Allied Telesis AT-WR4500 manual Mangle, Create tcp chain and deny some tcp ports in it

204	AT-WR4500 Series - IEEE 802.11abgh Outdoor Wireless Routers
	RouterOS v3 Configuration and User Guide

Make jumps to new chains:

add chain=forward protocol=tcp action=jump jump-target=tcp add chain=forward protocol=udp action=jump jump-target=udp add chain=forward protocol=icmp action=jump jump-target=icmp

Create tcp chain and deny some tcp ports in it:

add chain=tcp protocol=tcp dst-port=69 action=drop \ comment="deny TFTP"

add chain=tcp protocol=tcp dst-port=111 action=drop \ comment="deny RPC portmapper"

add chain=tcp protocol=tcp dst-port=135 action=drop \ comment="deny RPC portmapper"

add chain=tcp protocol=tcp dst-port=137-139 action=drop \ comment="deny NBT"

add chain=tcp protocol=tcp dst-port=445 action=drop \ comment="deny cifs"

add chain=tcp protocol=tcp dst-port=2049 action=drop comment="deny NFS"

add chain=tcp protocol=tcp dst-port=12345-12346 action=drop comment="deny NetBus" add chain=tcp protocol=tcp dst-port=20034 action=drop comment="deny NetBus"

add chain=tcp protocol=tcp dst-port=3133 action=drop comment="deny BackOriffice" add chain=tcp protocol=tcp dst-port=67-68 action=drop comment="deny DHCP"

Deny udp ports in udp chain:

add chain=udp protocol=udp dst-port=69 action=drop comment="deny TFTP"

add chain=udp protocol=udp dst-port=111 action=drop comment="deny PRC portmapper" add chain=udp protocol=udp dst-port=135 action=drop comment="deny PRC portmapper" add chain=udp protocol=udp dst-port=137-139 action=drop comment="deny NBT"

add chain=udp protocol=udp dst-port=2049 action=drop comment="deny NFS"

add chain=udp protocol=udp dst-port=3133 action=drop comment="deny BackOriffice"

Allow only needed icmp codes in icmp chain:

add chain=icmp protocol=icmp icmp-options=0:0 action=accept \ comment="drop invalid connections"

add chain=icmp protocol=icmp icmp-options=3:0 action=accept \ comment="allow established connections"

add chain=icmp protocol=icmp icmp-options=3:1 action=accept \ comment="allow already established connections"

add chain=icmp protocol=icmp icmp-options=4:0 action=accept \ comment="allow source quench"

add chain=icmp protocol=icmp icmp-options=8:0 action=accept \ comment="allow echo request"

add chain=icmp protocol=icmp icmp-options=11:0 action=accept \ comment="allow time exceed"

add chain=icmp protocol=icmp icmp-options=12:0 action=accept \ comment="allow parameter bad"

add chain=icmp action=drop comment="deny all other types"

9.2Mangle

9.2.1General Information

Summary

The mangle facility allows marking IP packets with special marks. These marks are used by various other router facilities to identify the packets. Additionaly, the mangle facility is used to modify some fields in the IP header, like TOS (DSCP) and TTL fields.

Specifications

Packages required: system

License required: Level1