時區主機.
--
v7
--
/system ntp client
set enabled=yes
/system ntp client servers
add address=tock.stdtime.gov.tw
add address=watch.stdtime.gov.tw
add address=time.stdtime.gov.tw
add address=clock.stdtime.gov.tw
add address=tick.stdtime.gov.tw
--
v6
--
/system ntp client
set enabled=yes primary-ntp=pool.ntp.org secondary-ntp=pool.ntp.org \
server-dns-names=\
0.pool.ntp.org,1.pool.ntp.org,2.pool.ntp.org,3.pool.ntp.org
/system scheduler
add comment="Check and set NTP servers" interval=6h name=SetNtpServers \
on-event="# SetNtpServers - Check and set NTP servers from NTP pool\r\
\n# v1.2 Tested and Developed on ROS v5.7\r\
\n\r\
\n#\r\
\n# Change the following line as needed as progName should match script na\
me \r\
\n:local progName \"SetNtpServers\";\r\
\n\r\
\n# Array of NTP pools to use (check www.pool.ntp.org) one or a maximum of\
\_two, a primary & secondary\r\
\n# Modify the following line and array variable based on your locale (def\
ault is north america).\r\
\n:local arrNtpSystems (\"0.pool.ntp.org\", \"1.pool.ntp.org\");\r\
\n# Alternatively the US related pool below can be used. \r\
\n#:local arrNtpSystems (\"0.pool.ntp.org\", \"1.pool.ntp.org\");\r\
\n#\r\
\n# No modification is necessary beyond this line.\r\
\n:put \"\$progName: Running...\";\r\
\n:log info \"\$progName: Running...\";\r\
\n:set arrNtpSystems [ :toarray \$arrNtpSystems ];\r\
\n:if (( [ :len \$arrNtpSystems ] < 1 ) or ( [ :len \$arrNtpSystems ] > 2 \
)) do={ \r\
\n :put \"\$progName: ERROR NTP Systems array (\\\$arrNtpSystems) must \
be either one or two DNS names.\";\r\
\n :log info \"\$progName: ERROR NTP Systems array (\\\$arrNtpSystems) \
must be either one or two DNS names.\";\r\
\n} else={\r\
\n :local arrRosNtpSetting (\"primary-ntp\", \"secondary-ntp\");\r\
\n :local i 0;\r\
\n :foreach strNtpSystem in (\$arrNtpSystems) do={\r\
\n :local ipAddrNtpSystem [ :resolve \$strNtpSystem ];\r\
\n :local strRosNtpSetting [ :pick \$arrRosNtpSetting \$i ];\r\
\n :local strCurrentNtpIp [ /system ntp client get \$strRosNtpSetti\
ng ];\r\
\n :put \"\$progName: NTP server DNS name \$strNtpSystem resolves t\
o \$ipAddrNtpSystem.\";\r\
\n :log info \"\$progName: NTP server DNS name \$strNtpSystem resol\
ves to \$ipAddrNtpSystem.\";\r\
\n :put \"\$progName: Current \$strRosNtpSetting setting is \$strCu\
rrentNtpIp.\";\r\
\n :log info \"\$progName: Current \$strRosNtpSetting setting is \$\
strCurrentNtpIp.\";\r\
\n :if ( [ :toip \$ipAddrNtpSystem ] != [ :toip \$strCurrentNtpIp ]\
\_) do={\r\
\n :put \"\$progName: Changing \$strRosNtpSetting setting to \$\
ipAddrNtpSystem.\";\r\
\n :log info \"\$progName: Changing \$strRosNtpSetting setting \
to \$ipAddrNtpSystem.\";\r\
\n :local strCommand [ :parse \"/system ntp client set \$strRos\
NtpSetting=\\\"\$ipAddrNtpSystem\\\"\" ];\r\
\n \$strCommand;\r\
\n } else={\r\
\n :put \"\$progName: No changes were made for the \$strRosNtpS\
etting NTP setting.\";\r\
\n :log info \"\$progName: No changes were made for the \$strRo\
sNtpSetting NTP setting.\";\r\
\n }\r\
\n :set i (\$i + 1);\r\
\n }\r\
\n}\r\
\n:put \"\$progName: Done.\";\r\
\n:log info \"\$progName: Done.\";" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup

--
CTI中天新聞24小時HD新聞直播 │ CTITV Taiwan News HD Live|台湾のHDニュース放送| 대만 HD 뉴스 방송 【中天大直播】
人品是做人最好的底牌.
A版於2025/06/22更新全完結.All Pass
--
/interface bridge
add igmp-snooping=yes multicast-querier=yes name=bridge1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=5m cache-size=104857KiB \
servers=168.95.192.1,168.95.1.1
/ip dns adlist
add ssl-verify=no url="https://raw.githubusercontent.com/hagezi/dns-blocklists\
/main/domains/ultimate.txt"
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip firewall address-list
add list=ddos-attackers
add list=ddos-targets
add address=0.0.0.0/8 comment=RFC6890 list=bad_dst_ipv4
add address=224.0.0.0/4 comment=RFC6890 list=bad_dst_ipv4
add address=127.0.0.0/8 comment=RFC6890 list=bad_ipv4
add address=192.0.0.0/24 comment=RFC6890 list=bad_ipv4
add address=192.0.2.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=198.51.100.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=203.0.113.0/24 comment="RFC6890 documentation" list=bad_ipv4
add address=240.0.0.0/4 comment="RFC6890 reserved" list=bad_ipv4
add address=224.0.0.0/4 comment=multicast list=bad_src_ipv4
add address=255.255.255.255 comment=RFC6890 list=bad_src_ipv4
add address=0.0.0.0/8 comment=RFC6890 list=no_forward_ipv4
add address=169.254.0.0/16 comment=RFC6890 list=no_forward_ipv4
add address=224.0.0.0/4 comment=multicast list=no_forward_ipv4
add address=255.255.255.255 comment=RFC6890 list=no_forward_ipv4
add address=0.0.0.0/8 comment=RFC6890 list=not_global_ipv4
add address=10.0.0.0/8 comment=RFC6890 list=not_global_ipv4
add address=100.64.0.0/10 comment=RFC6890 list=not_global_ipv4
add address=169.254.0.0/16 comment=RFC6890 list=not_global_ipv4
add address=172.16.0.0/12 comment=RFC6890 list=not_global_ipv4
add address=192.0.0.0/29 comment=RFC6890 list=not_global_ipv4
add address=192.168.0.0/16 comment=RFC6890 list=not_global_ipv4
add address=198.18.0.0/15 comment="RFC6890 benchmark" list=not_global_ipv4
add address=255.255.255.255 comment=RFC6890 list=not_global_ipv4
/ip firewall filter
add chain=input comment="Accept Icmp" protocol=icmp
add chain=input comment="Accept established,related,untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="Drop all not coming from LAN" \
in-interface-list=!LAN log=yes log-prefix=Drop
add chain=forward comment="Accept established,related, untracked" \
connection-state=established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=jump chain=forward comment="SYN/DoS/DDoS Protection" \
connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddos-targets \
address-list-timeout=10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddos-attackers \
address-list-timeout=10m chain=detect-ddos
add action=return chain=detect-ddos comment="SYN Flood protect" dst-limit=\
32,32,src-and-dst-addresses/10s protocol=tcp tcp-flags=syn,ack
add action=drop chain=forward comment="Drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="Drop bad forward IPs" \
src-address-list=no_forward_ipv4
add action=drop chain=forward comment="Drop bad forward IPs" \
dst-address-list=no_forward_ipv4
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
"UDP-Port (VoIP / Zoom / Team) \A1\F7 Conn-Mark (EF) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - EF" protocol=udp src-port=\
4500,5060,16384-32767
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Zoom) \A1\F7 Conn-Mark (AF43) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF43" protocol=tcp src-port=8801-8810
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Zoom / Google Meet) \A1\F7 Conn-Mark (AF43) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF43" protocol=udp \
src-port=8801-8810,19302-19309
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Teams Video) \A1\F7 Conn-Mark (AF42) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF42" protocol=udp src-port=\
3478-3481
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Webex) \A1\F7 Conn-Mark (AF41) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF41" protocol=udp src-port=5004
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Steam) \A1\F7 Conn-Mark (AF33) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF33" protocol=udp src-port=27005
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Steam) \A1\F7 Conn-Mark (AF33) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF33" protocol=tcp src-port=27015
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Valorant / PUBG / Steam) \A1\F7 Conn-Mark (AF31) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF31" protocol=udp \
src-port=7000-8000,10000-20019,27000-27100
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Genshin Impact) \A1\F7 Conn-Mark (AF31) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF31" protocol=tcp src-port=22102
add action=mark-connection chain=prerouting comment=\
"UDP-Port (YouTube / Netflix) \A1\F7 Conn-Mark (AF23) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF23" protocol=udp src-port=443,53
add action=mark-connection chain=prerouting comment=\
"TCP-Port (YouTube / Netflix / Twitch) \A1\F7 Conn-Mark (AF23) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF23" protocol=tcp \
src-port=443,53,1935
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Spotify) \A1\F7 Conn-Mark (AF21) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF21" protocol=udp src-port=443
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Spotify / Apple TV+ / HBO Max) \A1\F7 Conn-Mark (AF21) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF21" protocol=tcp \
src-port=4070,443
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Apple /Android) \A1\F7 Conn-Mark (AF21) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF21" protocol=tcp src-port=\
5223,5228
add action=mark-connection chain=prerouting comment=\
"TCP-Port (RDP / SMB / VNC) \A1\F7 Conn-Mark (AF13) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF13" protocol=tcp src-port=\
3389,445,5900
add action=mark-connection chain=prerouting comment=\
"TCP-Port (SMTP / IMAP / POP3) \A1\F7 Conn-Mark (AF11) - RX" \
in-interface=bridge1 new-connection-mark="conn - AF11" protocol=tcp \
src-port=25,143,110
add action=mark-connection chain=prerouting comment=\
"UDP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - CS1" protocol=udp \
src-port=6881-6889,17500
add action=mark-connection chain=prerouting comment=\
"TCP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - CS1" protocol=tcp \
src-port=6881-6889,17500
add action=mark-connection chain=prerouting comment="TCP-Port (Google Drive / \
HTTPs / DoH / HTTP) \A1\F7 Conn-Mark (CS0) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - CS0" protocol=tcp src-port=443,80
add action=mark-connection chain=prerouting comment=\
"IP Protocol 89-Port (OSPF) \A1\F7 Conn-Mark (CS7) - RX" in-interface=\
bridge1 new-connection-mark="conn - CS7" protocol=ospf
add action=mark-connection chain=prerouting comment=\
"TCP-Port (BGP) \A1\F7 Conn-Mark (CS7) - RX" in-interface=bridge1 \
new-connection-mark="conn - CS7" protocol=tcp src-port=179
add action=mark-connection chain=prerouting comment=\
"UDP-Port (NTP) \A1\F7 Conn-Mark (CS6) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - CS6" protocol=udp src-port=123
add action=mark-connection chain=prerouting comment=\
"UDP-Port (DHCP) \A1\F7 Conn-Mark (CS6) - RX" in-interface=bridge1 \
new-connection-mark="conn - CS6" protocol=udp src-port=67,68
add action=mark-connection chain=postrouting comment=\
"UDP-Port (VoIP / Zoom / Team) \A1\F7 Conn-Mark (EF) - TX" dst-port=\
4500,5060,16384-32767 new-connection-mark="conn - EF" out-interface=\
pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Zoom) \A1\F7 Conn-Mark (AF43) - TX" dst-port=8801-8810 \
new-connection-mark="conn - AF43" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Zoom / Google Meet) \A1\F7 Conn-Mark (AF43) - TX" dst-port=\
8801-8810,19302-19309 new-connection-mark="conn - AF43" out-interface=\
pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Teams Video) \A1\F7 Conn-Mark (AF42) - TX" dst-port=3478-3481 \
new-connection-mark="conn - AF42" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Webex) \A1\F7 Conn-Mark (AF41) - TX" dst-port=5004 \
new-connection-mark="conn - AF41" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Steam) \A1\F7 Conn-Mark (AF33) - TX" dst-port=27005 \
new-connection-mark="conn - AF33" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Steam) \A1\F7 Conn-Mark (AF33) - TX" dst-port=27015 \
new-connection-mark="conn - AF33" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Valorant / PUBG / Steam) \A1\F7 Conn-Mark (AF31) - TX" \
dst-port=7000-8000,10000-20019,27000-27100 new-connection-mark=\
"conn - AF31" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Genshin Impact) \A1\F7 Conn-Mark (AF31) - TX" dst-port=22102 \
new-connection-mark="conn - AF31" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (YouTube / Netflix) \A1\F7 Conn-Mark (AF23) - TX" dst-port=\
443,53 new-connection-mark="conn - AF23" out-interface=pppoe-out1 \
protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (YouTube / Netflix / Twitch) \A1\F7 Conn-Mark (AF23) - TX" \
dst-port=443,53,1935 new-connection-mark="conn - AF23" out-interface=\
pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Spotify) \A1\F7 Conn-Mark (AF21) - TX" dst-port=443 \
new-connection-mark="conn - AF21" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Spotify / Apple TV+ / HBO Max) \A1\F7 Conn-Mark (AF21) - TX" \
dst-port=4070,443 new-connection-mark="conn - AF21" out-interface=\
pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Apple / Android) \A1\F7 Conn-Mark (AF21) - TX" dst-port=\
5223,5228 new-connection-mark="conn - AF21" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (RDP / SMB / VNC) \A1\F7 Conn-Mark (AF13) - TX" dst-port=\
3389,445,5900 new-connection-mark="conn - AF13" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (SMTP / IMAP / POP3) \A1\F7 Conn-Mark (AF11) - TX" dst-port=\
25,143,110 new-connection-mark="conn - AF11" out-interface=bridge1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - TX" dst-port=\
6881-6889,17500 new-connection-mark="conn - CS1" out-interface=pppoe-out1 \
protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - TX" dst-port=\
6881-6889,17500 new-connection-mark="conn - CS1" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment="TCP-Port (Google Drive /\
\_HTTPs / DoH / HTTP) \A1\F7 Conn-Mark (CS0) - TX" dst-port=443,80 \
new-connection-mark="conn - CS0" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"IP Protocol 89-Port (OSPF) \A1\F7 Conn-Mark (CS7) - TX" \
new-connection-mark="conn - CS7" out-interface=bridge1 protocol=ospf
add action=mark-connection chain=postrouting comment=\
"TCP-Port (BGP) \A1\F7 Conn-Mark (CS7) - TX" dst-port=179 \
new-connection-mark="conn - CS7" out-interface=bridge1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (NTP) \A1\F7 Conn-Mark (CS6) - TX" dst-port=123 \
new-connection-mark="conn - CS6" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (DHCP) \A1\F7 Conn-Mark (CS6) - TX" dst-port=67,68 \
new-connection-mark="conn - CS6" out-interface=bridge1 protocol=udp
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS7) \A1\F7 Packet-Mark (CS7) / DSCP (56) - RX" \
connection-mark="conn - CS7" dscp=56 in-interface=pppoe-out1 \
new-packet-mark=CS7
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS6) \A1\F7 Packet-Mark (CS6) / DSCP (48) - RX" \
connection-mark="conn - CS6" dscp=48 in-interface=pppoe-out1 \
new-packet-mark=CS6
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (EF) \A1\F7 Packet-Mark (EF) / DSCP (46) - RX" \
connection-mark="conn - EF" dscp=46 in-interface=pppoe-out1 \
new-packet-mark=EF
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF43) \A1\F7 Packet-Mark (AF43) / DSCP (38) - RX" \
connection-mark="conn - AF43" dscp=38 in-interface=pppoe-out1 \
new-packet-mark=AF43
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF42) \A1\F7 Packet-Mark (AF42) / DSCP (36) - RX" \
connection-mark="conn - AF42" dscp=36 in-interface=pppoe-out1 \
new-packet-mark=AF42
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF41) \A1\F7 Packet-Mark (AF41) / DSCP (34) - RX" \
connection-mark="conn - AF41" dscp=34 in-interface=pppoe-out1 \
new-packet-mark=AF41
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF33) \A1\F7 Packet-Mark (AF33) / DSCP (30) - RX" \
connection-mark="conn - AF33" dscp=30 in-interface=pppoe-out1 \
new-packet-mark=AF33
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF31) \A1\F7 Packet-Mark (AF31) / DSCP (26) - RX" \
connection-mark="conn - AF31" dscp=26 in-interface=pppoe-out1 \
new-packet-mark=AF31
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF23) \A1\F7 Packet-Mark (AF23) / DSCP (22) - RX" \
connection-mark="conn - AF23" dscp=22 in-interface=pppoe-out1 \
new-packet-mark=AF23
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF21) \A1\F7 Packet-Mark (AF21) / DSCP (18) - RX" \
connection-mark="conn - AF21" dscp=18 in-interface=pppoe-out1 \
new-packet-mark=AF21
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF13) \A1\F7 Packet-Mark (AF13) / DSCP (14) - RX" \
connection-mark="conn - AF13" dscp=14 in-interface=pppoe-out1 \
new-packet-mark=AF13
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF11) \A1\F7 Packet-Mark (AF11) / DSCP (10) - RX" \
connection-mark="conn - AF11" dscp=10 in-interface=pppoe-out1 \
new-packet-mark=AF11
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS1) \A1\F7 Packet-Mark (CS1) / DSCP (8) - RX" \
connection-mark="conn - CS1" dscp=8 in-interface=pppoe-out1 \
new-packet-mark=CS1
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS0) \A1\F7 Packet-Mark (CS0) / DSCP (0) - RX" \
connection-mark="conn - CS0" dscp=0 in-interface=pppoe-out1 \
new-packet-mark=CS0
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS7) \A1\F7 Packet-Mark (CS7) / DSCP (56) - TX" \
connection-mark="conn - CS7" dscp=56 new-packet-mark=CS7 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS6) \A1\F7 Packet-Mark (CS6) / DSCP (48) - TX" \
connection-mark="conn - CS6" dscp=48 new-packet-mark=CS6 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (EF) \A1\F7 Packet-Mark (EF) / DSCP (46) - TX" \
connection-mark="conn - EF" dscp=46 new-packet-mark=EF out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF43) \A1\F7 Packet-Mark (AF43) / DSCP (38) - TX" \
connection-mark="conn - AF43" dscp=38 new-packet-mark=AF43 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF42) \A1\F7 Packet-Mark (AF42) / DSCP (36) - TX" \
connection-mark="conn - AF42" dscp=36 new-packet-mark=AF42 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF41) \A1\F7 Packet-Mark (AF41) / DSCP (34) - TX" \
connection-mark="conn - AF41" dscp=34 new-packet-mark=AF41 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF33) \A1\F7 Packet-Mark (AF33) / DSCP (30) - TX" \
connection-mark="conn - AF33" dscp=30 new-packet-mark=AF33 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF31) \A1\F7 Packet-Mark (AF31) / DSCP (26) - TX" \
connection-mark="conn - AF31" dscp=26 new-packet-mark=AF31 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF23) \A1\F7 Packet-Mark (AF23) / DSCP (22) - TX" \
connection-mark="conn - AF23" dscp=22 new-packet-mark=AF23 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF21) \A1\F7 Packet-Mark (AF21) / DSCP (18) - TX" \
connection-mark="conn - AF21" dscp=18 new-packet-mark=AF21 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF13) \A1\F7 Packet-Mark (AF13) / DSCP (14) - TX" \
connection-mark="conn - AF13" dscp=14 new-packet-mark=AF13 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF11) \A1\F7 Packet-Mark (AF11) / DSCP (10) - TX" \
connection-mark="conn - AF11" dscp=10 new-packet-mark=AF11 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS1) \A1\F7 Packet-Mark (CS1) / DSCP (8) - TX" \
connection-mark="conn - CS1" dscp=8 new-packet-mark=CS1 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS0) \A1\F7 Packet-Mark (CS0) / DSCP (0) - TX" \
connection-mark="conn - CS0" dscp=0 new-packet-mark=CS0 out-interface=\
pppoe-out1
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS7) \A1\F7 DSCP (56) - RX" connection-mark=\
"conn - CS7" in-interface=pppoe-out1 new-dscp=56
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS6) \A1\F7 DSCP (48) - RX" connection-mark=\
"conn - CS6" in-interface=pppoe-out1 new-dscp=48
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (EF) \A1\F7 DSCP (46) - RX" connection-mark=\
"conn - EF" in-interface=pppoe-out1 new-dscp=46
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF43) \A1\F7 DSCP (38) - RX" \
connection-mark="conn - AF43" in-interface=pppoe-out1 new-dscp=38
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF42) \A1\F7 DSCP (36) - RX" \
connection-mark="conn - AF42" in-interface=pppoe-out1 new-dscp=36
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF33) \A1\F7 DSCP (30) - RX" \
connection-mark="conn - AF33" in-interface=pppoe-out1 new-dscp=30
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF31) \A1\F7 DSCP (26) - RX" \
connection-mark="conn - AF31" in-interface=pppoe-out1 new-dscp=26
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF23) \A1\F7 DSCP (22) - RX" \
connection-mark="conn - AF23" in-interface=pppoe-out1 new-dscp=22
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF21) \A1\F7 DSCP (18) - RX" \
connection-mark="conn - AF21" in-interface=pppoe-out1 new-dscp=18
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF13) \A1\F7 DSCP (14) - RX" \
connection-mark="conn - AF13" in-interface=pppoe-out1 new-dscp=14
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF11) \A1\F7 DSCP (10) - RX" \
connection-mark="conn - AF11" in-interface=pppoe-out1 new-dscp=10
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS1) \A1\F7 DSCP (8) - RX" connection-mark=\
"conn - CS1" in-interface=pppoe-out1 new-dscp=8
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS0) \A1\F7 DSCP (0) - RX" connection-mark=\
"conn - CS0" in-interface=pppoe-out1 new-dscp=0
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS7) \A1\F7 DSCP (56) - TX" connection-mark=\
"conn - CS7" new-dscp=56 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS6) \A1\F7 DSCP (48) - TX" connection-mark=\
"conn - CS6" new-dscp=48 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (EF) \A1\F7 DSCP (46) - TX" connection-mark=\
"conn - EF" new-dscp=46 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF43) \A1\F7 DSCP (38) - TX" \
connection-mark="conn - AF43" new-dscp=38 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF42) \A1\F7 DSCP (36) - TX" \
connection-mark="conn - AF42" new-dscp=36 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF33) \A1\F7 DSCP (30) - TX" \
connection-mark="conn - AF33" new-dscp=30 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF31) \A1\F7 DSCP (26) - TX" \
connection-mark="conn - AF31" new-dscp=26 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF23) \A1\F7 DSCP (22) - TX" \
connection-mark="conn - AF23" new-dscp=22 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF21) \A1\F7 DSCP (18) - TX" \
connection-mark="conn - AF21" new-dscp=18 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF13) \A1\F7 DSCP (14) - TX" \
connection-mark="conn - AF13" new-dscp=14 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF11) \A1\F7 DSCP (10) - TX" \
connection-mark="conn - AF11" new-dscp=10 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS1) \A1\F7 DSCP (8) - TX" connection-mark=\
"conn - CS1" new-dscp=8 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS0) \A1\F7 DSCP (0) - TX" connection-mark=\
"conn - CS0" new-dscp=0 out-interface=pppoe-out1
/queue type
add cake-diffserv=diffserv8 cake-flowmode=dual-dsthost cake-nat=yes \
cake-overhead=18 kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=diffserv8 cake-flowmode=dual-srchost \
cake-nat=yes cake-overhead=18 kind=cake name=cake-tx
/queue simple
add max-limit=100M/40M name=cake queue=cake-rx/cake-tx target=pppoe-out1
/ip firewall nat
add action=masquerade chain=srcnat comment=\
"NAT from local address back to public IP" out-interface-list=WAN \
src-address=192.168.88.0/24
add action=redirect chain=dstnat comment="Redirect DNS" dst-port=53 \
in-interface-list=LAN protocol=tcp to-ports=53
add action=redirect chain=dstnat dst-port=53 in-interface-list=LAN protocol=\
udp to-ports=53
/ip firewall raw
add action=drop chain=prerouting comment="Drop DDoS-attackers" \
dst-address-list=ddos-targets src-address-list=ddos-attackers
add action=accept chain=prerouting comment="accept DHCP discover" \
dst-address=255.255.255.255 dst-port=67 in-interface-list=LAN protocol=\
udp src-address=0.0.0.0 src-port=68
add action=drop chain=prerouting comment="drop bogon IP's" src-address-list=\
bad_ipv4
add action=drop chain=prerouting comment="drop bogon IP's" dst-address-list=\
bad_ipv4
add action=drop chain=prerouting comment="drop bogon IP's" src-address-list=\
bad_src_ipv4
add action=drop chain=prerouting comment="drop bogon IP's" dst-address-list=\
bad_dst_ipv4
add action=drop chain=prerouting comment="drop non global from WAN" \
in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment="drop forward to local lan from WAN" \
dst-address=192.168.88.0/24 in-interface-list=WAN
add action=drop chain=prerouting comment=\
"drop local if not from default IP range" in-interface-list=LAN \
src-address=!192.168.88.0/24
add action=drop chain=prerouting comment="drop bad UDP" port=0 protocol=udp
add action=jump chain=prerouting comment="jump to ICMP chain" jump-target=\
icmp4 protocol=icmp
add action=jump chain=prerouting comment="jump to TCP chain" jump-target=\
bad_tcp protocol=tcp
add action=accept chain=prerouting comment="accept everything else from LAN" \
in-interface-list=LAN
add action=accept chain=prerouting comment="accept everything else from WAN" \
in-interface-list=WAN
add action=drop chain=prerouting comment="drop the rest"
add action=drop chain=bad_tcp comment="TCP flag filter" protocol=tcp \
tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,syn
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,rst
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,!ack
add action=drop chain=bad_tcp protocol=tcp tcp-flags=fin,urg
add action=drop chain=bad_tcp protocol=tcp tcp-flags=syn,rst
add action=drop chain=bad_tcp protocol=tcp tcp-flags=rst,urg
add action=drop chain=bad_tcp comment="TCP port 0 drop" port=0 protocol=tcp
add action=accept chain=icmp4 comment="echo reply" icmp-options=0:0 limit=\
5,10:packet protocol=icmp
add action=accept chain=icmp4 comment="net unreachable" icmp-options=3:0 \
protocol=icmp
add action=accept chain=icmp4 comment="host unreachable" icmp-options=3:1 \
protocol=icmp
add action=accept chain=icmp4 comment="protocol unreachable" icmp-options=3:2 \
protocol=icmp
add action=accept chain=icmp4 comment="port unreachable" icmp-options=3:3 \
protocol=icmp
add action=accept chain=icmp4 comment="fragmentation needed" icmp-options=3:4 \
protocol=icmp
add action=accept chain=icmp4 comment="echo request" icmp-options=8:0 limit=\
5,10:packet protocol=icmp
add action=accept chain=icmp4 comment="time exceeded" icmp-options=11:0 \
protocol=icmp
add action=accept chain=icmp4 comment="parameter bad" icmp-options=12:0 \
protocol=icmp
add action=drop chain=icmp4 comment="drop other icmp" protocol=icmp
/system ntp client
set enabled=yes
/system ntp client servers
add address=tock.stdtime.gov.tw
add address=watch.stdtime.gov.tw
add address=time.stdtime.gov.tw
add address=clock.stdtime.gov.tw
add address=tick.stdtime.gov.tw
/system scheduler
add comment="DNS Cache Flush" interval=1d name="DNS Cache Flush" on-event=\
DNS_Flush_Cache policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
add dont-require-permissions=no name=DNS_Flush_Cache policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
"/ip dns cache flush"
--
In The End [Official HD Music Video] - Linkin Park
人品是做人最好的底牌.
B版於2025/06/22更新全完結.
--
若採用固定IP(建議這樣會比較好),則:
/ip firewall nat
add action=dst-nat chain=dstnat comment="NAT to local address" dst-address=\
固定IP/32 in-interface=pppoe-out1 to-addresses=區網/24
add action=src-nat chain=srcnat comment=\
"NAT from local address back to public IP" out-interface=pppoe-out1 \
src-address=區網/24 to-addresses=固定IP/32
--
/interface bridge
add igmp-snooping=yes multicast-querier=yes name=bridge1
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes cache-max-ttl=5m cache-size=104857KiB \
servers=168.95.192.1,168.95.1.1
/ip dns adlist
add ssl-verify=no url="https://raw.githubusercontent.com/hagezi/dns-blocklists\
/main/domains/ultimate.txt"
/ip settings
set rp-filter=strict tcp-syncookies=yes
/ip firewall address-list
add list=ddos-attackers
add list=ddos-targets
add address=0.0.0.0/8 comment=RFC6890 list=NotPublic
add address=10.0.0.0/8 comment=RFC6890 list=NotPublic
add address=100.64.0.0/10 comment=RFC6890 list=NotPublic
add address=127.0.0.0/8 comment=RFC6890 list=NotPublic
add address=169.254.0.0/16 comment=RFC6890 list=NotPublic
add address=172.16.0.0/12 comment=RFC6890 list=NotPublic
add address=192.0.0.0/24 comment=RFC6890 list=NotPublic
add address=192.0.2.0/24 comment=RFC6890 list=NotPublic
add address=192.168.0.0/16 comment=RFC6890 list=NotPublic
add address=192.88.99.0/24 comment=RFC3068 list=NotPublic
add address=198.18.0.0/15 comment=RFC6890 list=NotPublic
add address=198.51.100.0/24 comment=RFC6890 list=NotPublic
add address=203.0.113.0/24 comment=RFC6890 list=NotPublic
add address=224.0.0.0/4 comment=RFC4601 list=NotPublic
add address=240.0.0.0/4 comment=RFC6890 list=NotPublic
/ip firewall filter
add chain=input comment="Accept established and related packets" \
connection-state=established,related
add chain=input comment="Accept all connections from local network" \
in-interface=bridge1
add action=drop chain=input comment="Drop invalid packets" connection-state=\
invalid
add action=drop chain=input comment=\
"Drop all packets which are not destined to routes IP address" \
dst-address-type=!local
add action=drop chain=input comment=\
"Drop all packets which does not have unicast source IP address" \
src-address-type=!unicast
add action=drop chain=input comment="Drop all packets from public internet whi\
ch should not exist in public network" in-interface=pppoe-out1 \
src-address-list=NotPublic
add chain=forward comment="Accept established and related packets" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid packets" \
connection-state=invalid
add action=jump chain=forward comment="SYN/DoS/DDoS Protection" \
connection-state=new jump-target=detect-ddos
add action=return chain=detect-ddos dst-limit=32,32,src-and-dst-addresses/10s
add action=add-dst-to-address-list address-list=ddos-targets \
address-list-timeout=10m chain=detect-ddos
add action=add-src-to-address-list address-list=ddos-attackers \
address-list-timeout=10m chain=detect-ddos
add action=return chain=detect-ddos comment="SYN Flood protect" dst-limit=\
32,32,src-and-dst-addresses/10s protocol=tcp tcp-flags=syn,ack
add action=drop chain=forward comment=\
"Drop new connections from internet which are not dst-natted" \
connection-nat-state=!dstnat connection-state=new in-interface=pppoe-out1
add action=drop chain=forward comment="Drop all packets from public internet w\
hich should not exist in public network" in-interface=pppoe-out1 \
src-address-list=NotPublic
add action=drop chain=forward comment="Drop all packets from local network to \
internet which should not exist in public network" dst-address-list=\
NotPublic in-interface=bridge1
add action=drop chain=forward comment="Drop all packets in local network which\
\_does not have local network address" in-interface=bridge1 src-address=\
!192.168.88.0/24
add action=accept chain=forward comment=" In case firewall filters are used to\
\_drop some traffic you must be sure that forward packets which belong to \
natted connection are accepted" connection-nat-state=dstnat \
connection-state=established,related in-interface=pppoe-out1
/ip firewall mangle
add action=change-mss chain=forward comment="Change MSS" new-mss=\
clamp-to-pmtu protocol=tcp tcp-flags=syn
add action=change-mss chain=output new-mss=clamp-to-pmtu protocol=tcp \
tcp-flags=syn
add action=mark-connection chain=prerouting comment=\
"UDP-Port (VoIP / Zoom / Team) \A1\F7 Conn-Mark (EF) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - EF" protocol=udp src-port=\
4500,5060,16384-32767
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Zoom) \A1\F7 Conn-Mark (AF43) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF43" protocol=tcp src-port=8801-8810
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Zoom / Google Meet) \A1\F7 Conn-Mark (AF43) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF43" protocol=udp \
src-port=8801-8810,19302-19309
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Teams Video) \A1\F7 Conn-Mark (AF42) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF42" protocol=udp src-port=\
3478-3481
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Webex) \A1\F7 Conn-Mark (AF41) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF41" protocol=udp src-port=5004
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Steam) \A1\F7 Conn-Mark (AF33) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF33" protocol=udp src-port=27005
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Steam) \A1\F7 Conn-Mark (AF33) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF33" protocol=tcp src-port=27015
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Valorant / PUBG / Steam) \A1\F7 Conn-Mark (AF31) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF31" protocol=udp \
src-port=7000-8000,10000-20019,27000-27100
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Genshin Impact) \A1\F7 Conn-Mark (AF31) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF31" protocol=tcp src-port=22102
add action=mark-connection chain=prerouting comment=\
"UDP-Port (YouTube / Netflix) \A1\F7 Conn-Mark (AF23) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF23" protocol=udp src-port=443,53
add action=mark-connection chain=prerouting comment=\
"TCP-Port (YouTube / Netflix / Twitch) \A1\F7 Conn-Mark (AF23) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF23" protocol=tcp \
src-port=443,53,1935
add action=mark-connection chain=prerouting comment=\
"UDP-Port (Spotify) \A1\F7 Conn-Mark (AF21) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - AF21" protocol=udp src-port=443
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Spotify / Apple TV+ / HBO Max) \A1\F7 Conn-Mark (AF21) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - AF21" protocol=tcp \
src-port=4070,443
add action=mark-connection chain=prerouting comment=\
"TCP-Port (Apple /Android) \A1\F7 Conn-Mark (AF21) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF21" protocol=tcp src-port=\
5223,5228
add action=mark-connection chain=prerouting comment=\
"TCP-Port (RDP / SMB / VNC) \A1\F7 Conn-Mark (AF13) - RX" in-interface=\
pppoe-out1 new-connection-mark="conn - AF13" protocol=tcp src-port=\
3389,445,5900
add action=mark-connection chain=prerouting comment=\
"TCP-Port (SMTP / IMAP / POP3) \A1\F7 Conn-Mark (AF11) - RX" \
in-interface=bridge1 new-connection-mark="conn - AF11" protocol=tcp \
src-port=25,143,110
add action=mark-connection chain=prerouting comment=\
"UDP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - CS1" protocol=udp \
src-port=6881-6889,17500
add action=mark-connection chain=prerouting comment=\
"TCP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - RX" \
in-interface=pppoe-out1 new-connection-mark="conn - CS1" protocol=tcp \
src-port=6881-6889,17500
add action=mark-connection chain=prerouting comment="TCP-Port (Google Drive / \
HTTPs / DoH / HTTP) \A1\F7 Conn-Mark (CS0) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - CS0" protocol=tcp src-port=443,80
add action=mark-connection chain=prerouting comment=\
"IP Protocol 89-Port (OSPF) \A1\F7 Conn-Mark (CS7) - RX" in-interface=\
bridge1 new-connection-mark="conn - CS7" protocol=ospf
add action=mark-connection chain=prerouting comment=\
"TCP-Port (BGP) \A1\F7 Conn-Mark (CS7) - RX" in-interface=bridge1 \
new-connection-mark="conn - CS7" protocol=tcp src-port=179
add action=mark-connection chain=prerouting comment=\
"UDP-Port (NTP) \A1\F7 Conn-Mark (CS6) - RX" in-interface=pppoe-out1 \
new-connection-mark="conn - CS6" protocol=udp src-port=123
add action=mark-connection chain=prerouting comment=\
"UDP-Port (DHCP) \A1\F7 Conn-Mark (CS6) - RX" in-interface=bridge1 \
new-connection-mark="conn - CS6" protocol=udp src-port=67,68
add action=mark-connection chain=postrouting comment=\
"UDP-Port (VoIP / Zoom / Team) \A1\F7 Conn-Mark (EF) - TX" dst-port=\
4500,5060,16384-32767 new-connection-mark="conn - EF" out-interface=\
pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Zoom) \A1\F7 Conn-Mark (AF43) - TX" dst-port=8801-8810 \
new-connection-mark="conn - AF43" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Zoom / Google Meet) \A1\F7 Conn-Mark (AF43) - TX" dst-port=\
8801-8810,19302-19309 new-connection-mark="conn - AF43" out-interface=\
pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Teams Video) \A1\F7 Conn-Mark (AF42) - TX" dst-port=3478-3481 \
new-connection-mark="conn - AF42" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Webex) \A1\F7 Conn-Mark (AF41) - TX" dst-port=5004 \
new-connection-mark="conn - AF41" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Steam) \A1\F7 Conn-Mark (AF33) - TX" dst-port=27005 \
new-connection-mark="conn - AF33" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Steam) \A1\F7 Conn-Mark (AF33) - TX" dst-port=27015 \
new-connection-mark="conn - AF33" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Valorant / PUBG / Steam) \A1\F7 Conn-Mark (AF31) - TX" \
dst-port=7000-8000,10000-20019,27000-27100 new-connection-mark=\
"conn - AF31" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Genshin Impact) \A1\F7 Conn-Mark (AF31) - TX" dst-port=22102 \
new-connection-mark="conn - AF31" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (YouTube / Netflix) \A1\F7 Conn-Mark (AF23) - TX" dst-port=\
443,53 new-connection-mark="conn - AF23" out-interface=pppoe-out1 \
protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (YouTube / Netflix / Twitch) \A1\F7 Conn-Mark (AF23) - TX" \
dst-port=443,53,1935 new-connection-mark="conn - AF23" out-interface=\
pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (Spotify) \A1\F7 Conn-Mark (AF21) - TX" dst-port=443 \
new-connection-mark="conn - AF21" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Spotify / Apple TV+ / HBO Max) \A1\F7 Conn-Mark (AF21) - TX" \
dst-port=4070,443 new-connection-mark="conn - AF21" out-interface=\
pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (Apple / Android) \A1\F7 Conn-Mark (AF21) - TX" dst-port=\
5223,5228 new-connection-mark="conn - AF21" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (RDP / SMB / VNC) \A1\F7 Conn-Mark (AF13) - TX" dst-port=\
3389,445,5900 new-connection-mark="conn - AF13" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (SMTP / IMAP / POP3) \A1\F7 Conn-Mark (AF11) - TX" dst-port=\
25,143,110 new-connection-mark="conn - AF11" out-interface=bridge1 \
protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - TX" dst-port=\
6881-6889,17500 new-connection-mark="conn - CS1" out-interface=pppoe-out1 \
protocol=udp
add action=mark-connection chain=postrouting comment=\
"TCP-Port (BitTorrent / Dropbox) \A1\F7 Conn-Mark (CS1) - TX" dst-port=\
6881-6889,17500 new-connection-mark="conn - CS1" out-interface=pppoe-out1 \
protocol=tcp
add action=mark-connection chain=postrouting comment="TCP-Port (Google Drive /\
\_HTTPs / DoH / HTTP) \A1\F7 Conn-Mark (CS0) - TX" dst-port=443,80 \
new-connection-mark="conn - CS0" out-interface=pppoe-out1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"IP Protocol 89-Port (OSPF) \A1\F7 Conn-Mark (CS7) - TX" \
new-connection-mark="conn - CS7" out-interface=bridge1 protocol=ospf
add action=mark-connection chain=postrouting comment=\
"TCP-Port (BGP) \A1\F7 Conn-Mark (CS7) - TX" dst-port=179 \
new-connection-mark="conn - CS7" out-interface=bridge1 protocol=tcp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (NTP) \A1\F7 Conn-Mark (CS6) - TX" dst-port=123 \
new-connection-mark="conn - CS6" out-interface=pppoe-out1 protocol=udp
add action=mark-connection chain=postrouting comment=\
"UDP-Port (DHCP) \A1\F7 Conn-Mark (CS6) - TX" dst-port=67,68 \
new-connection-mark="conn - CS6" out-interface=bridge1 protocol=udp
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS7) \A1\F7 Packet-Mark (CS7) / DSCP (56) - RX" \
connection-mark="conn - CS7" dscp=56 in-interface=pppoe-out1 \
new-packet-mark=CS7
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS6) \A1\F7 Packet-Mark (CS6) / DSCP (48) - RX" \
connection-mark="conn - CS6" dscp=48 in-interface=pppoe-out1 \
new-packet-mark=CS6
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (EF) \A1\F7 Packet-Mark (EF) / DSCP (46) - RX" \
connection-mark="conn - EF" dscp=46 in-interface=pppoe-out1 \
new-packet-mark=EF
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF43) \A1\F7 Packet-Mark (AF43) / DSCP (38) - RX" \
connection-mark="conn - AF43" dscp=38 in-interface=pppoe-out1 \
new-packet-mark=AF43
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF42) \A1\F7 Packet-Mark (AF42) / DSCP (36) - RX" \
connection-mark="conn - AF42" dscp=36 in-interface=pppoe-out1 \
new-packet-mark=AF42
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF41) \A1\F7 Packet-Mark (AF41) / DSCP (34) - RX" \
connection-mark="conn - AF41" dscp=34 in-interface=pppoe-out1 \
new-packet-mark=AF41
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF33) \A1\F7 Packet-Mark (AF33) / DSCP (30) - RX" \
connection-mark="conn - AF33" dscp=30 in-interface=pppoe-out1 \
new-packet-mark=AF33
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF31) \A1\F7 Packet-Mark (AF31) / DSCP (26) - RX" \
connection-mark="conn - AF31" dscp=26 in-interface=pppoe-out1 \
new-packet-mark=AF31
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF23) \A1\F7 Packet-Mark (AF23) / DSCP (22) - RX" \
connection-mark="conn - AF23" dscp=22 in-interface=pppoe-out1 \
new-packet-mark=AF23
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF21) \A1\F7 Packet-Mark (AF21) / DSCP (18) - RX" \
connection-mark="conn - AF21" dscp=18 in-interface=pppoe-out1 \
new-packet-mark=AF21
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF13) \A1\F7 Packet-Mark (AF13) / DSCP (14) - RX" \
connection-mark="conn - AF13" dscp=14 in-interface=pppoe-out1 \
new-packet-mark=AF13
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (AF11) \A1\F7 Packet-Mark (AF11) / DSCP (10) - RX" \
connection-mark="conn - AF11" dscp=10 in-interface=pppoe-out1 \
new-packet-mark=AF11
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS1) \A1\F7 Packet-Mark (CS1) / DSCP (8) - RX" \
connection-mark="conn - CS1" dscp=8 in-interface=pppoe-out1 \
new-packet-mark=CS1
add action=mark-packet chain=prerouting comment=\
"Conn-Mark (CS0) \A1\F7 Packet-Mark (CS0) / DSCP (0) - RX" \
connection-mark="conn - CS0" dscp=0 in-interface=pppoe-out1 \
new-packet-mark=CS0
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS7) \A1\F7 Packet-Mark (CS7) / DSCP (56) - TX" \
connection-mark="conn - CS7" dscp=56 new-packet-mark=CS7 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS6) \A1\F7 Packet-Mark (CS6) / DSCP (48) - TX" \
connection-mark="conn - CS6" dscp=48 new-packet-mark=CS6 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (EF) \A1\F7 Packet-Mark (EF) / DSCP (46) - TX" \
connection-mark="conn - EF" dscp=46 new-packet-mark=EF out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF43) \A1\F7 Packet-Mark (AF43) / DSCP (38) - TX" \
connection-mark="conn - AF43" dscp=38 new-packet-mark=AF43 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF42) \A1\F7 Packet-Mark (AF42) / DSCP (36) - TX" \
connection-mark="conn - AF42" dscp=36 new-packet-mark=AF42 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF41) \A1\F7 Packet-Mark (AF41) / DSCP (34) - TX" \
connection-mark="conn - AF41" dscp=34 new-packet-mark=AF41 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF33) \A1\F7 Packet-Mark (AF33) / DSCP (30) - TX" \
connection-mark="conn - AF33" dscp=30 new-packet-mark=AF33 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF31) \A1\F7 Packet-Mark (AF31) / DSCP (26) - TX" \
connection-mark="conn - AF31" dscp=26 new-packet-mark=AF31 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF23) \A1\F7 Packet-Mark (AF23) / DSCP (22) - TX" \
connection-mark="conn - AF23" dscp=22 new-packet-mark=AF23 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF21) \A1\F7 Packet-Mark (AF21) / DSCP (18) - TX" \
connection-mark="conn - AF21" dscp=18 new-packet-mark=AF21 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF13) \A1\F7 Packet-Mark (AF13) / DSCP (14) - TX" \
connection-mark="conn - AF13" dscp=14 new-packet-mark=AF13 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (AF11) \A1\F7 Packet-Mark (AF11) / DSCP (10) - TX" \
connection-mark="conn - AF11" dscp=10 new-packet-mark=AF11 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS1) \A1\F7 Packet-Mark (CS1) / DSCP (8) - TX" \
connection-mark="conn - CS1" dscp=8 new-packet-mark=CS1 out-interface=\
pppoe-out1
add action=mark-packet chain=postrouting comment=\
"Conn-Mark (CS0) \A1\F7 Packet-Mark (CS0) / DSCP (0) - TX" \
connection-mark="conn - CS0" dscp=0 new-packet-mark=CS0 out-interface=\
pppoe-out1
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS7) \A1\F7 DSCP (56) - RX" connection-mark=\
"conn - CS7" in-interface=pppoe-out1 new-dscp=56
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS6) \A1\F7 DSCP (48) - RX" connection-mark=\
"conn - CS6" in-interface=pppoe-out1 new-dscp=48
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (EF) \A1\F7 DSCP (46) - RX" connection-mark=\
"conn - EF" in-interface=pppoe-out1 new-dscp=46
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF43) \A1\F7 DSCP (38) - RX" \
connection-mark="conn - AF43" in-interface=pppoe-out1 new-dscp=38
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF42) \A1\F7 DSCP (36) - RX" \
connection-mark="conn - AF42" in-interface=pppoe-out1 new-dscp=36
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF33) \A1\F7 DSCP (30) - RX" \
connection-mark="conn - AF33" in-interface=pppoe-out1 new-dscp=30
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF31) \A1\F7 DSCP (26) - RX" \
connection-mark="conn - AF31" in-interface=pppoe-out1 new-dscp=26
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF23) \A1\F7 DSCP (22) - RX" \
connection-mark="conn - AF23" in-interface=pppoe-out1 new-dscp=22
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF21) \A1\F7 DSCP (18) - RX" \
connection-mark="conn - AF21" in-interface=pppoe-out1 new-dscp=18
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF13) \A1\F7 DSCP (14) - RX" \
connection-mark="conn - AF13" in-interface=pppoe-out1 new-dscp=14
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (AF11) \A1\F7 DSCP (10) - RX" \
connection-mark="conn - AF11" in-interface=pppoe-out1 new-dscp=10
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS1) \A1\F7 DSCP (8) - RX" connection-mark=\
"conn - CS1" in-interface=pppoe-out1 new-dscp=8
add action=change-dscp chain=prerouting comment=\
"Packet-Mark / DSCP Rewrite (CS0) \A1\F7 DSCP (0) - RX" connection-mark=\
"conn - CS0" in-interface=pppoe-out1 new-dscp=0
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS7) \A1\F7 DSCP (56) - TX" connection-mark=\
"conn - CS7" new-dscp=56 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS6) \A1\F7 DSCP (48) - TX" connection-mark=\
"conn - CS6" new-dscp=48 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (EF) \A1\F7 DSCP (46) - TX" connection-mark=\
"conn - EF" new-dscp=46 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF43) \A1\F7 DSCP (38) - TX" \
connection-mark="conn - AF43" new-dscp=38 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF42) \A1\F7 DSCP (36) - TX" \
connection-mark="conn - AF42" new-dscp=36 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF33) \A1\F7 DSCP (30) - TX" \
connection-mark="conn - AF33" new-dscp=30 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF31) \A1\F7 DSCP (26) - TX" \
connection-mark="conn - AF31" new-dscp=26 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF23) \A1\F7 DSCP (22) - TX" \
connection-mark="conn - AF23" new-dscp=22 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF21) \A1\F7 DSCP (18) - TX" \
connection-mark="conn - AF21" new-dscp=18 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF13) \A1\F7 DSCP (14) - TX" \
connection-mark="conn - AF13" new-dscp=14 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (AF11) \A1\F7 DSCP (10) - TX" \
connection-mark="conn - AF11" new-dscp=10 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS1) \A1\F7 DSCP (8) - TX" connection-mark=\
"conn - CS1" new-dscp=8 out-interface=pppoe-out1
add action=change-dscp chain=postrouting comment=\
"Packet-Mark / DSCP Rewrite (CS0) \A1\F7 DSCP (0) - TX" connection-mark=\
"conn - CS0" new-dscp=0 out-interface=pppoe-out1
/queue type
add cake-diffserv=diffserv8 cake-flowmode=dual-dsthost cake-nat=yes \
cake-overhead=18 kind=cake name=cake-rx
add cake-ack-filter=filter cake-diffserv=diffserv8 cake-flowmode=dual-srchost \
cake-nat=yes cake-overhead=18 kind=cake name=cake-tx
/queue simple
add max-limit=100M/40M name=cake queue=cake-rx/cake-tx target=pppoe-out1
/ip firewall nat
add action=dst-nat chain=dstnat comment="NAT to local address" in-interface=\
pppoe-out1 to-addresses=192.168.88.0/24
add action=masquerade chain=srcnat comment=\
"NAT from local address back to public IP" out-interface-list=WAN \
src-address=192.168.88.0/24
add action=redirect chain=dstnat comment=\
"Redirect DNS queries to router" dst-port=53 protocol=tcp
add action=redirect chain=dstnat dst-port=53 protocol=udp
/ip firewall raw
add action=drop chain=prerouting comment="Drop DDoS-attackers" \
dst-address-list=ddos-targets src-address-list=ddos-attackers
/system ntp client
set enabled=yes
/system ntp client servers
add address=tock.stdtime.gov.tw
add address=watch.stdtime.gov.tw
add address=time.stdtime.gov.tw
add address=clock.stdtime.gov.tw
add address=tick.stdtime.gov.tw
/system scheduler
add comment="DNS Cache Flush" interval=1d name="DNS Cache Flush" on-event=\
DNS_Flush_Cache policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-time=startup
add dont-require-permissions=no name=DNS_Flush_Cache policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
"/ip dns cache flush"
--
In The End [Official HD Music Video] - Linkin Park
人品是做人最好的底牌.
人品是做人最好的底牌.
人品是做人最好的底牌.
人品是做人最好的底牌.
08/03更新全完結:CAPsMAN舊版(WiFi-5)的設定參考官方
CAPsMAN:
--
WiFi-N、AN、AC頻譜



橋接統一管理:建議用這個,能避開中繼AP盜用.

密碼

設定












cAP:



分別把Wlan1&2&3的MAC位址複製

CAPsMAN:






結論:頻譜已避開DFS通道.這是WiFi-g/n/ac的CAPsMAN標準設定.
--
In The End [Official HD Music Video] - Linkin Park
人品是做人最好的底牌.
Wisp-AP模式的設定.






上述的設定就不用輸入最大功率更改調整指令.
以下是Wisp-AP最大功率更改調整指令,從高(0)到(10)低.
interface wireless
print detail advanced
set wlan1 antenna-gain=0
set wlan2 antenna-gain=0
set wlan3 antenna-gain=0
--
In The End [Official HD Music Video] - Linkin Park
人品是做人最好的底牌.
文章分享
評分
評分
複製連結
請輸入您要前往的頁數(1 ~ 520)

今日熱門文章 網友點擊推薦!