ros的一些設置

端口映射規則，dst-address填寫你的公網地址，亂寫也能夠，到後面會經過定時腳本自動更新

/ip firewall nat
add action=dst-nat chain=dstnat comment=nat-235 dst-address=11.22.33.44 \
    dst-port=21 protocol=tcp to-addresses=192.168.88.235 to-ports=21
add action=masquerade chain=srcnat src-address=192.168.88.0/22

 

ip統計腳本

/ip firewall mangle
add action=add-src-to-address-list address-list=online address-list-timeout=\
    none-static chain=prerouting comment="ip calc" dst-address-type="" \
    dst-limit=1,5,dst-address/1m40s limit=1,5:packet src-address=\
    192.168.88.0/22 src-address-type="" time=\
    0s-1d,sun,mon,tue,wed,thu,fri,sat

 

須要的腳本

/system script
add dont-require-permissions=no name=set-nat-global-ip owner=mmc policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    global ipaddr [/ip address get [/ip address find interface=pppoe-out1] add\
    ress]\r\
    \n\r\
    \n:set ipaddr [:pick \$ipaddr 0 ([len \$ipaddr] -3)]\r\
    \n:global oldip [/ip firewall nat get [/ip firewall nat find comment=\"nat\
    -235\"] dst-address]\r\
    \n\r\
    \n:if (\$ipaddr != \$oldip) do={\r\
    \n  log info message=[/ip firewall nat set [/ip firewall nat find comment=\
    \"nat-235\"] dst-address=\$ipaddr]\r\
    \n}"
add dont-require-permissions=no name=ip-number owner=mmc policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=":\
    local ipNumber 0\r\
    \n:local onlineIPList online\r\
    \n\r\
    \n:foreach i in=[/ip firewall address-list find list=\$onlineIPList] do={\
    \r\
    \n  :set ipNumber (\$ipNumber+1)\r\
    \n  }\r\
    \nlog warning message=(\"current \" . \$ipNumber . \" ips online\")"

 

定時器

/system scheduler
add interval=1m name=global-ip-sync on-event=":execute \"set-nat-global-ip\"" \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-date=oct/16/2018 start-time=11:07:59
add interval=1m name=ip-statistic on-event=":execute \"ip-number\"" policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    start-time=startup

 

pcq限速

/queue simple
add max-limit=50M/100M name=pcq1 queue=pcq-upload-default/pcq-download-default target=192.168.88.0/2

 

限制mac上網腳本

ip firewall filter add chain=forward src-mac-address=00:00:00:00:00:00 action=drop