ros\u7684\u9632\u706b\u5899\u975e\u5e38\u7075\u6d3b\uff0c\u5982\u679c\u914d\u4e0a\u6b63\u5219\u8868\u8fbe\u5f0f\u5219\u66f4\u4e3a\u5f3a\u5927\uff0c<\/p>\n\n\n\n
\u9632\u706bQ\u8fc7\u6ee4\u529f\u80fd\u6709\u4e09\u4e2a\u9ed8\u8ba4\u7684\u6570\u636e\u94fe\ue003chains\ue004\ue006input, forward\u548coutput \u4ed6\u4eec\u5206\u522b\u8d1f\u8d23\u4ece\u54ea\u91cc\u8fdb\u5165\u8def\u7531\u5668\u7684\u3001\u901a\u8fc7\u8def\u7531\u5668\u8f6c\u53d1\u7684\u4e0e\u4ece\u8def\u7531\u5668\u53d1\u51fa\u7684\u6570\u636e\u3002\u7528\u6237\u4e5f\u53ef\u7528\u81ea\u5b9a\u4e49\u6dfb\u52a0\u94fe\ue005\u5f53\u7136\u8fd9\u4e9b\u94fe\u6ca1\u6709\u9ed8\u8ba4\u7684\u4f20\u8f93\u914d\u7f6e\ue005\u9700\u8981\u5728\u4e09\u6761\u9ed8\u8ba4\u7684\u94fe\u4e2d\u5bf9action=jump\u7b56\u7565\u4e2d\u76f8\u5173\u7684jump-target\u8fdb\u884c\u914d\u7f6e\u3002<\/p>\n\n\n\n
\u4f8b\uff1a<\/p>\n\n\n\n
\u5efa\u7acb\u65b0\u7684\u8df3\u8f6c\u6570\u636e\u94fe\ue002chains\ue003\ue005<\/p>\n\n\n\n
add chain=forward protocol=tcp action=jump jump-target=tcp(\u65b0\u6570\u636e\u94fe\u540d) <\/p>\n\n\n\n
add chain=forward protocol=udp action=jump jump-target=udp <\/p>\n\n\n\n
add chain=forward protocol=icmp action=jump jump-target=icmp <\/p>\n\n\n\n
\u5efa\u7acbtcp-chain\u5e76\u62d2\u7edd\u4e00\u4e9btcp\u7aef\u53e3\ue005<\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=69 action=drop comment=”deny TFTP” <\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=111 action=drop comment=”deny RPC portmapper” add chain=tcp protocol=tcp dst-port=135 action=drop comment=”deny RPC portmapper” add chain=tcp protocol=tcp dst-port=137-139 action=drop comment=”deny NBT” <\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=445 action=drop comment=”deny cifs” <\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=2049 action=drop comment=”deny NFS” <\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment=”deny NetBus” add chain=tcp protocol=tcp dst-port=20034 action=drop comment=”deny NetBus” <\/p>\n\n\n\n
add chain=tcp protocol=tcp dst-port=3133 action=drop comment=”deny BackOriffice” add chain=tcp protocol=tcp dst-port=67-68 action=drop comment=”deny DHCP” <\/p>\n\n\n\n
\u5728udp-chain\u4e2d\u62d2\u7edd\u975e\u6cd5\u7684udp\u7aef\u53e3Deny udp ports in udp chain:<\/p>\n\n\n\n
add chain=udp protocol=udp dst-port=69 action=drop comment=”deny TFTP” <\/p>\n\n\n\n
add chain=udp protocol=udp dst-port=111 action=drop comment=”deny PRC portmapper” add chain=udp protocol=udp dst-port=135 action=drop comment=”deny PRC portmapper” add chain=udp protocol=udp dst-port=137-139 action=drop comment=”deny NBT” <\/p>\n\n\n\n
add chain=udp protocol=udp dst-port=2049 action=drop comment=”deny NFS” <\/p>\n\n\n\n
\u5728\u9632\u706b\u5899Layer7-protocol\u76ee\u5f55\u4e0b\ue005\u4f60\u53ef\u4ee5\u6dfb\u52a0\u6b63\u5219\u8868\u8fbe\u5f0f\u5b57\u7b26\u4e32\u534f\u8bae\ue005\u5b9a\u4e49\u4ed6\u4eec\u7684\u540d\u79f0\ue005\u5e76\u5728\u9632\u706b\u5899filter\u76ee\u5f55\u4e0b\u4e22\u5f03\u4ed6\u4eec\u7684\u6570\u636e\u3002\u9488\u5bf9\u4e00\u4e9b\u5e94\u7528\u7a0b\u5e8f\u5982skype\u3001QQ\u3001MSN\u3001\u9b54\u517d\u4e16\u754c\u2026\u2026\u7f51\u7edc\u7a0b\u5e8f\u505a\u9650\u5236\u548c\u8fc7\u6ee4<\/p>\n\n\n\n
DMZ \u914d\u7f6e\u4e8b\u4f8b<\/p>\n\n\n\n
\u8def\u7531\u5668\u4e00\u822c\u9700\u89813\u5f20\u7f51\u5361\ue003Public\u516c\u7f51\ue005Local\u672c\u5730\u7f51\u7edc\ue005DMZ-Zone\u975e\u519b\u4e8b\u533a<\/p>\n\n\n\n
\u7ed9\u76f8\u5e94\u7684Interface\u6dfb\u52a0\u5bf9\u5e94\u7684IP\u5730\u5740\ue005\u5982\u4e0b\ue006<\/p>\n\n\n\n
[admin@gateway] ip address> print<\/p>\n\n\n\n
Flags: X – disabled, I – invalid, D – dynamic<\/p>\n\n\n\n
# ADDRESS NETWORK BROADCAST INTERFACE<\/p>\n\n\n\n
0 192.168.0.2\/24 192.168.0.0 192.168.0.255 Public <\/p>\n\n\n\n
1 10.0.0.254\/24 10.0.0.0 10.0.0.255 Local <\/p>\n\n\n\n
2 10.1.0.1\/32 10.1.0.2 10.1.0.2 DMZ-zone <\/p>\n\n\n\n
3 192.168.0.3\/24 192.168.0.0 192.168.0.255 Public<\/p>\n\n\n\n
\u914d\u7f6eDMZ\u670d\u52a1\u5668\u7684IP\u5730\u5740\u4e3aIP\u5730\u574010.1.0.2\ue005\u7f51\u7edc\u5730\u5740\u6bb510.1.0.1\/24\ue005\u4ee5\u53ca\u7f51\u517310.1.0.1 <\/p>\n\n\n\n
\u914d\u7f6e\u80fd\u4ece\u56e0\u7279\u7f51\u8bbf\u95eeDMZ\u670d\u52a1\u7684dst-nat\u89c4\u5219\ue005\u5c06\u5730\u5740192.168.0.3\u914d\u7f6e\u7ed9DMZ\u670d\u52a1\u5668\ue006 [admin@gateway] ip firewall nat> add chain=dst-nat action=dst-nat \\ \\… dst-address=192.168.0.3 to-dst-address=10.1.0.2<\/p>\n\n\n\n
\u4e3a\u7f51\u7edc192.168.0.0\/24\u7684\u6240\u6709\u5ba2\u6237\u7aef\u6dfb\u52a0\u4e00\u4e2a\u9650\u5236\u4e0b\u8f7d\u6d41\u91cf\u4e3a2Mb\u4e0a\u4f20\u6d41\u91cf1Mb\u7684\u7b80\u5355\u961f\u5217\u89c4\u5219\u3002 <\/p>\n\n\n\n
[admin@MikroTik] queue simple> add name=Limit-Local target-address=192.168.0.0\/24 max-limit=1000000\/2000000<\/p>\n\n\n\n
\u8fd9\u91cc\u4e0d\u60f3\u8ba9\u670d\u52a1\u5668192\u3002168\u30020\u30021\u53d7\u5230\u6211\u4eec\u6dfb\u52a0\u4e0a\u9762\u89c4\u5219\u7684\u4efb\u4f55\u6d41\u91cf\u9650\u5236\ue005\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u6dfb\u52a0\u4e00\u4e2a\u6ca1\u6709\u4efb\u4f55\u9650\u5236\u7684\u89c4\u5219\ue003max-limit=0\/0\u4ee3\u8868\u6ca1\u6709\u4efb\u4f55\u9650\u5236\ue004\u5e76\u628a\u5b83\u79fb\u5230\u5217\u8868\u7684\u9876\u90e8\ue006 [admin@MikroTik] queue simple> add name=Server target-addresses=192.168.0.1\/32<\/p>\n\n\n\n
Queue tree HTB\u5b9e<\/p>\n\n\n\n
\u901a\u8fc7\u7528new-connection-mark\u6807\u8bb0\u5411\u5916\u7684\u8fde\u63a5\ue005\u5e76\u91c7\u53d6mark-connection\u52a8\u4f5c\u3002\u5f53\u8fd9\u4e2a\u5b8c\u6210\u65f6\u4f60\u53ef\u4ee5\u4f7f\u7528new-packet-mark\u6807\u8bb0\u5c5e\u4e8e\u8fd9\u4e2a\u8fde\u63a5\u7684\u6240\u6709\u6570\u636e\u5305\u5e76\u91c7\u7528mark-packet\u3002 \u9996\u5148VIP\u6570\u636e\u6807\u8bb0\ue005\u6211\u4eec\u901a\u8fc7ip firewall address-list\u5b9a\u4e49VIP\u7528\u6237\u7684\u5730\u5740\u5217\u8868\ue005\u5b9a\u4e49\u5b8c\u6210\u540e\u901a\u8fc7src-address-list\u8c03\u7528<\/p>\n\n\n\n
chain=forward action=mark-connection new-connection-mark=vip passthrough=yes src-address-list=vip <\/p>\n\n\n\n
chain=forward action=mark-packet new-packet-mark=vip passthrough=no connection-mark=vip<\/p>\n\n\n\n
\u8ddf\u7740\u5b9a\u4e49web\u6570\u636e\ue002\u8fd9\u91cc\u6211\u4eec\u9700\u8981\u9488\u5bf9\u8bbf\u95ee\u7f51\u9875\u7684tcp\/80\u7aef\u53e3\u548c\u57df\u540d\u89e3\u6790\u7684DNS\u7aef\u53e3tcp\/53\u548cudp\/53\u7aef\u53e3\u6807\u8bb0\ue003<\/p>\n\n\n\n
2 ;;; web chain=forward action=mark-connection new-connection-mark=web passthrough=yes protocol=tcp dst-port=80 <\/p>\n\n\n\n
3 chain=forward action=mark-connection new-connection-mark=web passthrough=yes protocol=tcp dst-port=53 <\/p>\n\n\n\n
4 chain=forward action=mark-connection new-connection-mark=web passthrough=yes protocol=udp dst-port=53 <\/p>\n\n\n\n
5 chain=forward action=mark-packet new-packet-mark=web passthrough=no connection-mark=web<\/p>\n\n\n\n
\u6807\u8bb0\u6570\u636e\u5b8c\u6210\u540e\ue002\u6211\u4eec\u8fdb\u5165queue tree\u4e2d\ue002\u5bf9\u6570\u636e\u8fdb\u884c\u4f18\u5148\u7ea7\u7684\u914d\u7f6e<\/p>\n\n\n\n
\u6211\u4eec\u8fdb\u5165forward\u94fe\u8868\ue002\u6dfb\u52a0\u4e00\u6761\u8df3\u8f6c\u7684\u89c4\u5219\ue002\u5c06forward\u4e2d\u6240\u6709\u6570\u636e\u9996\u5148\u8fdb\u5165dstgames\u7684\u94fe\u8868\u8fc7\u6ee4\u4e00\u6b21\ue002\u5c06\u6e38\u620f\u5206\u79bb\u51fa\u6765 \/ip firewall mangle add chain=forward action=jump jump-target=dstgam<\/p>\n\n\n\n
\u8fde\u63a5\u6807\u8bb0\ue002\u7528\u4e8e\u533a\u5206\u7f51\u9875\u89c6\u9891\u7684\u901f\u7387\ue002 chain=forward action=mark-connection new-connection-mark=web_video passthrough=yes protocol=tcp dst-port=80 connection-bytes=700000-0 connection-rate=70k-10<\/p>\n\n\n\n
HTB\u4ee4\u724c\u6876\u65b9\u5f0f\u63a7\u5236\u5404\u4e2a\u6570\u636e\u7684\u4f18\u5148\u7ea7\ue003\u5e76\u901a\u8fc7PCQ\u52a8\u6001\u5206\u914d\u5e26\u5bbd\ue003\u6211\u4eec\u8fdb\u5165queue\u7684tree\u8bbe\u7f6eHTB\ue003\u4f46\u6211\u4eec\u9996\u5148\u8fd8\u662f\u8981\u5148\u8bbe\u7f6ePCQ\u53c2\u6570 \u8fdb\u5165queue type\u6dfb\u52a0PCQ\u89c4\u5219\ue003\u6211\u4eec\u6dfb\u52a0\u4e00\u4e2adown\u7684PCQ\ue003kind= pcq\ue003rate\u8bbe\u7f6e\u6bcf\u53f0\u4e3b\u673a\u7684\u5e26\u5bbd\ue003\u8fd9\u91cc\u6211\u4eec\u9009\u62e90\ue003\u5373\u52a8\u6001\u5206\u914d\u5e26\u5bbd\ue003\u4f60\u4e5f\u53ef\u4ee5\u8bbe\u7f6e\u4e00\u4e2a\u56fa\u5b9a\u503c\ue003\u4ee5k\u6216\u8005m\u4e3a\u5355\u4f4d\ue003\u9009\u62e9dst-address\u4e3a\u4e0b\u884c\u7684\u89c4\u5219<\/p>\n\n\n\n
masquerade – \u4ee5\u4e00\u4e2a\u8def\u7531\u7b56\u7565\u81ea\u52a8\u5206\u914d\u7684IP\u5730\u5740\u53d6\u4ee3IP\u5305\u7684\u6e90\u5730<\/p>\n\n\n\n
netmap – \u521b\u9020\u4e00\u4e2aIP\u5730\u5740\u4ece\u4e00\u7aef\u5230\u53e6\u4e00\u7aef\u7684\u9759\u60011\ue0091\u6620\u50cf\u3002\u901a\u5e38\u7528\u4e8e\u5206\u914d\u516c\u7528IP\u5730\u5740\u5230\u4e13\u7528\u5185\u7f51\u7684\u4e3b\u673a\u4e0a<\/p>\n\n\n\n
passthrough – \u5ffd\u7565\u6b21\u6761\u89c4\u5219\u5e76\u8f6c\u5230\u4e0b\u4e00\u4e2a\u89c4\u5219<\/p>\n\n\n\n
redirect – \u628aIP\u5305\u7684\u76ee\u7684\u5730\u5740\u66ff\u6362\u6210\u4e00\u4e2a\u8def\u7531\u5668\u7684\u672c\u5730\u5730\u5740<\/p>\n\n\n\n
\u5bf9\u516c\u7528\u63a5\u53e3\u6dfb\u52a0\u516c\u7528IP\ue008 \/ip address add address=10.5.8.200\/24 interface=Public \u6dfb\u52a0\u5141\u8bb8\u5916\u90e8\u7f51\u7edc\u8bbf\u95ee\u672c\u5730\u670d\u52a1\u5668\u7684\u89c4\u5219\ue008 \/ip firewall nat add chain=dstnat dst-address=10.5.8.200 action=dst-nat \\ to-addresses=192.168.0.109<\/p>\n\n\n\n
\u5982\u679c\u4f60\u60f3\u4ece\u516c\u7528IP\u5b50\u7f5111.11.11.1\/32\u8bbf\u95ee\u672c\u5730\u76842.2.2.2\/32\ue003\u4f60\u5e94\u8be5\u4f7f\u7528\u76ee\u7684\u5730\u5740\u7ffb\u8bd1\u4ee5\u53ca\u6e90\u5730\u5740\u7ffb\u8bd1\u7279\u6027\u8bbe\u7f6eaction=netmap\u3002<\/p>\n\n\n\n
\/ip firewall nat add chain=dstnat dst-address=11.11.11.1 \\ action=netmap to-addresses=2.2.2.2 <\/p>\n\n\n\n
\/ip firewall nat add chain=srcnat src-address=2.2.2.2 \\ action=netmap to-addresses=11.11.11.1<\/p>\n\n\n\n
\u3002Mangle\u6807\u8bb0\u4ec5\u5b58\u5728\u4e8e\u8be5\u8def\u7531\u5668\u4e2d\ue005\u4ed6\u4eec\u65e0\u6cd5\u4f20\u8f93\u5230\u7f51\u7edc\u4e2d\u53bb\u3002 \u6839\u636e\u6570\u636e\u4f20\u8f93\u65b9\u5f0f\u4e0d\u540c\u53ef\u4ee5\u9009\u62e9\ue006<\/p>\n\n\n\n
? Prerouting\ue004\u8def\u7531\u524d\ue003\u5e38\u7528\u4e8e\u6807\u8bb0\u7b56\u7565\u548c\u7aef\u53e3\u8def\u7531<\/p>\n\n\n\n
? Input\ue004\u8fdb\u5165\u8def\u7531\u5668\u7684\u6570\u636e<\/p>\n\n\n\n
? Foreward\ue004\u901a\u8fc7\u8def\u7531\u8f6c\u53d1\ue003\u7528\u4e8e\u4fee\u6539TTL\u3001TCP-MSS\u548c\u6d41\u91cf\u63a7\u5236\u89c4\u5219 <\/p>\n\n\n\n
? Output\ue004\u6570\u636e\u8f93\u51fa<\/p>\n\n\n\n
? Prostrouting\ue004\u8def\u7531\u540e<\/p>\n\n\n\n
\u6807\u8bb0IP\u6570\u636e\u6d41\u7684\u4e09\u79cd\u7c7b\u578b\ue003\u8fd9\u4e09\u79cd\u7c7b\u578b\u4f1a\u5728\u5404\u79cd\u5e94\u7528\u4e2d\u591a\u6b21\u51fa\u73b0\ue003\u7279\u522b\u662fQueue\u7684\u6d41\u91cf\u63a7\u5236\u548cip route\u7684\u8def\u7531\ue004<\/p>\n\n\n\n
? Mark-connection\ue004\u6807\u8bb0\u6240\u6709IP\u6d41\u7684\u8fde\u63a5<\/p>\n\n\n\n
? Mark-packet\ue004\u6807\u8bb0IP\u6d41\u4e2d\u6570\u636e\u5305<\/p>\n\n\n\n
? Mark-routing\ue004\u6807\u8bb0IP\u6d41\u4e2dIP\u6570\u636e\u5305\u7684\u8def\u7531\u4fe1\u606f<\/p>\n\n\n\n
\u4e09\u79cd\u7c7b\u578b\u7684\u5173\u7cfb\ue003\u6240\u6709\u7684\u5728IP\u6570\u636e\u5305\u4f20\u8f93\u524d\ue003\u9996\u5148\u9700\u8981\u901a\u8fc7\u5efa\u7acbTCP\/UDP\u8fde\u63a5\ue003\u8fdb\u884c\u4f20\u8f93\u3002\u6240\u4ee5\u5f53\u6570\u636e\u901a\u8fc7IP\u6d41\u8fdb\u5165Mangle\u540e\ue003\u5efa\u7acb\u76f8\u5e94\u7684\u8fde\u63a5\u6807\u8bb0\ue003\u5e76\u4ece\u8fde\u63a5\u6807\u8bb0\u4e2d\u63d0\u53d6\u6570\u636e\u5305\ue003\u505a\u5904\u7406<\/p>\n","protected":false},"excerpt":{"rendered":"
ros\u7684\u9632\u706b\u5899\u975e\u5e38\u7075\u6d3b\uff0c\u5982\u679c\u914d\u4e0a\u6b63\u5219\u8868\u8fbe\u5f0f\u5219\u66f4\u4e3a\u5f3a\u5927\uff0c \u9632\u706bQ\u8fc7\u6ee4\u529f\u80fd\u6709\u4e09\u4e2a\u9ed8\u8ba4\u7684\u6570\u636e\u94fe\ue003chains\ue004\ue006in […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-198","post","type-post","status-publish","format-standard","hentry","category-11"],"_links":{"self":[{"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/posts\/198","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/comments?post=198"}],"version-history":[{"count":0,"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/posts\/198\/revisions"}],"wp:attachment":[{"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/media?parent=198"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/categories?post=198"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.xtaa.cn\/index.php\/wp-json\/wp\/v2\/tags?post=198"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}