/ ip firewall
set input name="input" policy=accept comment=""
set forward name="forward" policy=accept comment=""
set output name="output" policy=accept comment=""
add name="virus" policy=none comment=""
/ ip firewall rule forward
add src-address=192.168.0.20/32 action=accept comment="20号允许BT" \
    disabled=no
add src-address=192.168.0.120/32 action=accept comment="120号允许BT" \
    disabled=no
add src-address=192.168.0.200/32 action=accept comment="200号允许BT" \
    disabled=no
add dst-address=:3077 protocol=tcp action=drop comment="迅雷~我操你妈" \
    disabled=no
add dst-address=:3077 protocol=udp action=drop comment="迅雷~我操你妈1" \
    disabled=no
add dst-address=:3076 protocol=tcp action=drop comment="迅雷~我操你妈2" \
    disabled=no
add dst-address=:3076 protocol=udp action=drop comment="迅雷~我操你妈3" \
    disabled=no
add dst-address=210.22.12.53/32 action=drop comment="迅雷~我操你妈4" \
    disabled=no
add dst-address=61.128.198.97/32 action=drop comment="迅雷~我操你妈5" \
    disabled=no
add dst-address=220.175.8.100/32:80 protocol=tcp action=drop \
    comment="PP2005连接服务器" disabled=no
add dst-address=:5354 protocol=tcp action=drop comment="PP2005连接端口" \
    disabled=no
add content=pp365 action=drop comment="PP365关键字" disabled=no
add content=pp点点通 action=drop comment="pp点点通关键字" disabled=no
add dst-address=61.145.114.109/32:8801 protocol=udp action=drop \
    comment="酷狗" disabled=no
add dst-address=61.145.114.174/32:8800 protocol=udp action=drop comment="" \
    disabled=no
add src-address=192.168.0.0/24 p2p=bit-torrent action=drop \
    comment="禁止BT下载" disabled=no
add connection-state=invalid action=drop comment="Drop invalid connections" \
    disabled=no
add connection-state=established action=accept comment="Established \
    connections" disabled=no
add connection-state=related action=accept comment="Related connections" \
    disabled=no
add action=jump jump-target=virus comment="!!! Check for well-known viruses \
    !!!" disabled=no
add protocol=udp action=accept comment="UDP" disabled=no
add protocol=icmp limit-count=50 limit-burst=2 limit-time=5s action=accept \
    comment="Allow limited pings" disabled=no
add protocol=icmp action=drop comment="Drop excess pings" disabled=no
add dst-address=218.65.7.107/32 action=drop comment="" disabled=no
/ ip firewall rule input
add connection-state=invalid action=drop comment="Drop invalid connections" \
    disabled=no
add connection-state=established action=accept comment="Accept established \
    connections" disabled=no
add connection-state=related action=accept comment="Accept related \
    connections" disabled=no
add action=jump jump-target=virus comment="!!! Check for well-known viruses \
    !!!" disabled=no
add protocol=udp action=accept comment="UDP" disabled=no
add protocol=icmp limit-count=50 limit-burst=2 limit-time=5s action=accept \
    comment="Allow limited pings" disabled=no
add protocol=icmp action=drop comment="Drop excess pings" disabled=no
add dst-address=:1723 protocol=tcp action=accept comment="vpn" disabled=no
add dst-address=:12345 protocol=tcp action=accept comment="TELNET" \
    disabled=no
add dst-address=:67890 protocol=tcp action=accept comment="FTP" disabled=no
add dst-address=:98765 protocol=tcp action=accept comment="" disabled=no
add dst-address=:43210 protocol=tcp action=accept comment="HTTP" disabled=no
add dst-address=:3987 protocol=tcp action=accept comment="WINBOX" disabled=no
add dst-address=:2828 protocol=tcp action=accept comment="UPNP" disabled=no
add action=drop comment="drop everything else" disabled=no
/ ip firewall rule output
add protocol=tcp tcp-options=syn-only action=drop comment="" disabled=no
/ ip firewall rule virus
add dst-address=:135-139 protocol=tcp action=drop comment="" disabled=no
add dst-address=:135-139 protocol=udp action=drop comment="" disabled=no
add dst-address=:445 protocol=tcp action=drop comment="" disabled=no
add dst-address=:445 protocol=udp action=drop comment="" disabled=no
add dst-address=:500 protocol=tcp action=drop comment="" disabled=no
add dst-address=:500 protocol=udp action=drop comment="" disabled=no
add dst-address=:593 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1024-1030 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1080 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1214 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1363 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1364 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1368 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1373 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1377 protocol=tcp action=drop comment="" disabled=no
add dst-address=:1433-1434 protocol=tcp action=drop comment="" disabled=no
add dst-address=:2745 protocol=tcp action=drop comment="" disabled=no
add dst-address=:2283 protocol=tcp action=drop comment="" disabled=no
add dst-address=:2535 protocol=tcp action=drop comment="" disabled=no
add dst-address=:2745 protocol=tcp action=drop comment="" disabled=no
add dst-address=:3127-3128 protocol=tcp action=drop comment="" disabled=no
add dst-address=:3410 protocol=tcp action=drop comment="" disabled=no
add dst-address=:4444 protocol=tcp action=drop comment="" disabled=no
add dst-address=:4444 protocol=udp action=drop comment="" disabled=no
add dst-address=:5554 protocol=tcp action=drop comment="" disabled=no
add dst-address=:8866 protocol=tcp action=drop comment="" disabled=no
add dst-address=:9898 protocol=tcp action=drop comment="" disabled=no
add dst-address=:10000 protocol=tcp action=drop comment="" disabled=no
add dst-address=:10080 protocol=tcp action=drop comment="" disabled=no
add dst-address=:12345 protocol=tcp action=drop comment="" disabled=no
add dst-address=:17300 protocol=tcp action=drop comment="" disabled=no
add dst-address=:27374 protocol=tcp action=drop comment="" disabled=no
add dst-address=:65506 protocol=tcp action=drop comment="" disabled=no
/ ip firewall service-port
set ftp ports=21 disabled=no
set pptp disabled=no
set gre disabled=no
set h323 disabled=yes
set mms disabled=yes
set irc ports=6667 disabled=yes
set quake3 disabled=yes
set tftp ports=69 disabled=yes

红的地方自己根据实际修改一下~不要搞得进不了WINBOX。

欢迎访问最专业的网吧论坛,无盘论坛,网吧经营,网咖管理,网吧专业论坛https://bbs.txwb.com

关注天下网吧微信,了解网吧网咖经营管理，安装维护: