ros 防火墙名词解释input - 进入路由，并且需要对其处理 forward - 路由转发 output - 经过路由处理，并且从接口出去的包action：1 accept： 接受 add-dst-to-address-list - 把一个目标 IP 地址加入 address-listadd-src-to-address-list - 把一个源 IP 地址加入 address-list2 drop - 丢弃 3 jump - 跳转，可以跳转到一个规则主题里面，如 input forward，也可以跳转到某一条里面 4 log - 日志记录 5 passthrough - 忽略此条规则 6 reject - 丢弃这个包，并且发送一个 ICMP 回应消息 7 return - 把控制返回给 jump 的所在 8 tarpit - 捕获和扣留 进来的 TCP 连接 (用 SYN/ACK 回应进来的 TCP SYN 包)address-list (name) - 把从 action=add-dst-to-address-list or action=add-src-to-address-list actions 得到的 IP 地址放入 address-list 列表. 这个列表要用来对比 address-list-timeout 看是什么时候 用 address-list parameter 从 address list 中移走chain (forward | input | output | name) - 使用 chain 得到特定列表，不同的数据流经过不同的 chain 规则 要仔细的选对正确的访问控制. 如果 input 不是非常的确定和一个新的规则需要添加注释, transfered through the particular connection 0 的意思是无限的,例如 connection-bytes=2000000-0 意思是 2MB 以上 connection-limit (integer | netmask) - 地址的传输流量控制 connection-mark (name) - 传输中的标记后的数据包 connection-state (estabilished | invalid | new | related) - 连接的状态（连接中，不规则的连接， 新的连接，相互联系的连接） connection-type 连接的类型 （ftp | gre | h323 | irc | mms | pptp | quake3 | tftp)content 包的内容dst-address (IP address | netmask | IP address | IP address) - 目标地址dst-address-list (name) - 目标地址表dst-address-type (unicast | local | broadcast | multicast) - 目标地址类型 unicast -点对点 local - 本地地址 broadcast - 广播 multicast - 多播dst-limit (integer | time | integer | dst-address | dst-port | src-address | time) - 目标限制 Count - 每秒最大的包数量 by Time option Time - 时间 Burst - 突发的 Mode -等级优先 Expire - 终止dst-port 目标端口 hotspot 暂时不做学习 icmp-options (integer | integer) - ICMP 选择 in-interface (name) - 进入接口 ipv4-options (any | loose-source-routing | no-record-route | no-router-alert | no-source-routing |no- timestamp | none | record-route | router-alert | strict-source-routing | timestamp) any - match packet with at least one of the ipv4 options loose-source-routing -match packets with loose source routing option. This option is used toroute the internet datagram based on information supplied by the source no-record-route - match packets with no record route option. This option is used to route the internet datagram based on information supplied by the source no-router-alert - match packets with no router alter option no-source-routing - match packets with no source routing option no-timestamp - match packets with no timestamp option record-route - match packets with record route option router-alert - match packets with router alter option strict-source-routing - match packets with strict source routing option timestamp - match packets with timestamp jump-target (forward | input | output | name) -跳转 limit (integer | time | integer) - 限制 Count - 每秒最大的包数量 Time - 突发的总时间 log-prefix (text) - 如果还有定义的字符，加入日志 out-interface (name) - 流出的接口 p2p (all-p2p | bit-torrent | blubster | direct-connect | edonkey | fasttrack | gnutella | soulseek | warez | winmx) - P2P 协议 packet-mark (text) - 给包标记 packet-size (integer: 0.65535 | integer: 0.65535) - 包大小 range in bytesMin - 最小 Max - 最大 phys-in-interface (name) - 物理上的进入接口 phys-out-interface (name) -物理上的出去接口protocol (ddp | egp | encap | ggp | gre | hmp | icmp | idrp-cmtp | igmp | ipencap | ipip | ipsec- ah |ipsec-esp | iso-tp4 | ospf | pup | rdp | rspf | st | tcp | udp | vmtp | xns-idp | xtp | integer) -协议 psd (integer | time | integer | integer) - 防止对 ROS 的端口扫描 random (integer: 1.99) - matches packets randomly with given propability reject-with (icmp-admin-prohibited | icmp-echo-reply | icmp-host-prohibited | icmp-host-unreachable | icmp-net-prohibited | icmp-network-unreachable | icmp-port- unreachable |icmp-protocol-unreachable | tcp-reset | integer) - 改变 reject 的回答方式 routing-mark (name) - 路由标记 src-address (IP address | netmask | IP address | IP address) -源地址 src-address-list (name) -源地址列表 src-address-type (unicast | local | broadcast | multicast) - 源地址类型 src-mac-address (MAC address) - 源 MAC 地址 src-port (integer: 0.65535 | integer: 0.65535) - 源端口 tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg) -TCP 标志类型 ack - acknowledging data cwr - congestion window reduced ece - ECN-echo flag (explicit congestion notification) fin - close connection psh - push function rst - drop connection syn - new connection urg - urgent data tcp-mss (integer: 0.65535) - TCP MSS time (time | time | sat | fri | thu | wed | tue | mon | sun) - allows to create filter based on the packets arrival time and date or, for locally generated packets, departure time and date tos (max-reliability | max-throughput | min-cost | min-delay | normal) - specifies a match for the value of Type of Service (ToS) field of an IP header max-reliability - maximize reliability (ToS=4) max-throughput - maximize throughput (ToS=8) min-cost - minimize monetary cost (ToS=2) min-delay - minimize delay (ToS=16) normal - normal service (ToS=0):foreach i in=/system logging facility find local=memory do=/system logging facility set $i loc al=noneRO 防 synip-firewall-connections Tracking:TCP Syn Sent Timeout:50TCP syn received timeout:30限线程脚本： :for aaa from