Skip to content

Commit 4fc6ff0

Browse files
Disassembler0Disassembler0
committed
Add firewall scripts
1 parent d11596d commit 4fc6ff0

File tree

2 files changed

+110
-0
lines changed

2 files changed

+110
-0
lines changed

‎firewall/firewall-input.rsc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/ip firewall filter
2+
3+
# INPUT - General
4+
add action=accept chain=input comment="Allow 6to4" protocol=ipv6
5+
add action=accept chain=input comment="Allow ICMP" protocol=icmp
6+
add action=accept chain=input comment="Allow Broadcast" dst-address-type=broadcast
7+
add action=accept chain=input comment="Allow local CAPsMAN" dst-address=127.0.0.1 dst-port=5246,5247 protocol=udp src-address=127.0.0.1
8+
9+
# INPUT - LAN Services
10+
add action=jump chain=input comment="Jump to \"IN - LAN Services\" rules" in-interface=bridge1-local jump-target="IN - LAN Services"
11+
add action=accept chain="IN - LAN Services" comment="Allow DNS" dst-port=53 protocol=udp
12+
add action=accept chain="IN - LAN Services" comment="Allow DNS" dst-port=53 protocol=tcp
13+
add action=accept chain="IN - LAN Services" comment="Allow DHCP" dst-port=67 protocol=udp
14+
add action=accept chain="IN - LAN Services" comment="Allow CAPsMAN" dst-port=5246 protocol=udp
15+
add action=return chain="IN - LAN Services" comment="Return from \"IN - LAN Services\" rules"
16+
17+
# INPUT - Admin Services
18+
add action=jump chain=input comment="Jump to \"IN - Admin Services\" rules" jump-target="IN - Admin Services" src-address-list=Admins
19+
add action=accept chain="IN - Admin Services" comment="Allow SSH" dst-port=22 protocol=tcp
20+
add action=accept chain="IN - Admin Services" comment="Allow SNMP" dst-port=161 protocol=udp
21+
add action=accept chain="IN - Admin Services" comment="Allow WinBox " dst-port=8291 protocol=tcp
22+
add action=return chain="IN - Admin Services" comment="Return from \"IN - Admin Services\" rules"
23+
24+
# INPUT - General
25+
add action=accept chain=input comment="Allow established and related connections" connection-state=established,related
26+
add action=drop chain=input comment="Drop invalid connections" connection-state=invalid
27+
add action=drop chain=input comment="Drop everything else" log=yes log-prefix="IN FILTER:"

‎firewall/firewall-output.rsc‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
/ip firewall filter
2+
3+
# FORWARD - General
4+
add action=drop chain=forward comment="Drop blocked IPs" src-address-list=Blocked
5+
add action=drop chain=forward comment="Log and drop malware traffic" dst-address-list=Malware log=yes log-prefix="OUT MALWARE:"
6+
add action=accept chain=forward comment="Bypass firewall for allowed IPs" dst-address-list=Allowed
7+
8+
# FORWARD - Output from LAN clients
9+
add action=jump chain=forward comment="Jump to \"OUT - Clients\" rules" in-interface=bridge1-local jump-target="OUT - Clients" out-interface=ether1-WAN
10+
add action=accept chain="OUT - Clients" comment="Allow ICMP" protocol=icmp
11+
add action=accept chain="OUT - Clients" comment="Allow FTP" dst-port=21 protocol=tcp
12+
add action=accept chain="OUT - Clients" comment="Allow SSH" dst-port=22 protocol=tcp
13+
add action=accept chain="OUT - Clients" comment="Allow SMTP" dst-port=25 protocol=tcp
14+
add action=accept chain="OUT - Clients" comment="Allow DNS" dst-port=53 protocol=tcp
15+
add action=accept chain="OUT - Clients" comment="Allow DNS" dst-port=53 protocol=udp
16+
add action=accept chain="OUT - Clients" comment="Allow HTTP" dst-port=80 protocol=tcp
17+
add action=accept chain="OUT - Clients" comment="Allow POP3" dst-port=110 protocol=tcp
18+
add action=accept chain="OUT - Clients" comment="Allow NTP" dst-port=123 protocol=udp
19+
add action=accept chain="OUT - Clients" comment="Allow IMAP" dst-port=143 protocol=tcp
20+
add action=accept chain="OUT - Clients" comment="Allow SNMP" dst-port=161 protocol=udp
21+
add action=accept chain="OUT - Clients" comment="Allow LDAP" dst-port=389 protocol=tcp
22+
add action=accept chain="OUT - Clients" comment="Allow HTTPS" dst-port=443 protocol=tcp
23+
add action=accept chain="OUT - Clients" comment="Allow QUIC" dst-port=443 protocol=udp
24+
add action=accept chain="OUT - Clients" comment="Allow SMTPS" dst-port=465 protocol=tcp
25+
add action=accept chain="OUT - Clients" comment="Allow Syslog" dst-port=514 protocol=udp
26+
add action=accept chain="OUT - Clients" comment="Allow RTSP" dst-port=554 protocol=tcp
27+
add action=accept chain="OUT - Clients" comment="Allow RTSP" dst-port=554 protocol=udp
28+
add action=accept chain="OUT - Clients" comment="Allow Submission" dst-port=587 protocol=tcp
29+
add action=accept chain="OUT - Clients" comment="Allow LDAPS" dst-port=636 protocol=tcp
30+
add action=accept chain="OUT - Clients" comment="Allow Flash Socket Policy" dst-port=843 protocol=tcp
31+
add action=accept chain="OUT - Clients" comment="Allow SFTP" dst-port=990 protocol=tcp
32+
add action=accept chain="OUT - Clients" comment="Allow IMAPS" dst-port=993 protocol=tcp
33+
add action=accept chain="OUT - Clients" comment="Allow POP3S" dst-port=995 protocol=tcp
34+
add action=accept chain="OUT - Clients" comment="Allow SOCKS5" dst-port=1080 protocol=tcp
35+
add action=accept chain="OUT - Clients" comment="Allow Blizzard games" dst-port=1119,3724,6012,6112-6119 protocol=tcp
36+
add action=accept chain="OUT - Clients" comment="Allow Blizzard games" dst-port=1119,3724,6012,6112-6119 protocol=udp
37+
add action=accept chain="OUT - Clients" comment="Allow OpenVPN" dst-port=1194 protocol=tcp
38+
add action=accept chain="OUT - Clients" comment="Allow OpenVPN" dst-port=1194 protocol=udp
39+
add action=accept chain="OUT - Clients" comment="Allow Xbox" dst-port=1836,3074 protocol=tcp
40+
add action=accept chain="OUT - Clients" comment="Allow Xbox" dst-port=1836,3074,3544 protocol=udp
41+
add action=accept chain="OUT - Clients" comment="Allow MQTT" dst-port=1883 protocol=tcp
42+
add action=accept chain="OUT - Clients" comment="Allow RTMP" dst-port=1935 protocol=tcp
43+
add action=accept chain="OUT - Clients" comment="Allow Squid" dst-port=3128 protocol=tcp
44+
add action=accept chain="OUT - Clients" comment="Allow MySQL" dst-port=3306 protocol=tcp
45+
add action=accept chain="OUT - Clients" comment="Allow RDP" dst-port=3389 protocol=tcp
46+
add action=accept chain="OUT - Clients" comment="Allow STUN" dst-port=3478 protocol=tcp
47+
add action=accept chain="OUT - Clients" comment="Allow STUN" dst-port=3478 protocol=udp
48+
add action=accept chain="OUT - Clients" comment="Allow PlayStation" dst-port=3480,3658-3659 protocol=tcp
49+
add action=accept chain="OUT - Clients" comment="Allow Teredo" dst-port=3544 protocol=udp
50+
add action=accept chain="OUT - Clients" comment="Allow PlayStation" dst-port=3658-3659 protocol=udp
51+
add action=accept chain="OUT - Clients" comment="Allow Viber" dst-port=4244,5242 protocol=tcp
52+
add action=accept chain="OUT - Clients" comment="Allow Steam" dst-port=4379,4380,27000-27036 protocol=udp
53+
add action=accept chain="OUT - Clients" comment="Allow Signal" dst-port=4433 protocol=tcp
54+
add action=accept chain="OUT - Clients" comment="Allow SIP" dst-port=5060 protocol=tcp
55+
add action=accept chain="OUT - Clients" comment="Allow SIP" dst-port=5060 protocol=udp
56+
add action=accept chain="OUT - Clients" comment="Allow SIPS" dst-port=5061 protocol=tcp
57+
add action=accept chain="OUT - Clients" comment="Allow OSCAR" dst-port=5190 protocol=tcp
58+
add action=accept chain="OUT - Clients" comment="Allow XMPP" dst-port=5222 protocol=tcp
59+
add action=accept chain="OUT - Clients" comment="Allow XMPPS, Apple Push" dst-port=5223 protocol=tcp
60+
add action=accept chain="OUT - Clients" comment="Allow Google Play" dst-port=5228 protocol=tcp
61+
add action=accept chain="OUT - Clients" comment="Allow Viber" dst-port=5243,9785 protocol=udp
62+
add action=accept chain="OUT - Clients" comment="Allow XMPP Federation" dst-port=5269 protocol=tcp
63+
add action=accept chain="OUT - Clients" comment="Allow PostgreSQL" dst-port=5432 protocol=tcp
64+
add action=accept chain="OUT - Clients" comment="Allow VNC" dst-port=5900 protocol=tcp
65+
add action=accept chain="OUT - Clients" comment="Allow TeamViewer" dst-port=5938 protocol=tcp
66+
add action=accept chain="OUT - Clients" comment="Allow TeamViewer" dst-port=5938 protocol=udp
67+
add action=accept chain="OUT - Clients" comment="Allow SUPL" dst-port=7275 protocol=tcp
68+
add action=accept chain="OUT - Clients" comment="Allow Alternative HTTP" dst-port=8080 protocol=tcp
69+
add action=accept chain="OUT - Clients" comment="Allow WinBox" dst-port=8291 protocol=tcp
70+
add action=accept chain="OUT - Clients" comment="Allow Alternative HTTPS" dst-port=8443 protocol=tcp
71+
add action=accept chain="OUT - Clients" comment="Allow MQTTS" dst-port=8883 protocol=tcp
72+
add action=accept chain="OUT - Clients" comment="Allow TeamSpeak" dst-port=9987 protocol=udp
73+
add action=accept chain="OUT - Clients" comment="Allow TeamSpeak" dst-port=10011,30033 protocol=tcp
74+
add action=accept chain="OUT - Clients" comment="Allow Apple FaceTime" dst-port=16384-16387 protocol=udp
75+
add action=accept chain="OUT - Clients" comment="Allow Apple FaceTime" dst-port=16393-16402 protocol=udp
76+
add action=accept chain="OUT - Clients" comment="Allow Google Hangouts" dst-port=19302-19309 protocol=udp
77+
add action=accept chain="OUT - Clients" comment="Allow Google Hangouts" dst-port=19305-19309 protocol=tcp
78+
add action=accept chain="OUT - Clients" comment="Allow Steam" dst-port=27014-27050 protocol=tcp
79+
add action=accept chain="OUT - Clients" comment="Allow Windows Update" dst-port=40001-40046 protocol=tcp
80+
add action=accept chain="OUT - Clients" comment="Allow Windows Update" dst-port=40001-40046 protocol=udp
81+
add action=accept chain="OUT - Clients" comment="Allow established and related connections" connection-state=established,related
82+
add action=drop chain="OUT - Clients" comment="Drop invalid connections" connection-state=invalid
83+
add action=drop chain="OUT - Clients" comment="Log and drop everything else" log=yes log-prefix="OUT FILTER:"

0 commit comments

Comments
 (0)