ab-intermedia.com

Untuk melindungi network user, kita harus memeriksa semua traffic yang melewati router dan blok yang tidak diinginkan.Untuk traffic ICMP, TCP, UDP kita akan membuat chain dimana akan melakukan DROP untuk paket-paket yang tidak diinginkan.

/ip firewall filter
add chain=forward connection-state=established comment=”allow established connections”
add chain=forward connection-state=related comment=”allow related connections”
add chain=forward connection-state=invalid action=drop comment=”drop invalid connections”

Untuk mencegah Jaringan LAN dari virus   input dan forward nya bisa disesuaikan dengan kebutuhan

add action=jump chain=forward comment=”PREVENT VIRUS COME FROM LOCAL NETWORK” \
disabled=no in-interface=ether-local jump-target=viruses
add action=jump chain=forward comment=\
“PREVENT VIRUS COME FROM PUBLIC INTERNET NETWORK” disabled=no \
in-interface=ether-public jump-target=viruses
add action=jump chain=input comment=”PREVENT VIRUS COME FROM LAN” disabled=no \
in-interface=ether-local jump-target=viruses
add action=jump chain=input comment=”PREVENT VIRUS COME FROM PUBLIC INTERNET” \
disabled=no in-interface=ether-public jump-target=viruses
add action=jump chain=viruses comment=”Jump to handle virus from TCP port” \
disabled=no jump-target=tcp-viruses protocol=tcp
add action=jump chain=viruses comment=”Jump to handle virus from UDP port” \
disabled=no jump-target=udp-viruses protocol=udp
add action=return chain=viruses comment=”Back to previous rules” disabled=no



Script Hemat untuk blok Netbios di windows sumber muasal Confliker disini :

/ip fi fi
add action=drop chain=forward comment="Conficker Filter" disabled=no dst-port=135-139,445 protocol=tcp
add action=drop chain=forward disabled=no protocol=tcp src-port=135-139,445
add action=drop chain=forward disabled=no dst-port=135-139,445 protocol=udp
add action=drop chain=forward disabled=no protocol=udp src-port=135-139,445
add action=add-dst-to-address-list address-list=conficker address-list-timeout=0s chain=forward disabled=no dst-port=135-139,445 protocol=tcp
add action=add-dst-to-address-list address-list=conficker address-list-timeout=0s chain=forward disabled=no protocol=tcp src-port=135-139,445
add action=add-dst-to-address-list address-list=conficker address-list-timeout=0s chain=forward disabled=no dst-port=135-139,445 protocol=udp
add action=add-dst-to-address-list address-list=conficker address-list-timeout=0s chain=forward disabled=no protocol=udp src-port=135-139,445
add action=drop chain=forward disabled=no src-address-list=conficker

tambahan :

add chain=virus action=drop protocol=tcp dst-port=135-139
add chain=virus action=drop protocol=icmp dst-port=135-139
add chain=virus action=drop protocol=tcp dst-port=445
add chain=virus action=drop protocol=ICMP dst-port=445
add chain=virus action=drop protocol=tcp dst-port=593
add chain=virus action=drop protocol=tcp dst-port=1024-1030
add chain=virus action=drop protocol=tcp dst-port=1080
add chain=virus action=drop protocol=tcp dst-port=1214
add chain=virus action=drop protocol=tcp dst-port=1364
add chain=virus action=drop protocol=tcp dst-port=593
add chain=virus action=drop protocol=tcp dst-port=1024-1030
add chain=virus action=drop protocol=tcp dst-port=1080
add chain=virus action=drop protocol=tcp dst-port=1214
add chain=virus action=drop protocol=tcp dst-port=1364
add chain=virus action=drop protocol=6icmp dst-port=1364
add chain=virus action=drop protocol=tcp dst-port=1368
add chain=virus action=drop protocol=tcp dst-port=1373
add chain=virus action=drop protocol=tcp dst-port=1377
add chain=virus action=drop protocol=tcp dst-port=1433-1434
add chain=virus action=drop protocol=tcp dst-port=2745
add chain=virus action=drop protocol=tcp dst-port=2283
add chain=virus action=drop protocol=tcp dst-port=2535
add chain=virus action=drop protocol=tcp dst-port=2745
add chain=virus action=drop protocol=tcp dst-port=3127-3128
add chain=virus action=drop protocol=tcp dst-port=3410
add chain=virus action=drop protocol=tcp dst-port=4444
add chain=virus action=drop protocol=icmp dst-port=4444
add chain=virus action=drop protocol=tcp dst-port=5554
add chain=virus action=drop protocol=tcp dst-port=8866
add chain=virus action=drop protocol=tcp dst-port=9898
add chain=virus action=drop protocol=tcp dst-port=10000
add chain=virus action=drop protocol=udp dst-port=10000
add chain=virus action=drop protocol=tcp dst-port=12345
add chain=virus action=drop protocol=tcp dst-port=17306
add chain=virus action=drop protocol=tcp dst-port=27374
add chain=virus action=drop protocol=tcp dst-port=65500

Diatas kita telah dapatkan daftar rule untuk memfilter paket-paket dari protocol dan posrt yang merupakan berasal dari Virus ataupun Trojan. Daftar diatas belum komplit, kita bisa mendapatkan rule-rule tambahan dari berbagai sumber, tapi setidaknya rule diatas dapat menjadi awal.

Agar paket dari chain forward dapat menuju ke chain virus kita dapat menererapkan action=jump, seperti rule dibawah ini :
add chain=forward action=jump jump-target=virus comment=”jump to the virus chain”

Bila paket yang ter-jump ke chain virus tidak ter-filter, maka paket tersebut akan dikembalikan ke chain forward.
Kita dapat dengan mudah menambahkan rule yang membolehkan udp dan ping dan drop yang lainnnya (jika tidak ada service pada network user yang perlu diakses dari network luar) :
add chain=forward protocol=icmp comment=”allow ping”
add chain=forward protocol=udp comment=”allow udp”
add chain=forward action=drop comment=”drop everything else”

Sumber : http://www.forummikrotik.com