/ip firewall address-list
1 add address=[Link]/8
add address=[Link]/8
2
3 disabled=yes list=bogons
4 add address=[Link]/8
5 add address=[Link]/16
add address=[Link]/12
6
7 disabled=yes list=bogons
add address=[Link]/16
8
9 disabled=yes list=bogons
10 add address=[Link]/24
add address=[Link]/24
11
12 add address=[Link]/15
13 add address=[Link]/24
14 add address=[Link]/24
add address=[Link]/4
15
16
add action=add-src-to-address-list address-
17 list=Syn_Flooder address-list-timeout=30m
chain=input \
add action=drop chain=input
18
add action=add-src-to-address-list address-
19 list=Port_Scanner address-list-timeout=1w
chain=input
20 disabled=no protocol=tcp psd=21,3s,3,1
add action=drop chain=input
21
add action=jump chain=input
22
23 add action=drop chain=input\
24
disabled=yes dst-port=8291 protocol=tcp src-address-
25 list=!support
add action=jump chain=forward
26
add action=drop chain=forward
27
add action=add-src-to-address-list address-
28 list=spammers address-list-timeout=3h chain=forward
add action=drop chain=forward
29
30 add action=accept chain=input
31 add action=accept chain=input
add action=accept chain=input
32
33 disabled=no
add action=accept chain=input
34
add action=accept chain=input
35
add action=drop chain=input
36
add action=accept chain=ICMP
37
add action=accept chain=ICMP
38
add action=accept chain=ICMP
39
add action=accept chain=ICMP
40
41 add action=accept chain=ICMP
42 add action=drop chain=ICMP
add action=jump chain=output
43
44 /ip firewall filter
add chain=input
45
add chain=input
46
47 add action=drop chain=input
add action=drop chain=input
48
add action=drop chain=input
49
add action=drop chain=input
50
51 /ip firewall filter
add chain=forward
52
53 add action=drop chain=forward
add action=drop chain=forward
54
add action=drop chain=forward
55
add action=drop chain=forward
56
add action=drop chain=forward
57
58 /ip firewall filter
add action=drop chain=forward
59
Self-Identification [RFC 3330] disabled=no list=bogons
Private[RFC 1918] - CLASS A # Check if you need this subnet
before enable it\
Loopback [RFC 3330] disabled=no list=bogons
Link Local [RFC 3330] disabled=no list=bogons
Private[RFC 1918] - CLASS B # Check if you need this subnet
before enable it\
Private[RFC 1918] - CLASS C # Check if you need this subnet
before enable it\
Reserved - IANA - TestNet1 disabled=no list=bogons
6to4 Relay Anycast [RFC 3068] disabled=no list=bogons
NIDB Testing disabled=no list=bogons
Reserved - IANA - TestNet2 disabled=no list=bogons
Reserved - IANA - TestNet3 disabled=no list=bogons
MC, Class D, IANA # Check if you need this subnet before
enable it\
Add Syn Flood IP to the list connection-limit=30,32
disabled=no protocol=tcp tcp-flags=syn
Drop to syn flood list disabled=no src-address-
list=Syn_Flooder
Port Scanner Detect\
Drop to port scan list disabled=no src-address-
list=Port_Scanner
Jump for icmp input flow disabled=no jump-target=ICMP
protocol=icmp
Block all access to the winbox - except to support list # DO
NOT ENABLE THIS RULE BEFORE ADD YOUR SUBNET IN THE
SUPPORT ADDRESS LIST\
Jump for icmp forward flow disabled=no jump-target=ICMP
protocol=icmp
Drop to bogon list disabled=no dst-address-list=bogons
Add Spammers to the list for 3 hours\
Avoid spammers action disabled=no dst-port=25,587
protocol=tcp src-address-list=spammers
Accept DNS - UDP disabled=no port=53 protocol=udp
Accept DNS - TCP disabled=no port=53 protocol=tcp
Accept to established connections connection-
state=established\
Accept to related connections connection-state=related
disabled=no
Full access to SUPPORT address list disabled=no src-address-
list=support
Drop anything else! # DO NOT ENABLE THIS RULE BEFORE
YOU MAKE SURE ABOUT ALL ACCEPT RULES YOU NEED\
Echo request - Avoiding Ping Flood, adjust the limit as
needed disabled=no icmp-options=8:0 limit=2,5
protocol=icmp
Echo reply disabled=no icmp-options=0:0 protocol=icmp
Time Exceeded disabled=no icmp-options=11:0
protocol=icmp
Destination unreachable disabled=no icmp-options=3:0-1
protocol=icmp
PMTUD disabled=no icmp-options=3:4 protocol=icmp
Drop to the other ICMPs disabled=no protocol=icmp
Jump for icmp output disabled=no jump-target=ICMP
protocol=icmp
Accept established and related packets connection-
state=established,related
Accept all connections from local network in-interface=LAN
Drop invalid packets connection-state=invalid
Drop all packets which are not destined to routes IP address
dst-address-type=!local
Drop all packets which does not have unicast source IP
address src-address-type=!unicast
Drop all packets from public internet which should not exist
in public network in-interface=WAN src-address-
list=NotPublic
Accept established and related packets connection-
state=established,related
Drop invalid packets connection-state=invalid
Drop new connections from internet which are not dst-
natted connection-nat-state=!dstnat connection-state=new
in-interface=WAN
Drop all packets from public internet which should not exist
in public network in-interface=WAN src-address-
list=NotPublic
Drop all packets from local network to internet which should
not exist in public network dst-address-list=NotPublic in-
interface=LAN
Drop all packets in local network which does not have local
network address in-interface=LAN src-address=!
[Link]/24
Drop new connections from internet which are not dst-
natted connection-nat-state=!dstnat connection-state=new
in-interface=WAN
