محافظت DDoS روی MikroTik: اسکریپت‌ها و تکنیک‌های فایروال

/ip firewall filter
add chain=input protocol=udp dst-port=0-65535 fragment=yes action=drop comment="Drop fragmented UDP"
add chain=input protocol=tcp fragment=yes action=drop comment="Drop fragmented TCP"

/ip firewall filter
add chain=input connection-state=new action=jump jump-target=conn-rate-limit
/ip firewall filter
add chain=conn-rate-limit src-address-list=conn-flood action=drop
add chain=conn-rate-limit action=add-src-to-address-list address-list=conn-flood address-list-timeout=5m limit=20,10:packet
add chain=conn-rate-limit action=accept

/ip firewall filter
add chain=input protocol=icmp icmp-options=8:0 action=jump jump-target=icmp-rate
/ip firewall filter
add chain=icmp-rate src-address-list=icmp-flood action=drop
add chain=icmp-rate action=add-src-to-address-list address-list=icmp-flood address-list-timeout=5m limit=10,5:packet
add chain=icmp-rate action=accept

/ip firewall filter
add chain=input protocol=tcp tcp-flags=syn connection-state=new action=jump jump-target=syn-protect
/ip firewall filter
add chain=syn-protect src-address-list=syn-flood action=drop
add chain=syn-protect action=add-src-to-address-list address-list=syn-flood address-list-timeout=10m limit=50,5:packet
add chain=syn-protect action=accept

/ip firewall filter
add chain=input protocol=udp action=jump jump-target=udp-protect
/ip firewall filter
add chain=udp-protect src-address-list=udp-flood action=drop
add chain=udp-protect action=add-src-to-address-list address-list=udp-flood address-list-timeout=10m limit=100,50:packet
add chain=udp-protect action=accept

/ip firewall address-list
add list=bogons address=0.0.0.0/8
add list=bogons address=10.0.0.0/8
add list=bogons address=127.0.0.0/8
add list=bogons address=169.254.0.0/16
add list=bogons address=172.16.0.0/12
add list=bogons address=192.168.0.0/16
add list=bogons address=240.0.0.0/4

/ip firewall filter
add chain=input src-address-list=bogons action=drop comment="Drop bogon sources"
add chain=forward src-address-list=bogons action=drop

/system script
add name=ddos-check source={
    :local conns [/ip firewall connection print count-only]
    :if ($conns > 5000) do={
        /log warning "DDoS suspected: $conns active connections"
    }
}

/system scheduler
add name=ddos-monitor interval=1m on-event=ddos-check

/ip firewall address-list print where list~"flood"
/ip firewall connection print count-only
/system resource print