Re: v6.48.2 [stable]发布了!

• 2021年5月14日星期五上午10:08
  这是................如果我没说错的话，我在第一个帖子里也看到有人说PF不起作用。
  
  
  
  

  
  
  
  
  
  
  
  
  
  
  /接口桥
  添加名称=桥
  add disabled=yes name=Bridge_Guest
  /以太网接口
  set [find default-name=ether1] l2mtu=1598 name=WAN1
  set [find default-name=ether3] l2mtu=4064 mtu=4064 name=WAN2
  set [find default-name=ether2] l2mtu=4064 mtu=4064 name=ether2_LAN . set
  设置[find default-name=ether4] disabled=yes
  设置[find default-name=ether5] disabled=yes
  设置[find default-name=ether6] disabled=yes
  设置[find default-name=ether7] disabled=yes
  设置[find default-name=ether8] disabled=yes
  设置[find default-name=sfp1] disabled=yes
  /接口列表
  添加名称=局域网
  添加名称=广域网
  /interface无线安全配置文件
  设置[find default=yes] authentication-types=wpa2-psk eap-methods="" \
  模式= dynamic-keys supplicant-identity =雷竞技网站 MikroTik
  添加authentication-types=wpa2-psk eap-methods="" management-protection=\
  允许模式=dynamic-keys name=Xoleritsa supplicant-identity=""
  添加authentication-types=wpa2-psk eap-methods="" management-protection=\
  allowed mode=dynamic-keys name=Guest supplicant-identity=""
  添加authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
  雷竞技网站Mikrotik supplicant-identity = Mikrotik
  /接口的无线
  设置[find default-name=wlan1]天线增益=0波段=2ghz-b/g/n国家=\
  No_country_set默认转发=没有禁用=没有距离=室内\
  频率模式=手动-txpower安装=室内keepalive-frames=\
  禁用max-station-count=80 mode=ap-bridge multicast-buffering=\
  名称=wlan1_Mikrotik \雷竞技网站
  nv2-downlink-ratio=80安全配置文件=Mikrotik ss雷竞技网站id= Mikrotik \
  x-power=20 x-power-mode=all-rate -fixed wireless-protocol=802.11
  wps-mode =禁用
  add keepalive-frames=disabled mac-address=CE:2D:E0:8F:68:AE \
  master-interface=wlan1_雷竞技网站Mikrotik max-station-count=40 \
  multicast-buffering=disabled name=Guest security-profile=Guest ssid=\
  Guest wps- cost-range=0 wps- default-cost=0 wps-mode=disabled
  / ip池
  add name=DHCP_Local_pool ranges=10.157.138.100-10.157.138.200
  add name=DHCP_Guest_pool ranges=10.10.20.200-10.10.20.220
  / ip dhcp服务器
  add address-pool=DHCP_Local_pool disabled=no interface=Bridge lease-time=\
  4 = DHCP_Local w2d名称
  add address-pool=DHCP_Guest_pool interface=Bridge_Guest lease-time=1d \
  name = DHCP_Guest
  / ipv6 dhcp服务器
  add address-pool=ipv6-pool disabled=yes interface=Bridge name=server1
  / ipv6池
  add name=ipv6-pool-WAN1 prefix=2a02:85f:2e01:6400::/56 prefix-length=56
  添加name=pool1 prefix=2a02:85f::/56 prefix-length=64
  /队列类型
  增加kind=sfq name=sfq-default sfq-perturb=10
  /队列简单
  add bucket-size=0/0 disabled=yes max-limit=256k/6M name=Limit_Others \
  队列= sfq-default / sfq-default目标= " 10.157.138.103/32,10.157.138.104 \
  / 32、10.157.138.105/32 10.157.138.106/32 10.157.138.107/32,10.157.138.1 \
  08/32 10.157.138.109/32 10.157.138.110/32 10.157.138.111/32, 10.157.138 \
  .112/32、10.157.138.113/32 10.157.138.114/32 10.157.138.115/32,10.157.1 \
  38.116/32 10.157.138.117/32 10.157.138.118/32 10.157.138.119/32 10.157 \
  .138.120/32“total-queue = sfq-default
  add bucket-size=0/0 disabled=yes max-limit=256k/5M name=Limit_HTPC queue=\
  Sfq-default / Sfq-default target=10.157.138.102/32 total-queue=\
  sfq-default
  add bucket-size=0/0 disabled=yes max-limit=192k/6M name=Guest_Limit \
  Queue =sfq-default/sfq-default target=10.10.20.0/24
  sfq-default
  add bucket-size=0/0 disabled=yes dst=WAN1 max-limit=512k/12M name=\
  WAN1_Limit queue=sfq-default/sfq-default target=10.157.138.0/24 \
  total-queue = sfq-default
  add bucket-size=0/0 disabled=yes dst=WAN2 max-limit=512k/12M name=\
  WAN2_Limit queue=sfq-default/sfq-default target=10.157.138.0/24 \
  total-queue = sfq-default
  / snmp社区
  设置[find default=yes] addresses=0.0.0.0/0
  /系统日志操作
  设置0内存行=50
  设置1个磁盘行-每个文件=100
  /用户组
  设置完整策略="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox\ "
  、密码、网络嗅探、敏感、api,二大伙计,tikapp”
  /接口桥接端口
  add bridge=网桥接口=wlan1_Mikrotik雷竞技网站
  add bridge=网桥接口=ether2_LAN
  添加bridge=Bridge_Guest接口=Guest
  /接口网桥设置
  设置use-ip-firewall = yes
  执行命令/ip neighbor discovery-settings
  设置discover-interface-list = !动态
  / ip设置
  设置tcp-syncookies = yes
  / ipv6设置
  设置accept-router-advertisements = yes
  /接口detect-internet
  set detect-interface-list=WAN
  wan-interface-list =广域网
  /接口列表成员
  add interface=Bridge list=LAN
  add interface=WAN1 list=WAN
  add interface=WAN2 list=WAN
  add interface=Bridge_Guest list=LAN
  / ip地址
  add address=10.157.138.1/24 interface=网桥网络=10.157.138.0
  add address=192.168.0.2/24 interface=WAN1 network=192.168.0.0
  add address=10.10.20.1/24 disabled=yes interface=Bridge_Guest network=\
  10.10.20.0
  add address=192.168.2.3/24接口=WAN2网络=192.168.2.0
  /ip dhcp-server config
  设置store-leases-disk = 2 h
  /ip dhcp-server lease
  添加address=10.157.138.100 client-id=1:0:11:6b:c2:4:1 mac-address=\
  = DHCP_Local 00:11:6B: C2:04:01服务器
  添加address=10.157.138.101 client-id= 1:0:37:45:6a:43:e2 mac-address=\
  = DHCP_Local D0:37:45:6A: 43: E2服务器
  添加address=10.157.138.102 client-id= 1:0:37:45:e4:ef:26 mac-address=\
  D0:37:45: E4:服务器= DHCP_Local EF: 26
  /ip dhcp-server网络
  添加地址=10.10.20.0/24 dns-server=10.157.138.1网关=10.10.20.1
  添加地址=10.157.138.0/24 dns-server=10.157.138.1网关=10.157.138.1
  / ip dns
  设置allow-remote-requests=yes cache-max-ttl=1d max-concurrent-queries=200 \
  Max-concurrent-tcp-sessions =50个服务器=1.1.1.1,1.0.0.1
  use-doh-server =https://cloudflare-dns.com/dns-queryverify-doh-cert = \
  是的
  /ip DNS static
  添加地址=104.16.248.249 regexp=cloudflare-dns
  添加地址=104.16.249.249 regexp=cloudflare-dns
  /ip防火墙地址列表
  add address=91.121.222.150 list=Zlo_Games
  add address=51.68.50.232 list=Zlo_Games
  add address=87.98.168.112 list=Zlo_Games
  /ip防火墙过滤器
  add action=accept chain=input comment=" accept ICMP after RAW"协议=\
  icmp
  add action=accept chain=input comment=" accept input Established Related" \
  连接状态=建立联系
  add action=drop chain=input comment=" drop Invalid connections" \
  连接状态=无效
  add action=accept chain=input comment="允许所有LAN输入" \
  in-interface-list =局域网
  add action=drop chain=input comment=“删除所有其他输入”
  添加动作=接受链=转发评论=\
  "Accept forward Established Related"连接状态=\
  建立,相关
  add action=drop chain=forward comment=" drop Invalid connections" \
  连接状态=无效
  add action=accept chain=forward comment="允许所有LAN转发" \
  in-interface-list =局域网
  添加动作=删除链=转发评论=\
  “放下其他东西前进____!”DST_NAT“connection-nat-state = \
  dstnat !
  /ip firewall mangle
  add action=mark-routing chain=prerouting comment=_______HTPC_to_WAN1 \
  disabled=yes new-routing-mark=to_WAN2 passthrough=no port=443 \
  协议tcp src-address = = 10.157.138.102
  添加动作=标记-路由链=预路由注释=\
  "_______HTTP-S_Routing mark" disabled=yes new-routing-mark=to_WAN1 \
  Passthrough =no port= 80443 protocol=tcp src-address=10.157.138.0/24
  添加action=mark-routing chain=prerouting disabled=yes
  to_WAN1 passthrough=no port= 80443 protocol=udp src-address=\
  10.157.138.0/24
  add action=mark-routing chain=prerouting comment=_______Guests_to_WAN2 \
  disabled=yes new-routing-mark=to_WAN2 passthrough=no src-address=\
  10.10.20.0/24
  add action=mark-routing chain=prerouting comment=_______Music_to_WAN2 \
  new-routing-mark=to_WAN2 passthrough=no port=7062 protocol=tcp \
  src-address = 10.157.138.0/24
  添加动作=标记-路由链=预路由注释=\
  _______Remotes&Games_to_WAN1 new-routing-mark=to_WAN1 passthrough=no \
  端口=1320,17771,5000-5500,7985协议=udp src-address=\
  10.157.138.0/24
  添加action=mark-routing chain=prerouting dst-port="" new-routing-mark=\
  to_WAN1 passthrough=无端口=1320,12975,32976,4899,5938,48377 \
  协议tcp src-address = = 10.157.138.0/24
  add action=mark-routing chain=prerouting comment=_______ZLO_to_WAN1 \
  dst-address-list=Zlo_Games new-routing-mark=to_WAN1 passthrough=no \
  src-address = 10.157.138.100/31
  添加动作=标记-路由链=预路由注释=\
  "_______Torrents_to_WAN1或WAN2" disabled=yes new-routing-mark=\
  to_WAN2 passthrough=no port=8999-65535 protocol=tcp src-address=\
  10.157.138.100/31
  添加action=mark-routing chain=prerouting disabled=yes
  to_WAN2 passthrough=no port=8999-65535 protocol=udp src-address=\
  10.157.138.100/31
  添加动作=标记-连接链=输入评论=\
  _______Load_Balance_Mark_IN-OUT in-interface=WAN1 \
  new-connection-mark = WAN1_conn透传= no
  add action=mark-connection chain=input in-interface=WAN2 \
  new-connection-mark = WAN2_conn透传= no
  添加动作=标记-路由链=输出连接-标记=WAN1_conn \
  new-routing-mark = to_WAN1透传= no
  添加动作=标记-路由链=输出连接-标记=WAN2_conn \
  new-routing-mark = to_WAN2透传= no
  Add action=accept chain=prerouting comment=\
  _______ load_balance_accept_all_wan st-address=192.168.0.0/24 \
  在界面=桥
  添加action=accept chain=prerouting dst-address=192.168.2.0/24 \
  在界面=桥
  添加动作=标记-连接链=预路由评论=\
  "_______Load_Balance_Divider&Routing mark" dst-address-type=!当地\
  in-interface=Bridge new-connection-mark=WAN1_conn passthrough=yes \
  per-connection-classifier = both-addresses-and-ports: 2/0
  添加动作=标记连接链=预路由地址类型=!当地\
  in-interface=Bridge new-connection-mark=WAN2_conn passthrough=yes \
  per-connection-classifier = both-addresses-and-ports: 2/1
  add action=标记-路由链=预路由连接-标记=WAN1_conn \
  in-interface=Bridge new-routing-mark=to_WAN1 passthrough=no
  add action=标记-路由链=预路由连接-标记=WAN2_conn \
  in-interface=Bridge new-routing-mark=to_WAN2 passthrough=no
  add action=change-dscp chain=prerouting comment=_______DSCP_56_ICMP \
  New-dscp =56 passthrough=no protocol=icmp
  add action=change-dscp chain=post - strouting comment=_______DSCP_56_ICMP \
  New-dscp =56 passthrough=no protocol=icmp
  添加action=change-dscp chain=prerouting comment=\
  _______ dscp_56_dns - remote - games new-dscp=56 passthrough=no port=\
  53, 1320, 17771, 5000 - 5500, 4899, 5938, 12975, 32976, 48377 = udp协议
  Add action=change-dscp chain=post - strouting comment=\
  _______ dscp_56_dns - remote - games new-dscp=56 passthrough=no port=\
  53, 1320, 17771, 5000 - 5500, 4899, 5938, 12975, 32976, 48377 = udp协议
  添加action=change-dscp chain=prerouting comment=\
  _______DSCP_48_HTTP-S_SMALL connection-bytes=0-500000 new-dscp=48 \
  Passthrough =无端口= 80443,8080,7062协议=tcp
  Add action=change-dscp chain=post - strouting comment=\
  _______DSCP_48_HTTP-S_SMALL connection-bytes=0-500000 new-dscp=48 \
  Passthrough =无端口= 80443,8080,7062协议=tcp
  添加action=change-dscp chain=prerouting comment=\
  _______DSCP_22_HTTP-S_LARGE new-dscp=22 passthrough=no port=\
  80443、8080 = tcp协议
  Add action=change-dscp chain=post - strouting comment=\
  _______DSCP_22_HTTP-S_LARGE new-dscp=22 passthrough=no port=\
  80443、8080 = tcp协议
  add action=change-dscp chain=prerouting comment=_______ dscp_0_torrent \
  New-dscp =0 passthrough=no port=8999-65355 protocol=tcp
  add action=change-dscp chain=post - strouting comment=_______ dscp_0_torrent \
  New-dscp =0 passthrough=no port=8999-65355 protocol=tcp
  add action=change-dscp chain=prerouting comment=_______ dscp_0_torrent \
  New-dscp =0 passthrough=no port=8999-65355 protocol=udp
  add action=change-dscp chain=post - strouting comment=_______ dscp_0_torrent \
  New-dscp =0 passthrough=no port=8999-65355 protocol=udp
  添加action=change-dscp chain=prerouting comment=\
  "_______DSCP_12_All others" new-dscp=12 passthrough=no
  Add action=change-dscp chain=post - strouting comment=\
  "_______DSCP_12_All others" new-dscp=12 passthrough=no
  /ip firewall NAT
  add action=masquerade chain=srcnat comment="Access modem" \
  out-interface-list =广域网
  add action=dst-nat chain=dstnat comment="Allow Torrent" dst-port=61132 \
  in-interface-list=WAN协议=tcp to-addresses=10.157.138.101 \
  与港口= 61132
  add action=dst-nat chain= dst-port=61132 in-interface-list=WAN \
  Protocol =udp to addresses=10.157.138.101 to ports=61132
  add action=dst-nat chain=dstnat comment=Hamachi_Desktop disabled=yes \
  dst-port=1320 in-interface-list=WAN协议=tcp to-addresses=\
  10.157.138.100向港口= 1320
  添加action=dst-nat chain=dstnat disabled=yes dst-port=1320 \
  in-interface-list=WAN协议=udp to-addresses=10.157.138.100 \
  与港口= 1320
  add action=dst-nat chain=dstnat comment=Hamachi_Lapi dst-port=1320 \
  in-interface-list=WAN协议=tcp to-addresses=10.157.138.101 \
  与港口= 1320
  add action=dst-nat chain=dstnat dst-port=1320 in-interface-list=WAN \
  Protocol =udp to addresses=10.157.138.101 to ports=1320
  /ip firewall raw
  add action=drop chain=prerouting comment="______阻塞端口TCP" \
  log-prefix=“阻断TCP”端口=\
  0, 20日,21日,22日,23日,67 - 69161 - 162135 - 139444 - 445,1080,1900 = tcp协议
  add action=drop chain=prerouting comment="______阻塞端口UDP" \
  log-prefix=“阻断UDP”端口=\
  0, 20日,21日,22日,23161 - 162135 - 139444 - 445、1080、1900 = udp协议
  add action=add-src-to-address-list address-list="端口扫描器" \
  Address-list-timeout =1d chain=prerouting comment=\
  "______添加端口扫描器到列表" in-interface-list=!局域网协议=tcp \
  3 s psd = 21日3 1时间= 0 s-1d,太阳,星期一,星期二,星期三,星期四,星期五,坐
  add action=add-src-to-address-list address-list="端口扫描器" \
  Address-list-timeout =1d chain=prerouting comment=\
  "______NMAP FIN隐身扫描"协议=tcp tcp-flags=\
  鳍,syn ! rst、psh、ack, !开始
  add action=add-src-to-address-list address-list="端口扫描器" \
  address-list-timeout=1d chain=prerouting comment="______SYN/FIN扫描" \
  协议tcp tcp-flags = =鳍、syn
  add action=add-src-to-address-list address-list="端口扫描器" \
  address-list-timeout=1d chain=prerouting comment="______SYN/RST扫描" \
  协议tcp tcp-flags = = syn rst
  add action=add-src-to-address-list address-list="端口扫描器" \
  Address-list-timeout =1d chain=prerouting comment=\
  "______FIN/PSH/URG scan"协议=tcp tcp-flags=\
  开始,鳍、psh ! syn, rst, !消
  add action=add-src-to-address-list address-list="端口扫描器" \
  address-list-timeout=1d chain=prerouting comment="______ALL/ALL scan" \
  协议tcp tcp-flags = =鳍、syn rst、psh、ack,开始
  add action=add-src-to-address-list address-list="端口扫描器" \
  Address-list-timeout =1d chain=prerouting comment=\
  "______NMAP NULL scan"协议=tcp psd=21,3s,3,1 tcp-flags=\
  鳍,syn ! rst、psh、ack, !开始
  Add action=drop chain=prerouting comment=\
  src-address-list="端口扫描器"
  添加动作=跳转链=预路由评论=______ddos_Protection \
  Jump-target =block-ddos协议=tcp tcp-flags=syn
  Add action=drop chain=prerouting dst-address-list=ddosed \
  src-address-list = ddos
  添加action=return chain=block-ddos - dst-limit=\
  50岁,50岁,src-and-dst-addresses / 10 s
  Add action= Add -dst-to-address-list address-list=ddosed \
  address-list-timeout = 1 d = block-ddos链
  Add action= Add -src-to-address-list address-list=ddoser
  address-list-timeout = 1 d = block-ddos链
  add action=jump chain=prerouting comment=" jump to ICMP chain" \
  跳转目标= = icmp icmp4协议
  Add action=accept chain=icmp4 comment="echo reply" icmp4 -options=0:0 \
  限制= 5,10:= icmp数据包协议
  Add action=accept chain=icmp4 comment="网络不可达" icmp-options=3:0 \
  = icmp协议
  Add action=accept chain=icmp4 comment="host unavailable " icmp-options=3:1 \
  = icmp协议
  Add action=accept chain=icmp4 comment="协议不可达" \
  icmp-options = 3:2 = icmp协议
  Add action=accept chain=icmp4 comment="端口不可达" icmp-options=3:3 \
  = icmp协议
  添加动作=接受链=icmp4评论=“碎片需要”\
  icmp-options = = icmp 3:4协议
  Add action=accept chain=icmp4 comment=echo icmp-options=8:0 limit=\
  5、10:= icmp数据包协议
  Add action=accept chain=icmp4 comment="超时" icmp4 -options=\
  11:0 - 255 = icmp协议
  Add action=drop chain=icmp4 comment="drop other icmp" protocol=icmp
  /ip firewall service-port
  设置FTP禁用=yes
  设置TFTP禁用=yes
  设置irc禁用=yes
  设置h323 disabled=yes
  设置sip disabled=yes
  设置禁用PPTP =yes
  设置udplite disabled=yes
  设置DCCP禁用=yes
  设置禁用SCTP =yes
  / ip路由
  add distance=1 gateway=1.0.0.1 routing-mark=to_WAN2
  add distance=2 gateway=1.1.1.1 routing-mark=to_WAN2
  add distance=1 gateway=1.1.1.1 routing-mark=to_WAN1
  add distance=2 gateway=1.0.0.1 routing-mark=to_WAN1
  增加check-gateway=ping distance=1 gateway=1.1.1.1
  增加check-gateway=ping distance=2 gateway=1.0.0.1
  增加check-gateway=ping distance=1 dst-address=1.0.0.1/32 gateway=\
  192.168.2.1范围= 10
  添加距离=3 dst-address=1.0.0.1/32 type=黑洞
  添加check-gateway=ping distance=1 dst-address=1.1.1.1/32 gateway=\
  192.168.0.1范围= 10
  添加距离=3 dst-address=1.1.1.1/32 type=黑洞
  / ip服务
  设置Telnet禁用=yes
  设置FTP禁用=yes
  设置WWW地址=10.157.138.0/24
  设置SSH禁用=yes
  设置API禁用=yes
  设置winbox地址=10.157.138.0/24
  设置api-ssl disabled=yes
  / ip ssh
  设置allow-none-crypto=yes forwarding-enabled=remote
  / ipv6地址
  add disabled=yes from-pool=ipv6-pool-WAN1 interface=Bridge
  add address=::1 from-pool=pool1 interface=Bridge
  / ipv6 dhcp客户端
  add add-default-route=yes disabled=yes interface=WAN1 pool-name=pool1 \
  pool-prefix-length = 56请求=前缀
  /ipv6防火墙地址列表
  添加address=fe80::/16 list=allowed
  添加address=ff02::/16 comment=multicast list=allowed
  添加address=2a02::/48 list=allowed
  /ipv6防火墙过滤器
  add action=accept chain=input comment="Allow established and related" \
  连接状态=建立联系
  add action=accept chain=input comment=" accept ICMPv6" protocol= ICMPv6
  add action=accept chain=input comment=" accept UDP traceroute" port=\
  33434 - 33534 = udp协议
  添加动作=接受链=输入评论=\
  "Accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp \
  src-address = fe80:: / 16
  add action=drop chain=input comment=DropLL_from_public in-interface-list=\
  WAN src-address = fe80:: / 16
  add action=accept chain=input comment="允许允许的地址" \
  src-address-list =允许
  add action=drop chain=input comment=“删除所有其他输入”
  添加动作=接受链=转发评论=已建立，相关\
  连接状态=建立联系
  add action=drop chain=forward comment=" drop invalid"连接状态=\
  无效的
  add action=accept chain=forward comment=" accept icmpv6" \
  in-interface-list = = icmpv6局域网协议
  add action=accept chain=forward comment="Allow LAN" in-interface-list=LAN \
  src-address-list =允许
  add action=drop chain=forward comment=" drop everything else forward " \
  log-prefix = IPV6_drop
  / ipv6 nd
  设置[find default=yes] managed-address-configuration=yes \
  其他配置=是的ra-interval = 20 s-1m
  / ipv6路由
  添加距离=0网关=网桥
  add disabled=yes distance=1 gateway=WAN1
  add disabled=yes distance=1 gateway=WAN2
  /液晶
  设置enabled=no触摸屏=disabled
  /lcd界面页
  set 0 interfaces=wlan1_雷竞技网站Mikrotik
  /系统时钟
  设置time-zone-name =欧洲/雅典
  /系统标识
  集名称=路由器
  /system NTP客户端
  设置enabled=yes server-dns-names=time.cloudflare.com
  /system ios版雷竞技官网入口routerboard设置
  设置auto-upgrade = yes
  /系统监督
  设置看门狗=没有
  /工具bandwidth-server
  设置启用=没有
  电子邮件/工具
  Set address=smtp.gmail.com from=<ksigalas@gmail.com> port=587 start-tls=\
  是的用户=ksigalas@gmail.com