add chain=input action=accept comment="CHEQUEAR LINEA A LINEA FALLA WEB-PROXY" \ disabled=yes add chain=forward action=accept comment="" disabled=yes add chain=forward protocol=tcp tcp-flags=syn,rst tcp-mss=1400-1536 \ action=accept comment="Disminuye MMS MTU menos cabeceras IP y TCP" \ disabled=yes add chain=forward action=jump jump-target=drop-p2p comment="Drop P2P " \ disabled=no add chain=input action=jump jump-target=drop comment="Dropping IP no \ permitidas " disabled=no add chain=forward action=jump jump-target=drop comment="Dropping NetBios" \ disabled=no add chain=forward action=jump jump-target=virus comment="jump y drop to VIRUS \ chain" disabled=no add chain=forward in-interface=Local out-interface=Local action=accept \ comment="Allow traffic between wired and wireless networks" disabled=no add chain=forward action=jump jump-target=drop comment="Dropping IP no \ permitidas por DML" disabled=no add chain=forward action=jump jump-target=Limit-Conn comment="Limito \ conexiones TCP" disabled=no add chain=forward action=jump jump-target=sanity-check comment="Sanity Check" \ disabled=no add chain=forward protocol=tcp action=jump jump-target=restrict-tcp \ comment="-------- Restric TCP" disabled=no add chain=forward protocol=udp action=jump jump-target=restrict-udp \ comment="-------- Restric UDP" disabled=no add chain=forward action=jump jump-target=restrict-ip comment="" disabled=no add chain=restrict-tcp connection-mark=auth action=reject \ reject-with=icmp-network-unreachable comment="" disabled=no add chain=restrict-tcp connection-mark=smtp action=jump \ jump-target=smtp-first-reject comment="anti-spam policy" disabled=no add chain=smtp-first-drop src-address-list=first-smtp \ action=add-src-to-address-list address-list=approved-smtp \ address-list-timeout=0s comment="" disabled=no add chain=smtp-first-drop src-address-list=approved-smtp action=return \ comment="" disabled=no add chain=smtp-first-drop action=add-src-to-address-list \ address-list=first-smtp address-list-timeout=0s comment="" disabled=no add chain=smtp-first-drop action=reject reject-with=icmp-network-unreachable \ comment="" disabled=no add chain=restrict-tcp connection-mark=other-tcp action=jump jump-target=drop \ comment="" disabled=no add chain=restrict-udp connection-mark=other-udp action=jump jump-target=drop \ comment="" disabled=no add chain=restrict-ip connection-mark=other action=jump jump-target=drop \ comment="" disabled=no add chain=input action=jump jump-target=drop comment="Dropping NetBios" \ disabled=no add chain=input action=jump jump-target=Limit-Conn comment="Limito conexiones \ TCP" disabled=no add chain=input action=jump jump-target=drop-p2p comment="Drop P2P " \ disabled=no add chain=input src-address-type=local dst-address-type=local action=accept \ comment="Allow local traffic \(between router applications\)" disabled=no add chain=input in-interface=Local protocol=udp src-port=68 dst-port=67 \ action=jump jump-target=dhcp comment="DHCP protocol would not pass sanity \

checking, so enabling it explicitly before other checks" disabled=no add chain=input action=jump jump-target=sanity-check comment="Sanity Check" \ disabled=no add chain=input dst-address-type=!local action=jump jump-target=drop \ comment="Dropping packets not destined to the router itself, including all \ broadcast traffic" disabled=no add chain=input in-interface=Local action=jump jump-target=local-services \ comment="Allowing some services to be accessible from the local network" \ disabled=no add chain=input in-interface=Public action=jump jump-target=public-services \ comment="Allowing some services to be accessible from the Internet" \ disabled=no add chain=input connection-mark=ping limit=5,5 action=accept comment="Alllow \ pings, but at a very limited rate \(5 per sec\)" disabled=no add chain=dhcp src-address=0.0.0.0 dst-address=255.255.255.255 action=accept \ comment="" disabled=no add chain=dhcp src-address=0.0.0.0 dst-address-type=local action=accept \ comment="" disabled=no add chain=dhcp dst-address-type=local src-address-list=local-addr \ action=accept comment="" disabled=no add chain=local-services connection-mark=ssh action=accept comment="SSH \ \(22/TCP\)" disabled=no add chain=local-services connection-mark=dns action=accept comment="DNS" \ disabled=no add chain=local-services connection-mark=proxy action=accept comment="HTTP \ Proxy \(3128/TCP\)" disabled=no add chain=local-services connection-mark=winbox action=accept comment="Winbox \ \(8291/TCP\)" disabled=no add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop \ Blaster Worm" disabled=no add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop \ Messenger Worm" disabled=no add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster \ Worm" disabled=no add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster \ Worm" disabled=no add chain=virus protocol=tcp dst-port=593 action=drop comment="________" \ disabled=no add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \ disabled=no add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \ disabled=no add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \ disabled=no add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \ disabled=no add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \ disabled=no add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \ disabled=no add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \ disabled=no add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" \ disabled=no add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \ disabled=no

add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \ disabled=no add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \ disabled=no add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \ disabled=no add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop \ Beagle.C-K" disabled=no add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop \ MyDoom" disabled=no add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \ OptixPro" disabled=no add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" \ disabled=no add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" \ disabled=no add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \ disabled=no add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \ disabled=no add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop \ Dabber.A-B" disabled=no add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop \ Dumaru.Y" disabled=no add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop \ MyDoom.B" disabled=no add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \ disabled=no add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \ disabled=no add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop \ SubSeven" disabled=no add chain=Limit-Conn src-address=192.168.0.0/24 protocol=tcp \ connection-limit=80,32 action=drop comment="Limitar a 80 las conexiones \ por clientes GRAL" disabled=no add chain=drop-p2p protocol=tcp tcp-flags=syn p2p=warez connection-limit=10,32 \ action=drop comment="Limito a 20 conexiones TCP el P2P" disabled=no add chain=drop-p2p src-address=192.168.0.0/24 p2p=all-p2p action=drop \ comment="Dropear las 24hs." disabled=no add chain=drop protocol=tcp connection-mark=netbios action=drop comment="Drop \ NetBios" disabled=no add chain=drop protocol=udp connection-mark=netbios action=drop comment="" \ disabled=no add chain=drop action=drop comment="MAC que rompio las bolas" disabled=yes add chain=drop src-address-list=Bloqueo_IPs_no_usados action=drop \ comment="Bloqueo de IPs no usadas" disabled=no add chain=drop src-address-list=blocked-addr action=drop comment="dropping \ port scanners -- Esto viene de Sanity Check" disabled=no add chain=public-services src-address=127.0.0.1 dst-address=127.0.0.1 \ action=accept comment="accept localhost" disabled=no add chain=public-services protocol=tcp dst-port=20-21 action=accept \ comment="FTP \(20-21/TCP\)" disabled=no add chain=public-services connection-mark=ssh action=accept comment="SSH \ \(22/TCP\)" disabled=no add chain=public-services connection-mark=telnet action=accept comment="TELNET \ \(23/TCP\)" disabled=no

add chain=public-services connection-mark=http action=accept \ comment="HTTP,WEBBOX \(80/TCP\)" disabled=no add chain=public-services connection-mark=winbox action=accept comment="Winbox \ \(8291/TCP\)" disabled=no add chain=public-services protocol=udp dst-port=20561 action=accept \ comment="allow MACwinbox " disabled=yes add chain=public-services src-address=159.148.172.205 protocol=tcp \ dst-port=7828 action=accept comment="..." disabled=yes add chain=public-services connection-mark=Radmin action=accept comment="RADMIN \ Bandwidth server \(TCP/4899\)" disabled=no add chain=public-services protocol=udp dst-port=5678 action=accept comment=" \ MT Discovery Protocol" disabled=yes add chain=public-services connection-mark=l2tp action=accept comment="L2TP \ \(1701/TCP\)" disabled=no add chain=public-services connection-mark=pptp action=accept comment="PPTP \ \(1723/TCP\)" disabled=no add chain=public-services connection-mark=gre action=accept comment="GRE for \ PPTP and EoIP" disabled=no add chain=public-services protocol=ipencap action=accept comment="allow IPIP" \ disabled=no add chain=public-services protocol=udp dst-port=1900 action=accept \ comment="UPnP" disabled=yes add chain=public-services protocol=tcp dst-port=2828 action=accept \ comment="UPnP" disabled=yes add chain=public-services protocol=udp dst-port=67-68 action=accept \ comment="allow DHCP" disabled=yes add chain=public-services protocol=tcp dst-port=8080 action=accept \ comment="allow Web Proxy" disabled=yes add chain=public-services protocol=tcp dst-port=123 action=accept \ comment="allow NTP" disabled=yes add chain=public-services protocol=tcp dst-port=161 action=accept \ comment="allow SNMP" disabled=yes add chain=public-services protocol=tcp dst-port=443 action=accept \ comment="allow https for Hotspot" disabled=yes add chain=public-services protocol=tcp dst-port=1080 action=accept \ comment="allow Socks for Hotspot" disabled=yes add chain=public-services protocol=udp dst-port=500 action=accept \ comment="allow IPSec connections" disabled=yes add chain=public-services protocol=ipsec-esp action=accept comment="allow \ IPSec" disabled=no add chain=public-services protocol=ipsec-ah action=accept comment="allow \ IPSec" disabled=no add chain=public-services protocol=tcp dst-port=179 action=accept \ comment="Allow BGP" disabled=yes add chain=public-services protocol=udp dst-port=520-521 action=accept \ comment="allow RIP" disabled=yes add chain=public-services protocol=ospf action=accept comment="allow OSPF" \ disabled=yes add chain=public-services protocol=udp dst-port=5000-5100 action=accept \ comment="allow BGP" disabled=yes add chain=public-services protocol=tcp dst-port=1720 action=accept \ comment="allow Telephony" disabled=yes add chain=public-services protocol=udp dst-port=1719 action=accept \ comment="allow Telephony" disabled=yes add chain=public-services protocol=vrrp action=accept comment="allow VRRP " \ disabled=yes

add chain=drop src-address=10.10.102.200-10.10.102.254 protocol=tcp \ time=0s-23h59m,fri,thu,wed,tue,mon action=drop comment="SABADO Y DOMINGO" \ disabled=yes add chain=drop src-address=10.10.101.100-10.10.101.254 protocol=tcp \ time=7h30m-20h59m,sat,fri,thu,wed,tue,mon,sun action=drop comment="NOCHE" \ disabled=yes add chain=drop src-address=10.10.228.100-10.10.228.254 protocol=tcp \ time=6h-23h30m,sat,fri,thu,wed,tue,mon,sun action=drop comment="" \ disabled=yes add chain=drop src-address=10.10.100.100-10.10.100.199 protocol=tcp \ time=0s-6h59m,sat,fri,thu,wed,tue,mon,sun action=drop comment="MANANA" \ disabled=yes add chain=drop src-address=10.10.100.100-10.10.100.199 protocol=tcp \ time=11h1m-23h59m,sat,fri,thu,wed,tue,mon,sun action=drop comment="" \ disabled=yes add chain=drop src-address=10.10.100.200-10.10.100.254 protocol=tcp \ time=0s-16h59m,sat,fri,thu,wed,tue,mon,sun action=drop comment="TARDE" \ disabled=yes add chain=drop src-address=10.10.100.200-10.10.100.254 protocol=tcp \ time=21h-23h59m,sat,fri,thu,wed,tue,mon,sun action=drop comment="" \ disabled=yes add chain=drop connection-state=invalid action=drop comment="Dropear \ conexiones invalidas" disabled=no add chain=drop dst-address-type=broadcast,multicast action=drop \ comment="Bloqueo todo el Multicast y Broadcast" disabled=no add chain=drop dst-address-list=illegal-addr action=drop comment="Bloqueo todo \ lo que este en Ilegal Address" disabled=no add chain=drop protocol=tcp tcp-flags=rst action=drop comment="Drop TCP RST" \ disabled=yes add chain=drop dst-address-type=!local action=drop comment="Dropeo todo los \ paquetes que no van destinados hacia el router inclusive el trafico \ Broadcast " disabled=yes add chain=local-services connection-mark=Radmin action=accept comment="RADMIN \ Bandwidth server \(TCP/4899\)" disabled=no add chain=sanity-check packet-mark=nat-traversal action=jump jump-target=drop \ comment="Deny illegal NAT traversal" disabled=no add chain=sanity-check protocol=tcp connection-limit=3,32 \ src-address-list=blocked-addr action=tarpit comment="Detectar DoS Service" \ disabled=yes add chain=sanity-check protocol=tcp connection-limit=20,32 \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=5s comment="" disabled=yes add chain=sanity-check protocol=tcp psd=21,3s,3,1 \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=3s comment="Block port scans" disabled=yes add chain=sanity-check protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=10s comment="Block TCP Null scan" disabled=no add chain=sanity-check protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=10s comment="Block TCP Xmas scan" disabled=no add chain=sanity-check protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=10s comment="NMAP FIN Stealth scan" disabled=no add chain=sanity-check protocol=tcp tcp-flags=syn,rst \ action=add-src-to-address-list address-list=blocked-addr \

address-list-timeout=10s comment="Drop TCP SYN + RST" disabled=no add chain=sanity-check protocol=tcp tcp-flags=fin,syn \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=10s comment="Drop TCP FIN+SYN" disabled=no add chain=sanity-check protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg \ action=add-src-to-address-list address-list=blocked-addr \ address-list-timeout=10s comment="ALL/ALL scan" disabled=no add chain=sanity-check src-address-list=blocked-addr action=jump \ jump-target=drop comment="Drop diferentes metodos de Port Scanners" \ disabled=no add chain=sanity-check connection-state=invalid action=jump jump-target=drop \ comment="Dropping invalid connections at once" disabled=no add chain=sanity-check connection-state=established action=accept \ comment="Accepting already established connections" disabled=no add chain=sanity-check connection-state=related action=accept comment="Also \ accepting related connections" disabled=no add chain=sanity-check dst-address-type=broadcast,multicast action=jump \ jump-target=drop comment="Drop all traffic that goes to multicast or \ broadcast addresses" disabled=no add chain=sanity-check in-interface=Local dst-address-list=illegal-addr \ action=jump jump-target=drop comment="Drop illegal destination addresses" \ disabled=no add chain=sanity-check in-interface=Local src-address-list=!local-addr \ action=jump jump-target=drop comment="Drop everything that goes from local \ interface but not from local address" disabled=no add chain=sanity-check protocol=tcp src-address-list=blocked-addr action=jump \ jump-target=drop comment="" disabled=no add chain=sanity-check in-interface=Public src-address-list=illegal-addr \ action=jump jump-target=drop comment="Drop illegal source addresses" \ disabled=no add chain=sanity-check in-interface=Public dst-address-list=!local-addr \ action=jump jump-target=drop comment="Drop everything that goes from \ public interface but not to local address" disabled=no add chain=sanity-check src-address-type=broadcast,multicast action=jump \ jump-target=drop comment="Drop all traffic that goes from multicast or \ broadcast addresses" disabled=no add chain=drop src-mac-address=00:11:3B:02:52:19 action=drop comment="" \ disabled=yes add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \ Gaobot" disabled=no