Mikrotik — Пример правил filters для Mikrotik RouterOS

Для того чтобы применить данные правила и не потерять доступ к маршрутизатору нужно создать лист safe и внести ип адрес или сеть откуда будете подключатся к маршрутизатору.

У меня сеть 10.8.248.0/21

/ip firewall address-list
add address=10.8.248.0/21 comment="OFFICE_LAN" list=safe

/ip firewall filter
add action=accept chain=forward comment="" disabled=no
add action=accept chain=input comment="accept established connection packets" connection-state=established disabled=no
add action=accept chain=input comment="accept related connection packets" connection-state=related disabled=no
add action=drop chain=input comment="drop invalid packets" connection-state=invalid disabled=no
add action=accept chain=input comment="Allow access to router from known network" disabled=no src-address-list=safe
add action=drop chain=input comment="detect and drop port scan connections" disabled=no protocol=tcp psd=21,3s,3,1
add action=tarpit chain=input comment="suppress DoS attack" connection-limit=3,32 disabled=no protocol=tcp src-address-list=black_list
add action=add-src-to-address-list address-list=black_list address-list-timeout=1d chain=input comment="detect DoS attack" connection-limit=10,32 disabled=no protocol=tcp
add action=jump chain=input comment="jump to chain ICMP" disabled=no jump-target=ICMP protocol=icmp
add action=jump chain=input comment="jump to chain services" disabled=no jump-target=services
add action=accept chain=input comment="Allow Broadcast Traffic" disabled=no dst-address-type=broadcast
add action=log chain=input comment="" disabled=no log-prefix=Filter:
add action=drop chain=input comment="drop everything else" disabled=no

/ip firewall filter
add action=accept chain=ICMP comment="0:0 and limit for 5pac/s" disabled=no icmp-options=0:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:3 and limit for 5pac/s" disabled=no icmp-options=3:3 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="3:4 and limit for 5pac/s" disabled=no icmp-options=3:4 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="8:0 and limit for 5pac/s" disabled=no icmp-options=8:0-255 limit=5,5 protocol=icmp
add action=accept chain=ICMP comment="11:0 and limit for 5pac/s" disabled=no icmp-options=11:0-255 limit=5,5 protocol=icmp
add action=drop chain=ICMP comment="Drop everything else" disabled=no protocol=icmp/ip firewall filter

add action=accept chain=services comment="accept localhost" disabled=no dst-address=127.0.0.1 src-address=127.0.0.1 src-address-list=""
add action=accept chain=services comment="allow MACwinbox " disabled=yes dst-port=20561 protocol=udp
add action=accept chain=services comment="Bandwidth server" disabled=yes dst-port=2000 protocol=tcp
add action=accept chain=services comment=" MT Discovery Protocol" disabled=yes dst-port=5678 protocol=udp
add action=accept chain=services comment="allow SNMP" disabled=yes dst-port=161 protocol=tcp
add action=accept chain=services comment="Allow BGP" disabled=yes dst-port=179 protocol=tcp
add action=accept chain=services comment="allow BGP" disabled=yes dst-port=5000-5100 protocol=udp
add action=accept chain=services comment="Allow NTP" disabled=yes dst-port=123 protocol=udp
add action=accept chain=services comment="Allow PPTP" disabled=no dst-port=1723 protocol=tcp
add action=accept chain=services comment="allow DNS request" disabled=yes dst-port=53 protocol=tcp
add action=accept chain=services comment="Allow DNS request" disabled=yes dst-port=53 protocol=udp
add action=accept chain=services comment=UPnP disabled=yes dst-port=1900 protocol=udp
add action=accept chain=services comment=UPnP disabled=yes dst-port=2828 protocol=tcp
add action=accept chain=services comment="allow PPTP and EoIP" disabled=yes protocol=gre
add action=accept chain=services comment="allow DHCP" disabled=yes dst-port=67-68 protocol=udp
add action=accept chain=services comment="allow Web Proxy" disabled=yes dst-port=8080 protocol=tcp
add action=accept chain=services comment="allow IPIP" disabled=yes protocol=ipencap
add action=accept chain=services comment="allow https for Hotspot" disabled=yes dst-port=443 protocol=tcp
add action=accept chain=services comment="allow Socks for Hotspot" disabled=yes dst-port=1080 protocol=tcp
add action=accept chain=services comment="Allow IPSec-esp" disabled=no protocol=ipsec-esp
add action=accept chain=services comment="Allow IPSec-ah" disabled=no protocol=ipsec-ah
add action=accept chain=services comment="Allow IKE" disabled=no dst-port=500 protocol=udp
add action=accept chain=services comment="Allow IPSec-esp" disabled=no protocol=ipsec-esp
add action=accept chain=services comment="Allow IPSec-ah" disabled=no protocol=ipsec-ah
add action=accept chain=services comment="allow RIP" disabled=yes dst-port=520-521 protocol=udp
add action=accept chain=services comment="allow OSPF" disabled=yes protocol=ospf
add action=return chain=services comment="" disabled=no
add action=drop chain=forward comment="" disabled=no

Спасибо за помощь TangaRUS’у