View source for RouterOS 默认防火墙规则

Mikrotik 的 RouterBoard 硬件产品默认都有带有配置良好的防火墙规则，x86/CHR 设备默认不带防火墙规则。 如果你不小心删掉了防火墙规则，或者需要还原默认防火墙规则，可以导入以下配置：。
 <code>/interface list
 add comment=defconf name=WAN
 add comment=defconf name=LAN
 
 /interface list member
 add comment=defconf interface=bridge list=LAN
 add comment=defconf interface=ether1 list=WAN
 
 /ip firewall filter
 add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
 add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
 add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
 add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
 add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
 add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
 add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
 add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
 add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
 add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
 add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
 
 /ipv6 firewall address-list
 add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
 add address=::1/128 comment="defconf: lo" list=bad_ipv6
 add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
 add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
 add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
 add address=100::/64 comment="defconf: discard only " list=bad_ipv6
 add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
 add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
 add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
 
 /ipv6 firewall filter
 add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
 add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
 add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
 add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
 add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
 add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
 add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
 add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
 add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
 add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
 add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
 add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
 add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
 add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
 add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
 add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
 add action=accept chain=forward comment="defconf: accept HIP" protocol=139
 add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
 add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
 add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
 add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
 add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN</code>
规则提取自 RouterOS 7.1.1，更新于 2021年12月31日。