Manual:IP/Firewall/Raw: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
Created page with "==Summary== <p id="shbox"><b>Sub-menu:</b> <code>/ip firewall raw</code></p> <br /> <p> Firewall RAW table allows to selectively bypass or drop packets before connection trac..."
 
No edit summary
 
(12 intermediate revisions by 3 users not shown)
Line 5: Line 5:
<p>
<p>
Firewall RAW table allows to selectively bypass or drop packets before connection tracking that way significantly reducing load on CPU. Tool is very useful for DOS attack mitigation.
Firewall RAW table allows to selectively bypass or drop packets before connection tracking that way significantly reducing load on CPU. Tool is very useful for DOS attack mitigation.
</p>


RAW table does not have matchers that depend on connection tracking ( like connection-state, layer7 etc.).
<p>RAW table does not have matchers that depend on connection tracking ( like connection-state, layer7 etc.). <br />
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.
</p>


==Chains==
<p>
There are two predefined chains in RAW tables:
<ul class="bullets">
<li> <b>prerouting</b> - used to process any packet entering the router
<li> <b>output</b> - used to process packets originated from the router and leaving it through one of the interfaces. Packets passing through the router are not processed against the rules of the output chain
</ul>
[[M:Packet_Flow | Packet flow]] diagrams illustrate how packets are processed in RouterOS.
</p>
</p>
==Properties==
<table class="styled_table">
<tr>
  <th width="40%">Property</th>
  <th >Description</th>
</tr>
<tr>
    <td><var><b>action</b></var> (<em>action name</em>; Default: <b>accept</b>)</td>
    <td>Action to take if packet is matched by the rule:
<ul class="bullets">
<li> <var>accept</var> - accept the packet. Packet is not passed to next firewall rule.
<li> <var>add-dst-to-address-list</var> - add destination address to [[M:IP/Firewall/Address list | address list]] specified by <code>address-list</code> parameter
<li> <var>add-src-to-address-list</var> - add source address to [[M:IP/Firewall/Address list | address list]] specified by <code>address-list</code> parameter
<li> <var>drop</var> - silently drop the packet
<li> <var>jump</var> - jump to the user defined chain specified by the value of <code>jump-target</code> parameter
<li> <var>log</var> - add a message to the system log containing following data: in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as <code>passthrough</code>
<li> <var>notrack</var> - do not send packet to connection tracking.
<li> <var>passthrough</var> - ignore this rule and go to next one (useful for statistics).
<li> <var>return</var>  - passes control back to the chain from where the jump took place
</ul>
</td>
</tr>
<tr>
    <td><var><b>address-list</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Name of the address list to be used. Applicable if action is <code>add-dst-to-address-list</code> or <code>add-src-to-address-list</code> </td>
</tr>
<tr>
    <td><var><b>address-list-timeout</b></var> (<em>none-dynamic | none-static | time</em>; Default: <b>none-dynamic</b>)</td>
    <td>Time interval after which the address will be removed from the address list specified by <code>address-list</code> parameter. Used in conjunction with <code>add-dst-to-address-list</code> or <code>add-src-to-address-list</code> actions<br />
<ul class="bullets">
<li>Value of <var>none-dynamic</var> (<code>00:00:00</code>) will leave the address in the address list till reboot
<li>Value of <var>none-static</var> will leave the address in the address list forever and will be included in configuration export/backup
</ul></td>
</tr>
<tr>
    <td><var><b>chain</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created. </td>
</tr>
<tr>
    <td><var><b>comment</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Descriptive comment for the rule.</td>
</tr>
<tr>
    <td><var><b>dscp</b></var> (<em>integer: 0..63</em>; Default: <b></b>)</td>
    <td>Matches DSCP IP header field.</td>
</tr>
<tr>
    <td><var><b>dst-address</b></var> (<em>IP/netmask | IP range</em>; Default: <b></b>)</td>
    <td>Matches packets which destination is equal to specified IP or falls into specified IP range.</td>
</tr>
<tr>
    <td><var><b>dst-address-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Matches destination address of a packet against user-defined [[M:IP/Firewall/Address_list | address list]]</td>
</tr>
<tr>
    <td><var><b>dst-address-type</b></var> (<em>unicast | local | broadcast | multicast</em>; Default: <b></b>)</td>
    <td>Matches destination address type:
<ul class="bullets">
<li> <var>unicast</var> - IP address used for point to point transmission
<li> <var>local</var> - if dst-address is assigned to one of router's interfaces
<li> <var>broadcast</var> - packet is sent to all devices in subnet
<li> <var>multicast</var> - packet is forwarded to defined group of devices
</ul>
</td>
</tr>
<tr>
    <td><var><b>dst-limit</b></var> (<em>integer[/time],integer,dst-address | dst-port | src-address[/time]</em>; Default: <b></b>)</td>
    <td>Matches packets until a given rate is exceeded. Rate is defined as packets per time interval. As opposed to the <var>limit</var> matcher, every flow has it's own limit. Flow is defined by mode parameter. Parameters are written in following format: <code>count[/time],burst,mode[/expire]</code>.
<ul class="bullets">
<li><b>count</b> - packet count per time interval per flow to match
<li><b>time</b> - specifies the time interval in which the packet count per flow cannot be exceeded (optional, 1s will be used if not specified)
<li><b>burst</b> - initial number of packets per flow to match: this number gets recharged by one every <code>time</code>/<code>count</code>, up to this number
<li><b>mode</b> - this parameter specifies what unique fields define flow (src-address, dst-address, src-and-dst-address, dst-address-and-port, addresses-and-dst-port)
<li><b>expire</b> - specifies interval after which flow with no packets will be allowed to be deleted (optional)
</ul>
</td>
</tr>
<tr>
    <td><var><b>dst-port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>List of destination port numbers or port number ranges</td>
</tr>
<tr>
    <td><var><b>fragment</b></var> (<em>yes|no</em>; Default: <b></b>)</td>
    <td>Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet</td>
</tr>
<tr>
    <td><var><b>hotspot</b></var> (<em>auth | from-client | http | local-dst | to-client</em>; Default: <b></b>)</td>
    <td></td>
</tr>
<tr>
    <td><var><b>icmp-options</b></var> (<em>integer:integer</em>; Default: <b></b>)</td>
    <td>Matches ICMP type:code fileds</td>
</tr>
<tr>
    <td><var><b>in-bridge-port</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Actual interface the packet has entered the router, if incoming interface is bridge. Works only if '''use-ip-firewall''' is enabled in bridge settings.</td>
</tr>
<tr>
    <td><var><b>in-interface</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Interface the packet has entered the router</td>
</tr>
<tr>
    <td><var><b>in-interface-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Set of interfaces defined in [[M:Interface/List | interface list]]. Works the same as <var>in-interface</var></td>
</tr>
<tr>
    <td><var><b>ingress-priority</b></var> (<em>integer: 0..63</em>; Default: <b></b>)</td>
    <td>Matches ingress priority of the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. [[M:WMM | Read more>>]]</td>
</tr>
<tr>
    <td><var><b>ipsec-policy</b></var> (<em>in | out, ipsec | none</em>; Default: <b></b>)</td>
    <td>Matches the policy used by IPsec. Value is written in following format: <code><b>direction, policy</b></code>. Direction is Used to select whether to match the policy used for decapsulation or the policy that will be used for encapsulation.
            <ul>
            <li><var>in</var> - valid in the PREROUTING chain</li>
            <li><var>out</var> - valid in the OUTPUT chain</li>
            </ul>
            <ul>
            <li><var>ipsec</var> - matches if the packet is subject to IPsec processing;</li>
            <li><var>none</var> - matches packet that is not subject to IPsec processing (for example, IpSec transport packet).</li>
            </ul>
            <p>For example, if router receives IPsec encapsulated Gre packet, then rule <code>ipsec-policy=in,ipsec</code> will match Gre packet, but rule <code>ipsec-policy=in,none</code> will match ESP packet.</p></td>
</tr>
<tr>
    <td><var><b>ipv4-options</b></var> (<em>any | loose-source-routing | no-record-route | no-router-alert | no-source-routing | no-timestamp | none | record-route | router-alert | strict-source-routing | timestamp</em>; Default: <b></b>)</td>
    <td>Matches IPv4 header options.
<ul class="bullets">
<li> <var>any</var> - match packet with at least one of the ipv4 options
<li> <var>loose-source-routing</var> - match packets with loose source routing option. This option is used to route the internet datagram based on information supplied by the source
<li> <var>no-record-route</var> - match packets with no record route option. This option is used to route the internet datagram based on information supplied by the source
<li> <var>no-router-alert</var> - match packets with no router alter option
<li> <var>no-source-routing</var> - match packets with no source routing option
<li> <var>no-timestamp</var> - match packets with no timestamp option
<li> <var>record-route</var> - match packets with record route option
<li> <var>router-alert</var> - match packets with router alter option
<li> <var>strict-source-routing</var> - match packets with strict source routing option
<li> <var>timestamp</var> - match packets with timestamp
</ul>
</td>
</tr>
<tr>
    <td><var><b>jump-target</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Name of the target chain to jump to. Applicable only if <code>action=jump</code></td>
</tr>
<tr>
    <td><var><b>limit</b></var> (<em>integer,time,integer</em>; Default: <b></b>)</td>
    <td>Matches packets up to a limited rate (packet rate or bit rate). Rule using this matcher will match until this limit is reached. Parameters are written in following format: <code>count[/time],burst:mode</code>.
<ul class="bullets">
<li><b>count</b> - packet or bit count per time interval to match
<li><b>time</b> - specifies the time interval in which the packet or bit count cannot be exceeded (optional, 1s will be used if not specified)
<li><b>burst</b> - initial number of packets or bits to match: this number gets recharged every 10ms so burst should be at least 1/100 of rate per second
<li><b>mode</b> - packet or bit mode
</ul>
</td>
</tr>
<tr>
    <td><var><b>log</b></var> (<em>yes {{!}} no</em>; Default: <b></b>)</td>
    <td>Preferred method of logging instead of <code>action=log</code></td>
</tr>
<tr>
    <td><var><b>log-prefix</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Adds specified text at the beginning of every log message. Applicable if <code>action=log</code></td>
</tr>
<tr>
    <td><var><b>nth</b></var> (<em>integer,integer</em>; Default: <b></b>)</td>
    <td>Matches every nth packet. [[M:NTH_in_RouterOS_3.x | Read more >>]]</td>
</tr>
<tr>
    <td><var><b>out-bridge-port</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Actual interface the packet is leaving the router, if outgoing interface is bridge. Works only if '''use-ip-firewall''' is enabled in bridge settings.</td>
</tr>
<tr>
    <td><var><b>out-interface</b></var> (<em></em>; Default: <b></b>)</td>
    <td>Interface the packet is leaving the router</td>
</tr>
<tr>
    <td><var><b>out-interface-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Set of interfaces defined in [[M:Interface/List | interface list]]. Works the same as <var>out-interface</var></td>
</tr>
<tr>
    <td><var><b>packet-size</b></var> (<em>integer[-integer]:0..65535</em>; Default: <b></b>)</td>
    <td>Matches packets of specified size or size range in bytes.</td>
</tr>
<tr>
    <td><var><b>per-connection-classifier</b></var> (<em>ValuesToHash:Denominator/Remainder</em>; Default: <b></b>)</td>
    <td>PCC matcher allows to divide traffic into equal streams with ability to keep packets with specific set of options in one particular stream. [[M:PCC | Read more >>]]</td>
</tr>
<tr>
    <td><var><b>port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if <code>protocol</code> is TCP or UDP</td>
</tr>
<tr>
    <td><var><b>priority</b></var> (<em>integer: 0..63</em>; Default:)</td>
    <td></td>
</tr>
<tr>
    <td><var><b>protocol</b></var> (<em>name or protocol ID</em>; Default: <b>tcp</b>)</td>
    <td>Matches particular IP protocol specified by protocol name or number</td>
</tr>
<tr>
    <td><var><b>psd</b></var> (<em>integer,time,integer,integer</em>; Default: <b></b>)</td>
    <td>Attempts to detect TCP and UDP scans. Parameters are in following format <code>WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight</code>
<ul class="bullets">
<li> <b>WeightThreshold</b> - total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence
<li> <b>DelayThreshold</b> - delay for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence
<li> <b>LowPortWeight</b> - weight of the packets with privileged (<1024) destination port
<li> <b>HighPortWeight</b> - weight of the packet with non-priviliged destination port
</ul>
</td>
</tr>
<tr>
    <td><var><b>random</b></var> (<em>integer: 1..99</em>; Default: <b></b>)</td>
    <td>Matches packets randomly with given probability.</td>
</tr>
<tr>
    <td><var><b>src-address</b></var> (<em>Ip/Netmaks, Ip range</em>; Default: <b></b>)</td>
    <td>Matches packets which source is equal to specified IP or falls into specified IP range.</td>
</tr>
<tr>
    <td><var><b>src-address-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Matches source address of a packet against user-defined [[M:IP/Firewall/Address_list | address list]]</td>
</tr>
<tr>
    <td><var><b>src-address-type</b></var> (<em>unicast | local | broadcast | multicast</em>; Default: <b></b>)</td>
    <td>
Matches source address type:
<ul class="bullets">
<li> <var>unicast</var> - IP address used for point to point transmission
<li> <var>local</var> - if address is assigned to one of router's interfaces
<li> <var>broadcast</var> - packet is sent to all devices in subnet
<li> <var>multicast</var> - packet is forwarded to defined group of devices
</ul>
</td>
</tr>
<tr>
    <td><var><b>src-port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>List of source ports and ranges of source ports. Applicable only if protocol is TCP or UDP.</td>
</tr>
<tr>
    <td><var><b>src-mac-address</b></var> (<em>MAC address</em>; Default: <b></b>)</td>
    <td>Matches source MAC address of the packet</td>
</tr>
<tr>
    <td><var><b>tcp-flags</b></var> (<em>ack | cwr | ece | fin | psh | rst | syn | urg</em>; Default: <b></b>)</td>
    <td>Matches specified TCP flags
<ul class="bullets">
<li> <var>ack</var> - acknowledging data
<li> <var>cwr</var> - congestion window reduced
<li> <var>ece</var> - ECN-echo flag (explicit congestion notification)
<li> <var>fin</var> - close connection
<li> <var>psh</var> - push function
<li> <var>rst</var> - drop connection
<li> <var>syn</var> - new connection
<li> <var>urg</var> - urgent data
</ul>
</td>
</tr>
<tr>
    <td><var><b>tcp-mss</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>Matches TCP MSS value of an IP packet</td>
</tr>
<tr>
    <td><var><b>time</b></var> (<em>time-time,sat | fri | thu | wed | tue | mon | sun</em>; Default: <b></b>)</td>
    <td>Allows to create filter based on the packets' arrival time and date or, for locally generated packets, departure time and date</td>
</tr>
<tr>
    <td><var><b>tls-host</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Allows to match traffic based on TLS hostname. Accepts [https://en.wikipedia.org/wiki/Glob_(programming) GLOB syntax] for wildcard matching. Note that matcher will not be able to match hostname if TLS handshake frame is fragmented into multiple TCP segments (packets).</td>
</tr>
<tr>
    <td><var><b>ttl</b></var> (<em>integer: 0..255</em>; Default: <b></b>)</td>
    <td>Matches packets TTL value</td>
</tr>
</table>
==Configuration examples==
{{Cont}}
[[Category:Manual|Firewallfilter]]
[[Category:Firewall|Firewallfilter]]

Latest revision as of 11:06, 15 May 2019

Summary

Sub-menu: /ip firewall raw


Firewall RAW table allows to selectively bypass or drop packets before connection tracking that way significantly reducing load on CPU. Tool is very useful for DOS attack mitigation.

RAW table does not have matchers that depend on connection tracking ( like connection-state, layer7 etc.).
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.


Chains

There are two predefined chains in RAW tables:

  • prerouting - used to process any packet entering the router
  • output - used to process packets originated from the router and leaving it through one of the interfaces. Packets passing through the router are not processed against the rules of the output chain

Packet flow diagrams illustrate how packets are processed in RouterOS.

Properties

Property Description
action (action name; Default: accept) Action to take if packet is matched by the rule:
  • accept - accept the packet. Packet is not passed to next firewall rule.
  • add-dst-to-address-list - add destination address to address list specified by address-list parameter
  • add-src-to-address-list - add source address to address list specified by address-list parameter
  • drop - silently drop the packet
  • jump - jump to the user defined chain specified by the value of jump-target parameter
  • log - add a message to the system log containing following data: in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as passthrough
  • notrack - do not send packet to connection tracking.
  • passthrough - ignore this rule and go to next one (useful for statistics).
  • return - passes control back to the chain from where the jump took place
address-list (string; Default: ) Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list
address-list-timeout (none-dynamic | none-static | time; Default: none-dynamic) Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions
  • Value of none-dynamic (00:00:00) will leave the address in the address list till reboot
  • Value of none-static will leave the address in the address list forever and will be included in configuration export/backup
chain (name; Default: ) Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment (string; Default: ) Descriptive comment for the rule.
dscp (integer: 0..63; Default: ) Matches DSCP IP header field.
dst-address (IP/netmask | IP range; Default: ) Matches packets which destination is equal to specified IP or falls into specified IP range.
dst-address-list (name; Default: ) Matches destination address of a packet against user-defined address list
dst-address-type (unicast | local | broadcast | multicast; Default: ) Matches destination address type:
  • unicast - IP address used for point to point transmission
  • local - if dst-address is assigned to one of router's interfaces
  • broadcast - packet is sent to all devices in subnet
  • multicast - packet is forwarded to defined group of devices
dst-limit (integer[/time],integer,dst-address | dst-port | src-address[/time]; Default: ) Matches packets until a given rate is exceeded. Rate is defined as packets per time interval. As opposed to the limit matcher, every flow has it's own limit. Flow is defined by mode parameter. Parameters are written in following format: count[/time],burst,mode[/expire].
  • count - packet count per time interval per flow to match
  • time - specifies the time interval in which the packet count per flow cannot be exceeded (optional, 1s will be used if not specified)
  • burst - initial number of packets per flow to match: this number gets recharged by one every time/count, up to this number
  • mode - this parameter specifies what unique fields define flow (src-address, dst-address, src-and-dst-address, dst-address-and-port, addresses-and-dst-port)
  • expire - specifies interval after which flow with no packets will be allowed to be deleted (optional)
dst-port (integer[-integer]: 0..65535; Default: ) List of destination port numbers or port number ranges
fragment (yes|no; Default: ) Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot (auth | from-client | http | local-dst | to-client; Default: )
icmp-options (integer:integer; Default: ) Matches ICMP type:code fileds
in-bridge-port (name; Default: ) Actual interface the packet has entered the router, if incoming interface is bridge. Works only if use-ip-firewall is enabled in bridge settings.
in-interface (name; Default: ) Interface the packet has entered the router
in-interface-list (name; Default: ) Set of interfaces defined in interface list. Works the same as in-interface
ingress-priority (integer: 0..63; Default: ) Matches ingress priority of the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. Read more>>
ipsec-policy (in | out, ipsec | none; Default: ) Matches the policy used by IPsec. Value is written in following format: direction, policy. Direction is Used to select whether to match the policy used for decapsulation or the policy that will be used for encapsulation.
  • in - valid in the PREROUTING chain
  • out - valid in the OUTPUT chain
  • ipsec - matches if the packet is subject to IPsec processing;
  • none - matches packet that is not subject to IPsec processing (for example, IpSec transport packet).

For example, if router receives IPsec encapsulated Gre packet, then rule ipsec-policy=in,ipsec will match Gre packet, but rule ipsec-policy=in,none will match ESP packet.
ipv4-options (any | loose-source-routing | no-record-route | no-router-alert | no-source-routing | no-timestamp | none | record-route | router-alert | strict-source-routing | timestamp; Default: ) Matches IPv4 header options.
  • any - match packet with at least one of the ipv4 options
  • loose-source-routing - match packets with loose source routing option. This option is used to route the internet datagram based on information supplied by the source
  • no-record-route - match packets with no record route option. This option is used to route the internet datagram based on information supplied by the source
  • no-router-alert - match packets with no router alter option
  • no-source-routing - match packets with no source routing option
  • no-timestamp - match packets with no timestamp option
  • record-route - match packets with record route option
  • router-alert - match packets with router alter option
  • strict-source-routing - match packets with strict source routing option
  • timestamp - match packets with timestamp
jump-target (name; Default: ) Name of the target chain to jump to. Applicable only if action=jump
limit (integer,time,integer; Default: ) Matches packets up to a limited rate (packet rate or bit rate). Rule using this matcher will match until this limit is reached. Parameters are written in following format: count[/time],burst:mode.
  • count - packet or bit count per time interval to match
  • time - specifies the time interval in which the packet or bit count cannot be exceeded (optional, 1s will be used if not specified)
  • burst - initial number of packets or bits to match: this number gets recharged every 10ms so burst should be at least 1/100 of rate per second
  • mode - packet or bit mode
log (yes | no; Default: ) Preferred method of logging instead of action=log
log-prefix (string; Default: ) Adds specified text at the beginning of every log message. Applicable if action=log
nth (integer,integer; Default: ) Matches every nth packet. Read more >>
out-bridge-port (name; Default: ) Actual interface the packet is leaving the router, if outgoing interface is bridge. Works only if use-ip-firewall is enabled in bridge settings.
out-interface (; Default: ) Interface the packet is leaving the router
out-interface-list (name; Default: ) Set of interfaces defined in interface list. Works the same as out-interface
packet-size (integer[-integer]:0..65535; Default: ) Matches packets of specified size or size range in bytes.
per-connection-classifier (ValuesToHash:Denominator/Remainder; Default: ) PCC matcher allows to divide traffic into equal streams with ability to keep packets with specific set of options in one particular stream. Read more >>
port (integer[-integer]: 0..65535; Default: ) Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority (integer: 0..63; Default:)
protocol (name or protocol ID; Default: tcp) Matches particular IP protocol specified by protocol name or number
psd (integer,time,integer,integer; Default: ) Attempts to detect TCP and UDP scans. Parameters are in following format WeightThreshold, DelayThreshold, LowPortWeight, HighPortWeight
  • WeightThreshold - total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence
  • DelayThreshold - delay for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence
  • LowPortWeight - weight of the packets with privileged (<1024) destination port
  • HighPortWeight - weight of the packet with non-priviliged destination port
random (integer: 1..99; Default: ) Matches packets randomly with given probability.
src-address (Ip/Netmaks, Ip range; Default: ) Matches packets which source is equal to specified IP or falls into specified IP range.
src-address-list (name; Default: ) Matches source address of a packet against user-defined address list
src-address-type (unicast | local | broadcast | multicast; Default: )

Matches source address type:

  • unicast - IP address used for point to point transmission
  • local - if address is assigned to one of router's interfaces
  • broadcast - packet is sent to all devices in subnet
  • multicast - packet is forwarded to defined group of devices
src-port (integer[-integer]: 0..65535; Default: ) List of source ports and ranges of source ports. Applicable only if protocol is TCP or UDP.
src-mac-address (MAC address; Default: ) Matches source MAC address of the packet
tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg; Default: ) Matches specified TCP flags
  • ack - acknowledging data
  • cwr - congestion window reduced
  • ece - ECN-echo flag (explicit congestion notification)
  • fin - close connection
  • psh - push function
  • rst - drop connection
  • syn - new connection
  • urg - urgent data
tcp-mss (integer[-integer]: 0..65535; Default: ) Matches TCP MSS value of an IP packet
time (time-time,sat | fri | thu | wed | tue | mon | sun; Default: ) Allows to create filter based on the packets' arrival time and date or, for locally generated packets, departure time and date
tls-host (string; Default: ) Allows to match traffic based on TLS hostname. Accepts GLOB syntax for wildcard matching. Note that matcher will not be able to match hostname if TLS handshake frame is fragmented into multiple TCP segments (packets).
ttl (integer: 0..255; Default: ) Matches packets TTL value

Configuration examples

[ Top | Back to Content ]

Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:IP/Firewall/Raw&oldid=33227"