protocol=udp

add action=drop chain=virus comment=”Drop Blaster Worm” disabled=no dst-port=445 protocol=tcp

add action=drop chain=virus comment=”Drop Blaster Worm” disabled=no dst-port=445 protocol=udp

add action=drop chain=virus comment=________ disabled=no dst-port=593 protocol=tcp

add action=drop chain=virus comment=________ disabled=no dst-port=1024-1030 protocol=tcp

add action=drop chain=virus comment=”Drop MyDoom” disabled=no dst-port=1080 protocol=tcp

add action=drop chain=virus comment=________ disabled=no dst-port=1214 protocol=tcp

add action=drop chain=virus comment=”ndm requester” disabled=no dst-port=1363 protocol=tcp

add action=drop chain=virus comment=”ndm server” disabled=no dst-port=1364 protocol=tcp

add action=drop chain=virus comment=”screen cast” disabled=no dst-port=1368 protocol=tcp

add action=drop chain=virus comment=hromgrafx disabled=no dst-port=1373 protocol=tcp

add action=drop chain=virus comment=cichlid disabled=no dst-port=1377 protocol=tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=1433-1434 protocol=tcp

add action=drop chain=virus comment=”Bagle Virus” disabled=no dst-port=2745 protocol=tcp

add action=drop chain=virus comment=”Drop Dumaru.Y” disabled=no dst-port=2283 protocol=tcp

add action=drop chain=virus comment=”Drop Beagle” disabled=no dst-port=2535 protocol=tcp

add action=drop chain=virus comment=”Drop Beagle.C-K” disabled=no dst-port=2745 protocol=tcp

add action=drop chain=virus comment=”Drop MyDoom” disabled=no dst-port=3127-3128 protocol=tcp

add action=drop chain=virus comment=”Drop Backdoor OptixPro” disabled=no dst-port=3410 protocol=tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=tcp

add action=drop chain=virus comment=Worm disabled=no dst-port=4444 protocol=udp

add action=drop chain=virus comment=”Drop Sasser” disabled=no dst-port=5554 protocol=tcp

add action=drop chain=virus comment=”Drop Beagle.B” disabled=no dst-port=8866 protocol=tcp

add action=drop chain=virus comment=”Drop Dabber.A-B” disabled=no dst-port=9898 protocol=tcp

add action=drop chain=virus comment=”Drop Dumaru.Y” disabled=no dst-port=10000 protocol=tcp

add action=drop chain=virus comment=”Drop MyDoom.B” disabled=no dst-port=10080 protocol=tcp

add action=drop chain=virus comment=”Drop NetBus” disabled=no dst-port=12345 protocol=tcp

add action=drop chain=virus comment=”Drop Kuang2″ disabled=no dst-port=17300 protocol=tcp

add action=drop chain=virus comment=”Drop SubSeven” disabled=no dst-port=27374 protocol=tcp

add action=drop chain=virus comment=”Drop PhatBot, Agobot, Gaobot” disabled=no dst-port=65506 protocol=tcp

add action=jump chain=forward comment=”jump to the virus chain” disabled=no jump-target=virus