Kopi paste script dibawah ini:
ip firewall filter add chain=input protocol=tcp dst-port=1337 action= add-src-toaddress-
list address-list=DDOS address-list-timeout=15s comment=”"
disabled=no
ip firewall filter add chain=input protocol=tcp dst-port=7331 src-addresslist=
knock action= add-src-to-address-list address-list=DDOS address-listtimeout=
15m comment=”" disabled=no
ip firewall filter add chain=input connection-state=established action=accept
comment=”accept established connection packets” disabled=no
ip firewall filter add chain=input connection-state=related action=accept
comment=”accept related connection packets” disabled=no
ip firewall filter add chain=input connection-state=invalid action=drop
comment=”drop Paket Invalid” disabled=no
ip firewall filter add chain=input protocol=tcp psd=21,3s,3,1 action=drop
comment=”Mendetek serangan Port Scaner” disabled=no
ip firewall filter add chain=input protocol=tcp connection-limit=3,32 src-addresslist=
black_list action=tarpit comment=”Bikin kejutan ke ip penyerang”
disabled=no
ip firewall filter add chain=input protocol=tcp connection-limit=10,32 action=addsrc-
to-address-list address-list=black_list address-list-timeout=1d
comment=”Masukin ke karung Ip penyerang” disabled=no
ip firewall filter add chain=input protocol=icmp action=jump jump-target=ICMP
comment=”jump chain ICMP” disabled=no
ip firewall filter add chain=input action=jump jump-target=services
comment=”jump chain service” disabled=no
ip firewall filter add chain=input dst-address-type=broadcast action=accept
comment=”Allow Broadcast Traffic” disabled=no
ip firewall filter add chain=input action=log log-prefix=”Filter:” comment=”Catat
kegiatan penyerang” disabled=no
ip firewall filter add chain=input src-address=Subnet WAN action=accept
comment=”List Ip yang boleh akses ke router”
ip firewall filter add chain=input src-address=Subnet Lan action=accept
ip firewall filter add chain=input src-address=Subnet DMZ action=accept
ip firewall filter add chain=input action=drop comment=”Blok Semua yang aneh2″
disabled=no
ip firewall filter add chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5
action=accept comment=”0:0 dan limit utk 5pac/s” disabled=no
ip firewall filter add chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5
action=accept comment=”3:3 dan limit utk 5pac/s” disabled=no
ip firewall filter add chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5
action=accept comment=”3:4 dan limit for 5pac/s” disabled=no
ip firewall filter add chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5
action=accept comment=”8:0 and limit utk 5pac/s” disabled=no
ip firewall filter add chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5
action=accept comment=”11:0 and limit utk 5pac/s” disabled=no
ip firewall filter add chain=ICMP protocol=icmp action=drop comment=”Blok
semua yang aneh2″ disabled=no
ip firewall filter add chain=forward protocol=icmp comment=”Perbolehkan ping”
ip firewall filter add chain=forward protocol=udp comment=”Perbolehkan ke udp”
ip firewall filter add chain=forward src-address=Subnet WAN action=accept
comment=”Akses hanya dari ip terdaftar”
ip firewall filter add chain=forward src-address=Subnet LAN action=accept
ip firewall filter add chain=forward src-address=Subnet DMZ action=accept
ip firewall filter add chain=forward action=drop comment=”blok semua yang
aneh2″
Semoga bermanfaat, jika anda mengalami hal seperti saya diatas jangan langsung salahkan ISP tempat anda berlangganan …..
1. bersihin dulu isi route nya , dari winbox pilih ip route, trus di delete deh tuh gateway/route disitu, semuanya
2. bersihin juga manglenya, caranya ip firewal mangle print, kalo dari winbox pilih ip > firewall >mangle, abis itu delete2 semuanya tuh
3. bersihin juga nat nya, dari winbox, ip > firewall > nat , trus delete tuh isinya
4. selanjutnya ikutin langkah2 berikut ini ya slow down aja jangan sampe salah ketik, sebaiknya pake tab biar auto completing penjelasan singkat ada 3 interface
1.lokal=192.168.100.254/24
2.isp=202.182.54.74/30
3.fastnet=118.137.79.0/24 (nah nilai ini yang selalu di ubah2, hanya yg ini, yg lain kaga usah, ubahnya pake winbox aja)
/ip address (enter)
add address=192.168.100.254/24 interface=lokal comment=”ip trafik lan” disabled=no
add address=202.182.54.74/30 interface=isp comment=”ip trafik indonesia” disabled=no
add address=118.137.79.0/24 interface=fastnet comment=”ip trafik luar” disabled=no
/ip firewall (enter)
add chain=src-nat src-address=192.168.100.0/24 action=masquerade
/ip firewall mangle (enter)
add action=mark-connection chain=prerouting comment=”" connection-state=new \
disabled=no in-interface=Lokal new-connection-mark=fastnet \
dst-address-list=!nice passthrough=yes
add action=mark-routing chain=prerouting comment=”" connection-mark=fastnet \
disabled=no in-interface=Lokal new-routing-mark=fastnet passthrough=no \
dst-address-list=!nice
add action=mark-connection chain=prerouting comment=”" connection-state=new \
disabled=no in-interface=Lokal new-connection-mark=isp \
passthrough=yes
add action=mark-routing chain=prerouting comment=”" connection-mark=isp \
disabled=no in-interface=Lokal new-routing-mark=isp passthrough=no
/ip route (enter)
add dst-address=0.0.0.0/0 gateway=118.137.79.1 scope=255 target-scope=10
comment=”gateway traffic internasional” disabled=no
add dst-address=0.0.0.0/0 gateway=202.182.54.73 scope=255 target-scope=10
comment=”gateway traffic IIX” mark=nice2 disabled=no
untuk simple queue nya ga usah diapa2in ya..awas loh..
