Подскажите, способен ли на жизнедеятельность такой конфиг? Именно в таком виде. (больше интерисует правильность первых правил JUMP)
Или как-то лучше перетосовать для более правильной работы?
Код: Выделить всё
/ip firewall filter
add action=jump chain=input comment="Check for bad stuff in \"Attack\" chain" \
jump-target=Attacks
add action=jump chain=input comment=\
"Check for bad stuff in \"portscaners\" chain" jump-target=portscaners
add action=drop chain=input comment="dropping port scanners" \
src-address-list="port scanners"
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface-list=WAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=accept chain=forward comment="defconf: Local GW" \
in-interface-list=LAN out-interface-list=LAN
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" in-interface-list=WAN
add action=log chain=log disabled=yes
add action=log chain=log disabled=yes
add action=drop chain=Attacks comment=\
"Drop connections FROM blacklisted hosts" src-address-list=intrusBL
add action=drop chain=Attacks comment="Drop connections TO blacklisted hosts" \
dst-address-list=intrusBL
add action=drop chain=Attacks comment="Invalid TCP source port (0)" protocol=\
tcp src-port=0
add action=drop chain=Attacks comment="Invalid TCP destination port (0)" \
dst-port=0 protocol=tcp
add action=drop chain=Attacks comment="Invalid UDP source port (0)" protocol=\
udp src-port=0
add action=drop chain=Attacks comment="Invalid UDP destination port (0)" \
dst-port=0 protocol=udp
add action=drop chain=Attacks comment=\
"Invalid packets (No valid current connection)" connection-state=invalid
add action=return chain=Attacks comment="Return to the chain that jumped"
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment=\
"Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="NMAP FIN Stealth scan" \
protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="SYN/FIN scan" \
protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="SYN/RST scan" \
protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="FIN/PSH/URG scan" \
protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="ALL/ALL scan" \
protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=portscaners comment="NMAP NULL scan" \
protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=return chain=portscaners comment="Return to the chain that jumped"
