ROS菜鸟系列6--防火墙简单应用.doc

ROS的filter规则等同于华为或者思科的ACL规则，安装好的ROS系统，在初始情况下，默认的防火规则有三种：input,output,forward三种链。简单说一下每一种的作用：input是指作用于所有去访问路由器本身的数据流，output是指作用于从路由器本身发出或者回应给其他访问的数据流，forward是指作用于通过路由器转发的数据流，主要是用于过滤内网用户与外网的数据交互。举些简单的应用例子：1)假定不允许从IP地址是192.168.1.100的机器登录路由器：adminMikroTik ipadminMikroTik /ip firewall filteradminMikroTik /ip firewall filter add chain=input src-address=192.168.1.100 action=dropadminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=drop src-address=192.168.1.1002)假定不允许路由器回应外网用户的PING探测：adminMikroTik /ip firewall filter add chain=output protocol=icmp out-interface=wan icmp-options=0 action=drop adminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=drop src-address=192.168.1.100 1 chain=output action=drop protocol=icmp out-interface=wan icmp-options=0:0-255 解释相关的部分参数：protocol参数是指选择的协议，如TCP,UDP,ICMP等。icmp-options意思是指ICMP的选项，代码0表示：echo replay。3)假定禁止内网的机器使用192.168.1.200-192.168.1.220的IP地址访问外部网络adminMikroTik /ip firewall filter add chain=forward src-address=192.168.1.200-192.168.1.220 action=dropadminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=drop src-address=192.168.1.100 1 chain=output action=drop protocol=icmp out-interface=wan icmp-options=0:0-255 2 chain=forward action=drop src-address=192.168.1.200-192.168.1.220 4)假定要实现防止外部网络使用TCP连接攻击路由器本身adminMikroTik /ip firewall filter add chain=input protocol=tcp connection-limit=5,32 action=add-src-to-address-list address-list=black-address address-list-timeout=1d adminMikroTik /ip firewall filter add chain=input src-address-list=black-address action=drop adminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=drop src-address=192.168.1.100 1 chain=output action=drop protocol=icmp out-interface=wan icmp-options=0:0-255 2 chain=forward action=drop src-address=192.168.1.200-192.168.1.220 3 chain=input action=add-src-to-address-list protocol=tcp address-list=black-address address-list-timeout=1d connection-limit=5,32 4 chain=input action=drop src-address-list=black-address 以上的功能实现也可以利用filter与mangle相互配合使用：adminMikroTik /ip firewall filter .adminMikroTik /ip firewall mangle adminMikroTik /ip firewall mangle add chain=input protocol=tcp connection-limit=5,32 action=add-src-to-address-list address-list=black-address address-list-timeout=1dadminMikroTik /ip firewall mangle printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=add-src-to-address-list protocol=tcp address-list=black-address address-list-timeout=1d connection-limit=5,32 adminMikroTik /ip firewall mangle .adminMikroTik /ip firewall filteradminMikroTik /ip firewall filter add chain=input src-address-list=black-address action=drop adminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=input action=drop src-address-list=black-address 解释一下相关部分参数：action=add-src-to-address-list意思是把引起超过限制连接数的源地址提取出来，放入名称为black-address 的地址列表中。address-list-timeout参数的意思是放进black-address 地址列表中的IP地址在多久后释放出来。connection-limit参数是配置连接数的限制，connection-limit=5,32 参数中5代表5个连接数，32是指IP地址的子网掩码，意思是每一个来访问路由器的源地址同时只允许最多建立5个TCP连接数。filter规则的默认执行顺序是从上往下的顺序执行，在执行的过程中可以对规则的action参数相关配置对执行顺序作跳转，如跳转到用户自定义的链执行完了会再返回原来的序列往下执行。5)假定为了抑制ICMP包攻击，设定对转发和路由本身的对ICMP的请求及回应的ICMP包数据进行限定adminMikroTik /ip firewall filter add chain=icmp protocol=icmp icmp-options=0 limit=5,32 action=accept adminMikroTik /ip firewall filter add chain=icmp protocol=icmp icmp-options=8limit=5,32 action=accept adminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=icmp action=accept protocol=icmp icmp-options=0:0-255 limit=5,32 1 chain=icmp action=accept protocol=icmp icmp-options=8:0-255 limit=5,32 解释一下相关部分参数： chain=icmp意思是建立自定义的链ICMPadminMikroTik /ip firewall filter add chain=input protocol=icmp action=jump jump-target=icmpadminMikroTik /ip firewall filter add chain=forward protocol=icmp action=jump jump-target=icmp adminMikroTik /ip firewall filter printFlags: X - disabled, I - invalid, D - dynamic 0 chain=icmp action=accept protocol=icmp icmp-options=0:0-255 limit=5,32 1 chain=icmp action=accept protocol=icmp icmp-options=8:0-255 limit=5,32 2 chain=input action=jump jump-target=icmp protocol=icmp 3 chain=forward action=jump jum