RouterOS297安装使用.ppt

单击此处编辑母版标题样式,*,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,Router OS 2.97共享上网教程及防火墙设置,注意事项,把硬盘装在IDE1主端口上,将BIOS设为从光盘引导，将Router OS的光盘放入光驱，用它来引导计算机,我们用VMware Workstation虚拟机来演示,建立ROS虚拟机时要将硬盘设成IDE接口不能按默认的SCSI接口。不然安装时提示找不到硬盘。,1、新建虚拟机,2、然后把虚拟机的光驱设为使用光盘镜像文件。把地址指向ROS 2.97.ISO,启动虚拟机。按Esc键先择从光驱启动。,出现如图：选第二个，开始安装Router OS 2.97按i，再按y,3、选择你要安装的组件。为了学习，你可以选择全部。按a,然后按，再按两次。,提示你重启。然后按回车。,4、还是先按Esc选择重光驱启动。如图。,7、系统重启后出现,MikroTik Login：输入“admin“后按“Enter“,Password：直接按“Enter”系统默认的密码为空,Router OS启动成功出现adminMikroTik提示符,8、依次输入：sys回车，lic回车，Pri回车。你会看到类似：,software-id:123s-laa,upgradable-until:jan/01/2008,level:6,features:extra-channels level:6 说明破解成功。6级级别。,继续输入：.回车,.回车,查计算机网卡的信息,adminMikroTik/int,adminMikroTik interfacepri,查看后你如发现两块网卡的前面有“”，需要激活网卡，在Router OS2.9以上版本的系统中网卡会自动激活,adminMikroTik interfaceenable 0,adminMikroTik interfaceenable 1,adminMikroTik interfacepri,输入完命令后会发现两网卡前出现“”，证明网卡已经激活,9、更改网卡的名称,adminMikroTik interfaceset 0 name=lan,adminMikroTik interfaceset 1 name=wan,adminMikroTik interfacepri,发现网卡改名成功,设置路由器的内网地址及子网掩码,adminMikroTik interface,adminMikroTiksetup,10、出现如下提示,Your choice Press Enter to configure ip address and gateway：a,Your choice Press Enter to add ip address：a,Enabled interface：lan,Ip address/netmask:：192.168.0.1/24,Your choice Press Enter to setup dafault gateway：g,Gateway：192.168.0.1,又出现,Your choice：X,Your choice：X,输入两次X后完成内网IP地址及子网掩码的设置,11、设置外网的IP地址及子网掩码,adminMikroTiksetup,出现如下提示,Your choice Press Enter to configure ip address and gateway：a,Your choice Press Enter to add ip address：a,Enabled interface：wan,Ip address/netmask:：61.54.32.108/26,Your choice Press Enter to setup dafault gateway：g,Gateway：61.54.32.126,又出现,Your choice：X,Your choice：X,输入两次X后完成外网IP地址及子网掩码的设置,12、查看IP地址的设置,adminMikroTikip add,adminMikroTik ip addresspri,说明：如果发现IP地址设置不正确，可以用remove命令删除出错的信息，例如：,adminMikroTik ip addressremove 0,重新启动使设置生效,按“Ctrl+Alt+Del“重启Router OS,13、下载WINBOX,在内网中启动一台计算机，并将其IP地址设为与Router OS的内网IP地址在同一网段，并在IE地址栏中输入：“192.168.0.1”，在打开的网页中单击“winbox tool”下载winbox,利用WINBOX登录Router OS路由器,双击winbox，输入Router OS内网的IP地址，用户名中输入“admin”，密码为空，单击“connect”进行连接,14、设置外网的DNS,在打开的页面中单击“IP”-“DNS”-“Settings”,在“Primary DNS：”中输入“202.102.227.68”,在“Seconday DNS：”中输入“202.102.224.68”（河南的DNS）,单击“ok”完成设置,15、ROS2.9以下版本设置共享上网,单击“IP”-“firewall”-“Source NAT”,单击“+”-“Action”在列表中选“masquerade”单击“ok”,至此所有设置完成，其他电脑就可以使用Router OS路由器共享上网了,对于Router OS2.9以上版本最后一步可操作：,（1）、“IP”-“firewall”-“NAT”；单击“+”-“Action”选“masquerade”,（2）、若外网需绑定IP地址,“IP”-“ARP”,单击“+”在“Interface”中选“wan”输入IP地址及MAC地址，再单击“ok”即可,16、对于Router OS2.9以上版本点击winbox上的IP-Firewall。选择NAT；点号；选择Action,Action:选masquerade；如下图,17、继续选择：Mangle（策略路由用）；点击号；General；Chain:选择postrouting；Protocol:选择6（tcp）如图,18、点：Advanced；TCP Flags；TCP Lags选择syn；如图,19、选择Action；Action选择change MSS；New TCP MSS:输入：1400；点击。试试能不能上网吧。,20、RouterOS 2.9防火墙设置,/ip firewall connection trackingset enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m,/ip firewall filteradd chain=input protocol=tcp dst-port=135-139 action=dropadd chain=input protocol=udp dst-port=135-139 action=dropadd chain=input connection-state=established action=acceptadd chain=input connection-state=related action=acceptadd chain=input src-address=127.0.0.1 dst-address=127.0.0.1 action=acceptadd chain=input connection-state=invalid action=dropadd chain=input dst-address-type=!local action=dropadd chain=input src-address-type=!unicast action=dropadd chain=input protocol=tcp psd=21,3s,3,1 action=dropadd chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list address-list=black_list address-list-timeout=1dadd chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpitadd chain=input protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=3:3 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept,add chain=input protocol=icmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=3:3 limit=5,5 action=accept,add chain=output protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=8:0-255 limit=5,5 action=acceptadd chain=output protocolicmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=3:3 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=8:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=input protocol=icmp action=dropadd chain=output protocol=icmp action=dropadd chain=forward protocol=icmp action=drop,/ip firewall service-portset ftp ports=21 disabled=noset tftp ports=69 disabled=noset irc ports=6667 disabled=noset h323 disabled=noset quake3 disabled=noset mms disabled=noset gre disabled=noset pptp disabled=no/ip firewall mangleadd chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440,20、然后点winbox上 New Terminal；出现如图,然后把下页内容复制下来。注意：不要一次复制。第一次你可以复制5行。以后每次复制5行。,然后在Terminal 窗口里点击右键；选择pasta；回车。,说明:/ip firewall connection trackingset enabled=yes tcp-syn-sent-timeout=1m tcp-syn-received-timeout=1m tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-close-wait-timeout=10s tcp-last-ack-timeout=10s tcp-time-wait-timeout=10s tcp-close-timeout=10s udp-timeout=10s udp-stream-timeout=3m icmp-timeout=10s generic-timeout=10m#+防火墙部分+#/ip firewall filter#关135-139端口 不用多说了add chain=input protocol=tcp dst-port=135-139 action=drop comment=drop Port add chain=input protocol=udp dst-port=135-139 action=drop,#+对本机数据包相关+#允许已建立的连接add chain=input connection-state=established action=accept comment=inputadd chain=input connection-state=related action=accept#允许本机对本机add chain=input src-address=127.0.0.1 dst-address=127.0.0.1 action=accept#丢弃明显异常包add chain=input connection-state=invalid action=drop#丢弃目标非本机的包add chain=input dst-address-type=!local action=drop#丢弃多播包add chain=input src-address-type=!unicast action=drop#+安全相关+#在短时间内从同一地址用不断变化的端口向本机发送大量数据包,视为端口扫描add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment=.,#短时间内同时建立大量TCP连接(超过10),视为DoS拒绝服务攻击,进黑名单一天!,add chain=input protocol=tcp connection-limit=10,32 action=add-src-toaddress-list address-list=black_list address-list-timeout=1d disabled=no#黑名单上的只能建立3个并发连接,tarpitadd chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list action=tarpit disabled=no,#+ICMP相关+#允许常见命令ping tracert,其它ICMP丢弃add chain=input protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=3:3 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=8:0-255 limit=5,5 action=acceptadd chain=input protocol=icmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=3:3 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=8:0-255 limit=5,5 action=acceptadd chain=output protocol=icmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=0:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=3:3 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=3:4 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=8:0-255 limit=5,5 action=acceptadd chain=forward protocol=icmp icmp-options=11:0-255 limit=5,5 action=acceptadd chain=input protocol=icmp action=dropadd chain=output protocol=icmp action=dropadd chain=forward protocol=icmp action=drop,/ip firewall service-portset ftp ports=21 disabled=noset tftp ports=69 disabled=noset irc ports=6667 disabled=noset h323 disabled=noset quake3 disabled=noset mms disabled=noset gre disabled=noset pptp disabled=no#+MMS值+#对于光纤接入的没多大关系，但对于ADSL如果某些网页打不开，可以修改一下./ip firewall mangleadd chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440,继续每五行一次这样复制进来。如图,然后点击IP-Firewall；选择Filter Rules,看到什么了。上面的防火墙，具体用到什么还要选择一下。,