Mikrotik | Forum Mikrotik Indonesia

Code:

ip proxy access add dst-host=kad.kaskus.us action=deny comment=ads-c1p1 disabled=no

ip proxy access add dst-host=ab.kaskus.us action=deny comment=ads-c1p1 disabled=no

ip proxy access add dst-host=openx.detik.com action=deny comment=ads-c1p1 disabled=no

ip proxy access add dst-host=ad.kaskus.us action=deny comment=ads-c1p1 disabled=no

ip proxy access add dst-host=ads3.kompas.com action=deny comment=ads-c1p1 disabled=no

Code:

/interface ethernet

set 0 arp=enabled auto-negotiation=yes comment="" disabled=yes full-duplex=yes \

    mac-address=00:0C:42:2E:B7:23 mtu=1500 name=ether1 speed=100Mbps

set 1 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \

    disabled=yes full-duplex=yes mac-address=00:0C:42:2E:B7:24 master-port=none mtu=\

    1500 name=ether2 speed=100Mbps

set 2 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \

    disabled=yes full-duplex=yes mac-address=00:0C:42:2E:B7:25 master-port=none mtu=\

    1500 name=ether3 speed=100Mbps

set 3 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \

    disabled=no full-duplex=yes mac-address=00:0C:42:2E:B7:26 master-port=none mtu=\

    1500 name=INTERNET speed=100Mbps

set 4 arp=enabled auto-negotiation=yes bandwidth=unlimited/unlimited comment="" \

    disabled=no full-duplex=yes mac-address=00:0C:42:2E:B7:27 master-port=none mtu=\

    1500 name=LAN speed=100Mbps



/ip address

add address=192.168.60.1/24 broadcast=192.168.60.255 comment="" disabled=no interface=\

    LAN network=192.168.60.0

add address=192.168.50.2/24 broadcast=192.168.50.255 comment="" disabled=no interface=\

    INTERNET network=192.168.50.0



/ip route

add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.50.1 \

    scope=30 target-scope=10



/ip pool

add name=pool1 next-pool=pool1 ranges=192.168.60.2-192.168.60.254



/ip firewall nat

add action=masquerade chain=srcnat comment="masquerade hotspot network" disabled=no



/ip hotspot profile

set default dns-name="" hotspot-address=0.0.0.0 html-directory=hotspot \

    http-cookie-lifetime=3d http-proxy=0.0.0.0:0 login-by=cookie,http-chap name=\

    default rate-limit="" smtp-server=0.0.0.0 split-user-domain=no use-radius=no

add dns-name="" hotspot-address=192.168.60.1 html-directory=hotspot http-proxy=\

    0.0.0.0:0 login-by=http-chap name=hsprof1 rate-limit="" smtp-server=0.0.0.0 \

    split-user-domain=no use-radius=no



/ip dns

set allow-remote-requests=yes cache-max-ttl=1w cache-size=2048KiB max-udp-packet-size=\

    512 primary-dns=203.130.209.242 secondary-dns=202.134.1.10

Quote:

chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop

26 chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list
address-list=ssh_blacklist address-list-timeout=1w3d

27 chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list
address-list=ssh_stage3 address-list-timeout=1m

28 chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 action=add-src-to-address-list
address-list=ssh_stage2 address-list-timeout=1m

29 chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m

30 ;;; Port Scanners to list
chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w

31 chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w

32 chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w

33 chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w

34 chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w

35 chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg action=add-src-to-address-list address-list=port scanners
address-list-timeout=2w

36 chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg action=add-src-to-address-list
address-list=port scanners address-list-timeout=2w

37 chain=input src-address-list=port scanners action=drop

38 ;;; Filter FTP to Box
chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop

39 chain=output protocol=tcp content=530 Login incorrect dst-limit=1/1m,9,dst-address/1m action=accept

40 chain=output protocol=tcp content=530 Login incorrect action=add-dst-to-address-list address-list=ftp_blacklist
address-list-timeout=3h

41 ;;; Separate Protocol into Chains
chain=forward protocol=tcp action=jump jump-target=tcp

42 chain=forward protocol=udp action=jump jump-target=udp

43 chain=forward protocol=icmp action=jump jump-target=icmp

44 ;;; Blocking UDP Packet
chain=udp protocol=udp dst-port=69 action=drop

45 chain=udp protocol=udp dst-port=111 action=drop

46 chain=udp protocol=udp dst-port=135 action=drop

47 chain=udp protocol=udp dst-port=137-139 action=drop

48 chain=udp protocol=udp dst-port=2049 action=drop

49 chain=udp protocol=udp dst-port=3133 action=drop

50 ;;; Bloking TCP Packet
chain=tcp protocol=tcp dst-port=69 action=drop

51 chain=tcp protocol=tcp dst-port=111 action=drop

52 chain=tcp protocol=tcp dst-port=119 action=drop

53 chain=tcp protocol=tcp dst-port=135 action=drop

54 chain=tcp protocol=tcp dst-port=137-139 action=drop

55 chain=tcp protocol=tcp dst-port=445 action=drop

56 chain=tcp protocol=tcp dst-port=2049 action=drop

57 chain=tcp protocol=tcp dst-port=12345-12346 action=drop

58 chain=tcp protocol=tcp dst-port=20034 action=drop

59 chain=tcp protocol=tcp dst-port=3133 action=drop

60 chain=tcp protocol=tcp dst-port=67-68 action=drop

61 ;;; Limited Ping Flood
chain=icmp protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept

62 chain=icmp protocol=icmp icmp-options=3:3 limit=5,5 action=accept

63 chain=icmp protocol=icmp icmp-options=3:4 limit=5,5 action=accept

64 chain=icmp protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept

65 chain=icmp protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept

66 chain=icmp protocol=icmp action=drop

67 ;;; Allow Broadcast Traffic
chain=input dst-address-type=broadcast action=accept

68 ;;; Connection State
chain=input connection-state=established action=accept

69 chain=input connection-state=related action=accept

70 chain=input connection-state=invalid action=drop

71 ;;; Drop Ip
chain=forward src-mac-address=00:24:2C:4C:31:65 action=drop

72 ;;; Allow semua akses internet to client
chain=forward in-interface=publik out-interface=lokal dst-address=192.168.10.0/24 action=accept

73 ;;; Allow Remote winbox dari Publik
chain=input in-interface=publik protocol=tcp dst-port=8291 action=accept

74 ;;; Allow NTP Traffic
chain=input in-interface=publik protocol=udp src-port=123 action=accept

75 ;;; Allow DNS Traffic
chain=input in-interface=publik protocol=udp src-port=53 action=accept

76 ;;; Allow Ping Traceroute Traffic
chain=input in-interface=publik protocol=icmp action=accept

77 ;;; Log Ip Yang Di Tolak
chain=input in-interface=publik connection-state=new action=add-src-to-address-list address-list=spam
address-list-timeout=30m

78 ;;; Drop Semua Akses yang tidak di ijinkan
chain=input in-interface=publik action=drop

79 chain=forward in-interface=wan src-address=!192.168.33.196 src-mac-address=!1C:4B:D6:C1:0B:41 action=drop

80 chain=forward in-interface=wan src-address=!192.168.20.238 src-mac-address=!00:17:C4:9D:59:2F action=drop

81 chain=input protocol=icmp action=drop

82 ;;; Reject if in the 24-hour-list
chain=forward src-address-list=24-hour-list action=reject reject-with=icmp-network-unreachable

83 ;;; Check if dest is an open customer
chain=forward dst-address-list=open-customers action=jump jump-target=open-customers

84 ;;; Check Known Bad Hosts
chain=forward action=jump jump-target=bad-hosts

85 ;;; Reject if in the 24-hour-list
chain=forward src-address-list=24-hour-list action=reject reject-with=icmp-network-unreachable

86 ;;; Take no action on bogons
chain=bad-host-detection src-address-list=bogons action=return

87 ;;; Add to the 30 second list
chain=bad-host-detection action=add-src-to-address-list address-list=30-second-list address-list-timeout=30s

88 chain=bad-host-detection action=return

89 ;;; jump to the bad-host-detection chain
chain=forward src-address-list=!our-networks action=jump jump-target=bad-host-detection

90 ;;; jump to the bad-host-detection chain
chain=forward src-address-list=!our-networks action=jump jump-target=bad-host-detection

91 ;;; log and reject the rest
chain=forward action=log log-prefix=""

92 chain=forward action=reject reject-with=icmp-network-unreachable

Code:

# oct/05/2009 21:28:27 by RouterOS 4.0rc1

/system script



add name=HomingBeacon-Simple policy=\

    ftp,reboot,read,write,policy,test,winbox,password source="# Dynamic DNS Up\

    date / Simple Edition\r\

    \n# Written by Sam Norris, ChangeIP.com\r\

    \n# Copyright ChangeIP.com 2009\r\

    \n# For support send mail to Support@ChangeIP.com\r\

    \n#\r\

    \n# 2009-06-22 RouterOS 3.25 Tested\r\

    \n# 2009-10-05 RouterOS 4.01rc1 Tested\r\

    \n#\r\

    \n# OVERVIEW:         %\r\

    \n#  This script will update a ChangeIP.com dynamic dns hostname\r\

    \n#  with an ip address located directly on an interface.\r\

    \n#                   %\r\

    \n# NOTES:            %\r\

    \n#  IF THIS SCRIPT DOES NOT PRODUCE ANY OUTPUT PLEASE COPY AND PASTE IT\r\

    \n#  AGAIN.  THERE PROBABLY IS A LINE BREAK IN THE WRONG PLACE! Once you\r\

    \n#  have created this script and tested that it works by running it\r\

    \n#  manually you can schedule it to run every few minutes.\r\

    \n#                   %\r\

    \n# CONFIGURATION FIELD DEFINITIONS:\r\

    \n#  ddnsuser:  Enter your ChangeIP.com user id.\r\

    \n#  ddnspass:  Enter your ChangeIP.com password.\r\

    \n#  ddnshost:  Enter the hostname (www.example.com) to update.\r\

    \n#  ddnsinterface:  Enter a list of interface names - case sensative.\r\

    \n#                   %\r\

    \n#                   %\r\

    \n#                   %\r\

    \n#                   %\r\

    \n#               %   %   %\r\

    \n#                %  %  %\r\

    \n#                 % % %\r\

    \n#                   %\r\

    \n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\

    \n# EDIT YOUR DETAILS / CONFIGURATION HERE\r\

    \n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\

    \n:global ddnsuser \"YourChangeIPUserID\"\r\

    \n:global ddnspass \"PASSWORD\"\r\

    \n:global ddnshost \"MyRouterHostname.example.org\"\r\

    \n:global ddnsinterface \"ether1\"\r\

    \n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\

    \n# END OF USER DEFINED CONFIGURATION\r\

    \n# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\

    \n\r\

    \n:global ddnssystem (\"mt-\" . [/system package get [/system package find\

    \_name=system] version] )\r\

    \n:global ddnsip [ /ip address get [/ip address find interface=\$ddnsinter\

    face] address ]\r\

    \n:global ddnslastip\r\

    \n\r\

    \n:if ([:len [/interface find name=\$ddnsinterface]] = 0 ) do={ :log info \

    \"DDNS: No interface named \$ddnsinterface, please check configuration.\" \

    }\r\

    \n\r\

    \n:if ([ :typeof \$ddnslastip ] = \"nothing\" ) do={ :global ddnslastip 0.\

    0.0.0/0 }\r\

    \n\r\

    \n:if ([ :typeof \$ddnsip ] = \"nothing\" ) do={\r\

    \n\r\

    \n:log info (\"DDNS: No ip address present on \" . \$ddnsinterface . \", p\

    lease check.\")\r\

    \n\r\

    \n} else={\r\

    \n\r\

    \n  :if (\$ddnsip != \$ddnslastip) do={\r\

    \n\r\

    \n    :log info \"DDNS: Sending UPDATE!\"\r\

    \n    :log info [ :put [/tool dns-update name=\$ddnshost address=[:pick \$\

    ddnsip 0 [:find \$ddnsip \"/\"] ] key-name=\$ddnsuser key=\$ddnspass ] ]\r\

    \n    :global ddnslastip \$ddnsip\r\

    \n\r\

    \n  } else={ \r\

    \n\r\

    \n    :log info \"DDNS: No changes necessary.\"\r\

    \n\r\

    \n  }\r\

    \n\r\

    \n}"



/system scheduler

add comment="" disabled=no interval=5m name=DDNS on-event=\

    HomingBeacon-Simple policy=read,write,policy,test,password start-time=\

    startup

Code:

# Update DNS on Freedns.afraid.org

   :global host "freedns.afraid.org"

   :global url "urlddns"

   

   /tool fetch url=$url host=$host

Code:

# Update DNS on Freedns.afraid.org

   :global host "freedns.afraid.org"

   :global url "http://freedns.afraid.org/dynamic/update.php?VEdmU24wTVRTTUlBQUs5NHdUczo0ODQxOTgx"

   

   /tool fetch url=$url host=$host

Code:

# Define user variables

# Please NOTE that your username and password will be sent cleartext across the internet!

:local eduser "USERNAME"

:local edpass "PASS"

:local eddomain "mydomain.com" 

:local edinterface "INTERFACE_NAME"



# Change this global variable if you want more than 1 script

:global edlastip1

:local str

:local edip

:local ip



:if ([ :typeof $edlastip1 ] = nil ) do={ :global edlastip1 "0" }



:local edip [ /ip address get [/ip address find interface=$edinterface ] address ]



:if ([ :typeof $edip ] = nil ) do={

   :log info ("EveryDNS: No ip address on $edinterface .")

} else={



# strip off netmask correctly (MRz)

   :for i from=( [:len $edip] - 1) to=0 do={ 

      :if ( [:pick $edip $i] = "/") do={ 

           :set edip [:pick $edip 0 $i];

      } 

   }



  :if ($edip != $edlastip1) do={



    :log info ("EveryDNS: $eddomain -> $edip")

# use url directly and mode http (MRz)

    :local str "/index.php?ver=0.1&ip=$edip&domain=$eddomain"

    /tool fetch url="http://dyn.everydns.net/$str" mode=http user=$eduser password=$edpass \

       dst-path=("/EveryDNS.".$eddomain)

    :delay 1 



# output any error messages received from file

    :local str [/file find name="EveryDNS.$eddomain"];

    :log info [/file get $str contents];

    /file remove $str

    :global edlastip1 $edip



  } 



}

Code:

system scheduler add name=EveryDNS1 interval=00:01 \

  on-event="/system script run everyDns1\r\n/system script run everyDns2"