Хочу вынести на суд общественности конфиг фаервола, в домашнем режиме - работает отлично, не смотря на то, что за ним стоят сервера с выходом в мир
Планирую его внедрить в сегмент с 1500 активными абонентами.
Будет стоять на CCR 1036, общий аплинк сейчас гигабит, в ближайшее время увеличится до 2-х гигабит, аплинк загружен на 90% днём и на 35% ночью поток траффика - постоянен. Поднята своя BGP и забираем фуллвью от обоих магистралов, но это пока не важно, важен фаер, прозрачный для абонентов, и в то-же время фильтрующий не нужный трафф
fastnetmon - установлен и настроен для полого мониторинга и отправления "ддосеров" в блекхолл
Все изменения и дополнения приветствуются
Код: Выделить всё
/ip firewall filter
add action=fasttrack-connection chain=forward comment="############### FastTrack ###############" connection-state=established,related routing-mark=!to_tor
add action=accept chain=forward connection-state=established,related routing-mark=!to_tor
add action=accept chain=forward comment="####################################################################################" disabled=yes
add action=accept chain=input log-prefix=ping protocol=icmp
add action=jump chain=forward comment="############### DDoS ###############" connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,256,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=10m chain=detect-ddos connection-limit=500,32
add action=add-src-to-address-list address-list=ddoser address-list-timeout=10m chain=detect-ddos connection-limit=500,32
add action=drop chain=forward comment="############### Drop Invalid connections ###############" connection-state=invalid
add action=drop chain=input comment="############### drop ftp brute forcers ###############" dst-port=21 in-interface-list=WAN protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=1h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="############### drop ssh and telnet brute forcers ###############" dst-port=22,23 in-interface-list=WAN protocol=tcp src-address-list=bruteforces_blacklist
add action=add-src-to-address-list address-list=bruteforces_blacklist address-list-timeout=1h chain=input connection-state=new dst-port=22,23 protocol=tcp src-address-list=bruteforces_blacklist_stage3
add action=add-src-to-address-list address-list=bruteforces_blacklist_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22,23 protocol=tcp src-address-list=bruteforces_blacklist_stage2
add action=add-src-to-address-list address-list=bruteforces_blacklist_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22,23 protocol=tcp src-address-list=bruteforces_blacklist_stage1
add action=add-src-to-address-list address-list=bruteforces_blacklist_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22,23 protocol=tcp src-address-list=!my-network
add action=add-src-to-address-list address-list=ddos-blacklist address-list-timeout=30m chain=input comment="############### DDoS - Limit_incoming connections, add IP to Blacklist (WAN List) ###############" connection-limit=100,32 in-interface-list=WAN protocol=tcp
add action=tarpit chain=input comment="############### DDoS - capture and hold_connections, try to slow the attacker ###############" connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=jump chain=forward comment="############### DDoS - SYN Flood protect (WAN List) ###############" connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface-list=WAN jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect connection-state=new limit=200,5:packet protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect connection-state=new protocol=tcp tcp-flags=syn
/ip firewall raw
add action=add-dst-to-address-list address-list=ddosed address-list-timeout=10m chain=detect-ddos comment="Detect DDoS"
add action=add-src-to-address-list address-list=ddoser address-list-timeout=10m chain=detect-ddos
add action=drop chain=prerouting src-address-list=ddoser
add action=drop chain=prerouting src-address-list=port_scanners
add action=add-src-to-address-list address-list=dnsflood address-list-timeout=1h chain=prerouting comment="DNS flood protect (WAN List)" dst-port=53 in-interface-list=WAN log-prefix=dnsflood protocol=udp
add action=drop chain=prerouting src-address-list=dnsflood
add action=drop chain=prerouting src-address=!192.168.2.0/24
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="Port scanners to list" protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=1h chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg