Добрый день! Не могу разобраться где ошибка в конфигурации firewall, при активации последнего правила пропадает интернет:-( #Mikrotik RB2011UiAS-2HnD-IN /ip firewall address-list add address=0.0.0.0/8 disabled=no list=BOGON add address=10.0.0.0/8 disabled=no list=BOGON add address=100.64.0.0/10 disabled=no list=BOGON add address=127.0.0.0/8 disabled=no list=BOGON add address=169.254.0.0/16 disabled=no list=BOGON add address=172.16.0.0/12 disabled=no list=BOGON add address=192.0.0.0/24 disabled=no list=BOGON add address=192.0.2.0/24 disabled=no list=BOGON add address=192.168.0.0/16 disabled=no list=BOGON add address=198.18.0.0/15 disabled=no list=BOGON add address=198.51.100.0/24 disabled=no list=BOGON add address=203.0.113.0/24 disabled=no list=BOGON add address=224.0.0.0/4 disabled=no list=BOGON add address=240.0.0.0/4 disabled=no list=BOGON /ip firewall filter # Блокируем всех из чёрного списка add action=drop chain=input comment="Drop blocklist" dst-address-list=blocklist add action=drop chain=forward comment="Drop blocklist" dst-address-list=blocklist # Блокируем Bogon add action=drop chain=input comment=Bogon_Wan_Drop in-interface=internet \ src-address-list=BOGON # Блокируем DNS запросы на внешний интерфейс add action=drop chain=input comment="Drop DNS" dst-port=53 in-interface=internet protocol=udp add action=drop chain=input dst-port=53 in-interface=internet protocol=tcp add chain=input action=drop in-interface=internet protocol=udp dst-port=53 # Блокируем взлом Windows add action=drop chain=input comment="Block hole Windows" dst-port=135,137-139,445,593,4444 protocol=tcp add action=drop chain=forward dst-port=135,137-139,445,593,4444 protocol=tcp add action=drop chain=input dst-port=135,137-139 protocol=udp add action=drop chain=forward dst-port=135,137-139 protocol=udp # Блокируем некоторые порты add action=drop chain=tcp dst-port=69 protocol=tcp add action=drop chain=tcp dst-port=111 protocol=tcp add action=drop chain=tcp dst-port=2049 protocol=tcp add action=drop chain=tcp dst-port=12345-12346 protocol=tcp add action=drop chain=tcp dst-port=20034 protocol=tcp add action=drop chain=tcp dst-port=3133 protocol=tcp add action=drop chain=tcp dst-port=67-68 protocol=tcp add action=drop chain=udp dst-port=69 protocol=udp add action=drop chain=udp dst-port=111 protocol=udp add action=drop chain=udp dst-port=2049 protocol=udp add action=drop chain=udp dst-port=3133 protocol=udp # Фильтруем полезный ICMP add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="ICMP echo reply" add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="ICMP net unreachable" add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="ICMP host unreachable" add chain=icmp protocol=icmp icmp-options=3:4 action=accept comment="ICMP host unreachable fragmentation required" add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="ICMP allow source quench" add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="ICMP allow echo request" add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="ICMP allow time exceed" add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="ICMP allow parameter bad" add chain=icmp action=drop comment="ICMP deny all other types" # Защита от брутфорса SSH add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout= \ 30m chain=input connection-state=new dst-port=22 protocol=tcp \ src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout= \ 30m chain=input connection-state=new dst-port=22 protocol=tcp \ src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout= \ 30m chain=input connection-state=new dst-port=22 protocol=tcp # Защита от сканера портов add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="Port scanners to list" disabled=no # Комбинации TCP флагов, указывающих на использование сканера портов add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="NMAP FIN Stealth scan" add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="SYN/FIN scan" add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="SYN/RST scan" add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="FIN/PSH/URG scan" add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="ALL/ALL scan" add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w comment="NMAP NULL scan" # Запрет подключений сканеров портов add chain=input src-address-list=port_scanners action=drop comment="dropping port scanners" disabled=no add chain=forward src-address-list=port_scanners action=drop comment="dropping port scanners" disabled=no # OUTPUT add chain=output action=accept out-interface=ether1 comment="accept everything to internet" add chain=output action=accept out-interface=!ether1 comment="accept everything to non internet" add chain=output action=accept comment="accept everything" # FORWARD #fasttrack-connection forward add action=fasttrack-connection chain=forward connection-state=established,related # jumping add chain=forward protocol=tcp action=jump jump-target=tcp add chain=forward protocol=udp action=jump jump-target=udp add chain=forward protocol=icmp action=jump jump-target=icmp # accept forward from local to internet add chain=forward action=accept in-interface=!internet out-interface=internet comment="accept from local to internet" #Разрешаем все уже установленные подключения (connection state=established) add chain=input connection-state=established action=accept comment="allow established connections" # Разрешаем все зависимые подключения (connection state=related) add chain=input connection-state=related action=accept comment="allow related connections" # Разрешаем подключение только из нашей локальной сети add action=accept chain=input src-address=192.168.0.0/24 # Разрешаем внешние подключения для собственных нужд add action=accept chain=input dst-port=22 in-interface=internet protocol=tcp comment="Allow SSH" add action=accept chain=input dst-port=80 in-interface=internet protocol=tcp comment="Allow HTTP" add action=accept chain=input dst-port=161 in-interface=internet protocol=udp comment="Allow SNMP" add action=accept chain=input dst-port=443 in-interface=internet protocol=tcp comment="Allow HTTPS" add action=accept chain=input dst-port=1194 in-interface=internet protocol=tcp comment="Allow OpenVPN" add action=accept chain=input dst-port=1194 in-interface=internet protocol=udp add chain=input comment="Allow L2TP" dst-port=1701 in-interface=internet protocol=tcp add chain=input comment="Allow L2TP" dst-port=1701 in-interface=internet protocol=udp add chain=input comment="Allow PPTP" dst-port=1723 in-interface=internet protocol=tcp add chain=input comment="Allow GRE" in-interface=internet protocol=gre #Запрещаем недействительные соединения для цепочек input add chain=input connection-state=invalid action=drop comment="drop invalid connections" # Запрет транзита '''битых''' и '''неправильных''' пакетов add chain=forward connection-state=invalid action=drop comment="Drop Invalid connections" # Заперт установки новых транзитных входящих соединений на WAN порту add action=drop chain=forward comment="Drop new forward WAN" connection-state=new in-interface=internet # Запрет всех входящих на маршрутизатор add chain=input in-interface=internet action=drop comment="Drop everything else" # drop all other forward add chain=forward action=drop comment="drop everything else" /ip firewall nat add action=masquerade chain=srcnat out-interface=internet
