Setting Firewall Filter Mikrotik

Langkah pertama yaitu ketikan atau copykan perintah dibawah ini dan letakan paa bagian
terminal mikrotik.
----------------------------------------------------------------------------------------------------------------------------------------
/ ip firewall filter
----------------------------------------------------------------------------------------------------------------------------------------

Setelah melakukan langkah diatas,lakukan langkahberikutnya yaitu copykan perintah dibawah ini dan langsung masukan dalam terminal mikrotik.

----------------------------------------------------------------------------------------------------------------------------------------

add chain=input connection-state=invalid action=drop comment="Drop Invalid
connections" disabled=no

add chain=input src-address=!192.168.0.0/27 protocol=tcp src-port=1024-65535
dst-port=8080 action=drop comment="Block to Proxy" disabled=no

add chain=input protocol=udp dst-port=12667 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=udp dst-port=27665 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=udp dst-port=31335 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=udp dst-port=27444 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=udp dst-port=34555 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=udp dst-port=35555 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=27444 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=27665 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=31335 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=31846 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=34555 action=drop comment="Trinoo"
disabled=no

add chain=input protocol=tcp dst-port=35555 action=drop comment="Trinoo"
disabled=no

add chain=input connection-state=established action=accept comment="Allow
Established connections" disabled=no

add chain=input protocol=udp action=accept comment="Allow UDP" disabled=no

add chain=input protocol=icmp action=accept comment="Allow ICMP" disabled=no

add chain=input src-address=192.168.0.0/27 action=accept comment="Allow access
to router from known network" disabled=no

add chain=input action=drop comment="Drop anything else" disabled=no

add chain=forward protocol=tcp connection-state=invalid action=drop
comment="drop invalid connections" disabled=no

add chain=forward connection-state=established action=accept comment="allow
already established connections" disabled=no

add chain=forward connection-state=related action=accept comment="allow
related connections" disabled=no

add chain=forward src-address=0.0.0.0/8 action=drop comment="" disabled=no

add chain=forward dst-address=0.0.0.0/8 action=drop comment="" disabled=no

add chain=forward src-address=127.0.0.0/8 action=drop comment="" disabled=no

add chain=forward dst-address=127.0.0.0/8 action=drop comment="" disabled=no

add chain=forward src-address=224.0.0.0/3 action=drop comment="" disabled=no

add chain=forward dst-address=224.0.0.0/3 action=drop comment="" disabled=no

add chain=forward protocol=tcp action=jump jump-target=tcp comment=""
disabled=no

add chain=forward protocol=udp action=jump jump-target=udp comment=""
disabled=no

add chain=forward protocol=icmp action=jump jump-target=icmp comment=""
disabled=no

add chain=tcp protocol=tcp dst-port=69 action=drop comment="deny TFTP"
disabled=no

add chain=tcp protocol=tcp dst-port=111 action=drop comment="deny RPC
portmapper" disabled=no

add chain=tcp protocol=tcp dst-port=135 action=drop comment="deny RPC
portmapper" disabled=no

add chain=tcp protocol=tcp dst-port=137-139 action=drop comment="deny NBT"
disabled=no

add chain=tcp protocol=tcp dst-port=445 action=drop comment="deny cifs"
disabled=no

add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"
disabled=no

add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny
NetBus" disabled=no

add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"
disabled=no

add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny
BackOriffice" disabled=no

add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"
disabled=no

add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"
disabled=no

add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC
portmapper" disabled=no

add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC
portmapper" disabled=no

add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"
disabled=no

add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"
disabled=no

add chain=udp protocol=udp dst-port=3133 action=drop comment="deny
BackOriffice" disabled=no

add chain=input protocol=tcp psd=21,3s,3,1 action=add-src-to-address-list
address-list="port scanners" address-list-timeout=2w comment="Port
scanners to list " disabled=no

add chain=input protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list="port scanners"

address-list-timeout=2w comment="NMAP FIN Stealth scan" disabled=no

add chain=input protocol=tcp tcp-flags=fin,syn action=add-src-to-address-list

address-list="port scanners" address-list-timeout=2w comment="SYN/FIN
scan" disabled=no

add chain=input protocol=tcp tcp-flags=syn,rst action=add-src-to-address-list
address-list="port scanners" address-list-timeout=2w comment="SYN/RST
scan" disabled=no

add chain=input protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack

action=add-src-to-address-list address-list="port scanners"

address-list-timeout=2w comment="FIN/PSH/URG scan" disabled=no

add chain=input protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w comment="ALL/ALL scan" disabled=no

add chain=input protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
action=add-src-to-address-list address-list="port scanners"
address-list-timeout=2w comment="NMAP NULL scan" disabled=no

add chain=input src-address-list="port scanners" action=drop comment="dropping
port scanners" disabled=no

add chain=icmp protocol=icmp icmp-options=0:0 action=accept comment="drop
invalid connections" disabled=no

add chain=icmp protocol=icmp icmp-options=3:0 action=accept comment="allow
established connections" disabled=no

add chain=icmp protocol=icmp icmp-options=3:1 action=accept comment="allow
already established connections" disabled=no

add chain=icmp protocol=icmp icmp-options=4:0 action=accept comment="allow
source quench" disabled=no

add chain=icmp protocol=icmp icmp-options=8:0 action=accept comment="allow
echo request" disabled=no

add chain=icmp protocol=icmp icmp-options=11:0 action=accept comment="allow
time exceed" disabled=no

add chain=icmp protocol=icmp icmp-options=12:0 action=accept comment="allow
parameter bad" disabled=no

add chain=icmp action=drop comment="deny all other types" disabled=no

add chain=tcp protocol=tcp dst-port=25 action=reject
reject-with=icmp-network-unreachable comment="Smtp" disabled=no

add chain=tcp protocol=udp dst-port=25 action=reject
reject-with=icmp-network-unreachable comment="Smtp" disabled=no

add chain=tcp protocol=tcp dst-port=110 action=reject
reject-with=icmp-network-unreachable comment="Smtp" disabled=no

add chain=tcp protocol=udp dst-port=110 action=reject
reject-with=icmp-network-unreachable comment="Smtp" disabled=no

add chain=tcp protocol=udp dst-port=110 action=reject
reject-with=icmp-network-unreachable comment="Smtp" disabled=no

-----------------------------------------------------------------------------------------------------------------