Manual:IP/Firewall/Raw: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
← Older editNewer edit →
Line 10: Line 10:
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.
</p>
</p>
==Properties==
<table class="styled_table">
<tr>
  <th width="40%">Property</th>
  <th >Description</th>
</tr>
<tr>
    <td><var><b>action</b></var> (<em>action name</em>; Default: <b>accept</b>)</td>
    <td>Action to take if packet is matched by the rule:
<ul class="bullets">
<li> <var>accept</var> - accept the packet. Packet is not passed to next firewall rule.
<li> <var>add-dst-to-address-list</var> - add destination address to [[M:IP/Firewall/Address list | address list]] specified by <code>address-list</code> parameter
<li> <var>add-src-to-address-list</var> - add source address to [[M:IP/Firewall/Address list | address list]] specified by <code>address-list</code> parameter
<li> <var>drop</var> - silently drop the packet
<li> <var>jump</var> - jump to the user defined chain specified by the value of <code>jump-target</code> parameter
<li> <var>log</var> - add a message to the system log containing following data: in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as <code>passthrough</code>
<li> <var>notrack</var> - do not send packet to connection tracking.
<li> <var>passthrough</var> - ignore this rule and go to next one (useful for statistics).
<li> <var>return</var>  - passes control back to the chain from where the jump took place
</ul>
</td>
</tr>
<tr>
    <td><var><b>address-list</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Name of the address list to be used. Applicable if action is <code>add-dst-to-address-list</code> or <code>add-src-to-address-list</code> </td>
</tr>
<tr>
    <td><var><b>address-list-timeout</b></var> (<em>time</em>; Default: <b>00:00:00</b>)</td>
    <td>Time interval after which the address will be removed from the address list specified by <code>address-list</code> parameter. Used in conjunction with <code>add-dst-to-address-list</code> or <code>add-src-to-address-list</code> actions<br />
Value of <code>00:00:00</code> will leave the address in the address list forever</td>
</tr>
<tr>
    <td><var><b>chain</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created. </td>
</tr>
<tr>
    <td><var><b>comment</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Descriptive comment for the rule.</td>
</tr>
<tr>
    <td><var><b>dscp</b></var> (<em>integer: 0..63</em>; Default: <b></b>)</td>
    <td>Matches DSCP IP header field.</td>
</tr>
<tr>
    <td><var><b>dst-address</b></var> (<em>IP/netmask | IP range</em>; Default: <b></b>)</td>
    <td>Matches packets which destination is equal to specified IP or falls into specified IP range.</td>
</tr>
<tr>
    <td><var><b>dst-address-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Matches destination address of a packet against user-defined [[M:IP/Firewall/Address_list | address list]]</td>
</tr>
<tr>
    <td><var><b>dst-address-type</b></var> (<em>unicast | local | broadcast | multicast</em>; Default: <b></b>)</td>
    <td>Matches destination address type:
<ul class="bullets">
<li> <var>unicast</var> - IP address used for point to point transmission
<li> <var>local</var> - if dst-address is assigned to one of router's interfaces
<li> <var>broadcast</var> - packet is sent to all devices in subnet
<li> <var>multicast</var> - packet is forwarded to defined group of devices
</ul>
</td>
</tr>
<tr>
    <td><var><b>dst-limit</b></var> (<em>integer[/time],integer,dst-address | dst-port | src-address[/time]</em>; Default: <b></b>)</td>
    <td>Matches packets until a given rate is exceeded. Rate is defined as packets per time interval. As opposed to the <var>limit</var> matcher, every flow has it's own limit. Flow is defined by mode parameter. Parameters are written in following format: <code>count[/time],burst,mode[/expire]</code>.
<ul class="bullets">
<li><b>count</b> - packet count per time interval per flow to match
<li><b>time</b> - specifies the time interval in which the packet count per flow cannot be exceeded (optional, 1s will be used if not specified)
<li><b>burst</b> - initial number of packets per flow to match: this number gets recharged by one every <code>time</code>/<code>count</code>, up to this number
<li><b>mode</b> - this parameter specifies what unique fields define flow (src-address, dst-address, src-and-dst-address, dst-address-and-port, addresses-and-dst-port)
<li><b>expire</b> - specifies interval after which flow with no packets will be allowed to be deleted (optional)
</ul>
</td>
</tr>
<tr>
    <td><var><b>dst-port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>List of destination port numbers or port number ranges</td>
</tr>
<tr>
    <td><var><b>fragment</b></var> (<em>yes|no</em>; Default: <b></b>)</td>
    <td>Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet</td>
</tr>
<tr>
    <td><var><b>hotspot</b></var> (<em>auth | from-client | http | local-dst | to-client</em>; Default: <b></b>)</td>
    <td></td>
</tr>
<tr>
    <td><var><b>icmp-options</b></var> (<em>integer:integer</em>; Default: <b></b>)</td>
    <td>Matches ICMP type:code fileds</td>
</tr>
<tr>
    <td><var><b>in-interface</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Interface the packet has entered the router</td>
</tr>
<tr>
    <td><var><b>in-interface-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Set of interfaces defined in [[M:Interface/List | interface list]]. Works the same as <var>in-interface</var></td>
</tr>
<tr>
    <td><var><b>ingress-priority</b></var> (<em>integer: 0..63</em>; Default: <b></b>)</td>
    <td>Matches ingress priority of the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. [[M:WMM | Read more>>]]</td>
</tr>
<tr>
    <td><var><b>ipsec-policy</b></var> (<em>in | out, ipsec | none</em>; Default: <b></b>)</td>
    <td>Matches the policy used by IpSec. Value is written in following format: <code><b>direction, policy</b></code>. Direction is Used to select whether to match the policy used for decapsulation or the policy that will be used for encapsulation.
            <ul>
            <li><var>in</var> - valid in the PREROUTING, INPUT and FORWARD chains</li>
            <li><var>out</var> - valid in the POSTROUTING, OUTPUT and FORWARD chains</li>
            </ul>
            <ul>
            <li><var>ipsec</var> - matches if the packet is subject to IpSec processing;</li>
            <li><var>none</var> - matches packet that is not subject to IpSec processing (for example, IpSec transport packet).</li>
            </ul>
            <p>For example, if router receives Ipsec encapsulated Gre packet, then rule <code>ipsec-policy=in,ipsec</code> will match Gre packet, but rule <code>ipsec-policy=in,none</code> will match ESP packet.</p></td>
</tr>
<tr>
    <td><var><b>ipv4-options</b></var> (<em>any | loose-source-routing | no-record-route | no-router-alert | no-source-routing | no-timestamp | none | record-route | router-alert | strict-source-routing | timestamp</em>; Default: <b></b>)</td>
    <td>Matches IPv4 header options.
<ul class="bullets">
<li> <var>any</var> - match packet with at least one of the ipv4 options
<li> <var>loose-source-routing</var> - match packets with loose source routing option. This option is used to route the internet datagram based on information supplied by the source
<li> <var>no-record-route</var> - match packets with no record route option. This option is used to route the internet datagram based on information supplied by the source
<li> <var>no-router-alert</var> - match packets with no router alter option
<li> <var>no-source-routing</var> - match packets with no source routing option
<li> <var>no-timestamp</var> - match packets with no timestamp option
<li> <var>record-route</var> - match packets with record route option
<li> <var>router-alert</var> - match packets with router alter option
<li> <var>strict-source-routing</var> - match packets with strict source routing option
<li> <var>timestamp</var> - match packets with timestamp
</ul>
</td>
</tr>
<tr>
    <td><var><b>jump-target</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Name of the target chain to jump to. Applicable only if <code>action=jump</code></td>
</tr>
<tr>
    <td><var><b>limit</b></var> (<em>integer,time,integer</em>; Default: <b></b>)</td>
    <td>Matches packets up to a limited rate (packet rate or bit rate). Rule using this matcher will match until this limit is reached. Parameters are written in following format: <code>count[/time],burst:mode</code>.
<ul class="bullets">
<li><b>count</b> - packet or bit count per time interval to match
<li><b>time</b> - specifies the time interval in which the packet or bit count cannot be exceeded (optional, 1s will be used if not specified)
<li><b>burst</b> - initial number of packets or bits to match: this number gets recharged every 10ms so burst should be at least 1/100 of rate per second
<li><b>mode</b> - packet or bit mode
</ul>
</td>
</tr>
<tr>
    <td><var><b>log</b></var> (<em>yes {{!}} no</em>; Default: <b></b>)</td>
    <td>Preferred method of logging instead of <code>action=log</code></td>
</tr>
<tr>
    <td><var><b>log-prefix</b></var> (<em>string</em>; Default: <b></b>)</td>
    <td>Adds specified text at the beginning of every log message. Applicable if <code>action=log</code></td>
</tr>
<tr>
    <td><var><b>nth</b></var> (<em>integer,integer</em>; Default: <b></b>)</td>
    <td>Matches every nth packet. [[M:NTH_in_RouterOS_3.x | Read more >>]]</td>
</tr>
<tr>
    <td><var><b>out-interface</b></var> (<em></em>; Default: <b></b>)</td>
    <td>Interface the packet is leaving the router</td>
</tr>
<tr>
    <td><var><b>out-interface-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Set of interfaces defined in [[M:Interface/List | interface list]]. Works the same as <var>out-interface</var></td>
</tr>
<tr>
    <td><var><b>packet-size</b></var> (<em>integer[-integer]:0..65535</em>; Default: <b></b>)</td>
    <td>Matches packets of specified size or size range in bytes.</td>
</tr>
<tr>
    <td><var><b>per-connection-classifier</b></var> (<em>ValuesToHash:Denominator/Remainder</em>; Default: <b></b>)</td>
    <td>PCC matcher allows to divide traffic into equal streams with ability to keep packets with specific set of options in one particular stream. [[M:PCC | Read more >>]]</td>
</tr>
<tr>
    <td><var><b>port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if <code>protocol</code> is TCP or UDP</td>
</tr>
<tr>
    <td><var><b>priority</b></var> (<em>integer: 0..63</em>; Default:)</td>
    <td></td>
</tr>
<tr>
    <td><var><b>protocol</b></var> (<em>name or protocol ID</em>; Default: <b>tcp</b>)</td>
    <td>Matches particular IP protocol specified by protocol name or number</td>
</tr>
<tr>
    <td><var><b>psd</b></var> (<em>integer,time,integer,integer</em>; Default: <b></b>)</td>
    <td>Attempts to detect TCP and UDP scans. Parameters are in following format <code>WeightThreshold, DelayThreshold, LopPortWeight, HighPortWeight</code>
<ul class="bullets">
<li> <b>WeightThreshold</b> - total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence
<li> <b>DelayThreshold</b> - delay for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence
<li> <b>LowPortWeight</b> - weight of the packets with privileged (<=1024) destination port
<li> <b>HighPortWeight</b> - weight of the packet with non-priviliged destination port
</ul>
</td>
</tr>
<tr>
    <td><var><b>random</b></var> (<em>integer: 1..99</em>; Default: <b></b>)</td>
    <td>Matches packets randomly with given probability.</td>
</tr>
<tr>
    <td><var><b>src-address</b></var> (<em>Ip/Netmaks, Ip range</em>; Default: <b></b>)</td>
    <td>Matches packets which source is equal to specified IP or falls into specified IP range.</td>
</tr>
<tr>
    <td><var><b>src-address-list</b></var> (<em>name</em>; Default: <b></b>)</td>
    <td>Matches source address of a packet against user-defined [[M:IP/Firewall/Address_list | address list]]</td>
</tr>
<tr>
    <td><var><b>src-address-type</b></var> (<em>unicast | local | broadcast | multicast</em>; Default: <b></b>)</td>
    <td>
Matches source address type:
<ul class="bullets">
<li> <var>unicast</var> - IP address used for point to point transmission
<li> <var>local</var> - if address is assigned to one of router's interfaces
<li> <var>broadcast</var> - packet is sent to all devices in subnet
<li> <var>multicast</var> - packet is forwarded to defined group of devices
</ul>
</td>
</tr>
<tr>
    <td><var><b>src-port</b></var> (<em>integer[-integer]: 0..65535</em>; Default: <b></b>)</td>
    <td>List of source ports and ranges of source ports. Applicable only if protocol is TCP or UDP.</td>
</tr>
<tr>
    <td><var><b>src-mac-address</b></var> (<em>MAC address</em>; Default: <b></b>)</td>
    <td>Matches source MAC address of the packet</td>
</tr>
<tr>
    <td><var><b>tcp-flags</b></var> (<em>ack | cwr | ece | fin | psh | rst | syn | urg</em>; Default: <b></b>)</td>
    <td>Matches specified TCP flags
<ul class="bullets">
<li> <var>ack</var> - acknowledging data
<li> <var>cwr</var> - congestion window reduced
<li> <var>ece</var> - ECN-echo flag (explicit congestion notification)
<li> <var>fin</var> - close connection
<li> <var>psh</var> - push function
<li> <var>rst</var> - drop connection
<li> <var>syn</var> - new connection
<li> <var>urg</var> - urgent data
</ul>
</td>
</tr>
<tr>
    <td><var><b>tcp-mss</b></var> (<em>integer: 0..65535</em>; Default: <b></b>)</td>
    <td>Matches TCP MSS value of an IP packet</td>
</tr>
<tr>
    <td><var><b>time</b></var> (<em>time-time,sat | fri | thu | wed | tue | mon | sun</em>; Default: <b></b>)</td>
    <td>Allows to create filter based on the packets' arrival time and date or, for locally generated packets, departure time and date</td>
</tr>
<tr>
    <td><var><b>ttl</b></var> (<em>integer: 0..255</em>; Default: <b></b>)</td>
    <td>Matches packets TTL value</td>
</tr>
</table>

Revision as of 13:11, 10 August 2016

Summary

Sub-menu: /ip firewall raw


Firewall RAW table allows to selectively bypass or drop packets before connection tracking that way significantly reducing load on CPU. Tool is very useful for DOS attack mitigation.

RAW table does not have matchers that depend on connection tracking ( like connection-state, layer7 etc.).
If packet is marked to bypass connection tracking packet de-fragmentation will not occur.

Properties

Property Description
action (action name; Default: accept) Action to take if packet is matched by the rule:
  • accept - accept the packet. Packet is not passed to next firewall rule.
  • add-dst-to-address-list - add destination address to address list specified by address-list parameter
  • add-src-to-address-list - add source address to address list specified by address-list parameter
  • drop - silently drop the packet
  • jump - jump to the user defined chain specified by the value of jump-target parameter
  • log - add a message to the system log containing following data: in-interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and length of the packet. After packet is matched it is passed to next rule in the list, similar as passthrough
  • notrack - do not send packet to connection tracking.
  • passthrough - ignore this rule and go to next one (useful for statistics).
  • return - passes control back to the chain from where the jump took place
address-list (string; Default: ) Name of the address list to be used. Applicable if action is add-dst-to-address-list or add-src-to-address-list
address-list-timeout (time; Default: 00:00:00) Time interval after which the address will be removed from the address list specified by address-list parameter. Used in conjunction with add-dst-to-address-list or add-src-to-address-list actions
Value of 00:00:00 will leave the address in the address list forever
chain (name; Default: ) Specifies to which chain rule will be added. If the input does not match the name of an already defined chain, a new chain will be created.
comment (string; Default: ) Descriptive comment for the rule.
dscp (integer: 0..63; Default: ) Matches DSCP IP header field.
dst-address (IP/netmask | IP range; Default: ) Matches packets which destination is equal to specified IP or falls into specified IP range.
dst-address-list (name; Default: ) Matches destination address of a packet against user-defined address list
dst-address-type (unicast | local | broadcast | multicast; Default: ) Matches destination address type:
  • unicast - IP address used for point to point transmission
  • local - if dst-address is assigned to one of router's interfaces
  • broadcast - packet is sent to all devices in subnet
  • multicast - packet is forwarded to defined group of devices
dst-limit (integer[/time],integer,dst-address | dst-port | src-address[/time]; Default: ) Matches packets until a given rate is exceeded. Rate is defined as packets per time interval. As opposed to the limit matcher, every flow has it's own limit. Flow is defined by mode parameter. Parameters are written in following format: count[/time],burst,mode[/expire].
  • count - packet count per time interval per flow to match
  • time - specifies the time interval in which the packet count per flow cannot be exceeded (optional, 1s will be used if not specified)
  • burst - initial number of packets per flow to match: this number gets recharged by one every time/count, up to this number
  • mode - this parameter specifies what unique fields define flow (src-address, dst-address, src-and-dst-address, dst-address-and-port, addresses-and-dst-port)
  • expire - specifies interval after which flow with no packets will be allowed to be deleted (optional)
dst-port (integer[-integer]: 0..65535; Default: ) List of destination port numbers or port number ranges
fragment (yes|no; Default: ) Matches fragmented packets. First (starting) fragment does not count. If connection tracking is enabled there will be no fragments as system automatically assembles every packet
hotspot (auth | from-client | http | local-dst | to-client; Default: )
icmp-options (integer:integer; Default: ) Matches ICMP type:code fileds
in-interface (name; Default: ) Interface the packet has entered the router
in-interface-list (name; Default: ) Set of interfaces defined in interface list. Works the same as in-interface
ingress-priority (integer: 0..63; Default: ) Matches ingress priority of the packet. Priority may be derived from VLAN, WMM or MPLS EXP bit. Read more>>
ipsec-policy (in | out, ipsec | none; Default: ) Matches the policy used by IpSec. Value is written in following format: direction, policy. Direction is Used to select whether to match the policy used for decapsulation or the policy that will be used for encapsulation.
  • in - valid in the PREROUTING, INPUT and FORWARD chains
  • out - valid in the POSTROUTING, OUTPUT and FORWARD chains
  • ipsec - matches if the packet is subject to IpSec processing;
  • none - matches packet that is not subject to IpSec processing (for example, IpSec transport packet).

For example, if router receives Ipsec encapsulated Gre packet, then rule ipsec-policy=in,ipsec will match Gre packet, but rule ipsec-policy=in,none will match ESP packet.
ipv4-options (any | loose-source-routing | no-record-route | no-router-alert | no-source-routing | no-timestamp | none | record-route | router-alert | strict-source-routing | timestamp; Default: ) Matches IPv4 header options.
  • any - match packet with at least one of the ipv4 options
  • loose-source-routing - match packets with loose source routing option. This option is used to route the internet datagram based on information supplied by the source
  • no-record-route - match packets with no record route option. This option is used to route the internet datagram based on information supplied by the source
  • no-router-alert - match packets with no router alter option
  • no-source-routing - match packets with no source routing option
  • no-timestamp - match packets with no timestamp option
  • record-route - match packets with record route option
  • router-alert - match packets with router alter option
  • strict-source-routing - match packets with strict source routing option
  • timestamp - match packets with timestamp
jump-target (name; Default: ) Name of the target chain to jump to. Applicable only if action=jump
limit (integer,time,integer; Default: ) Matches packets up to a limited rate (packet rate or bit rate). Rule using this matcher will match until this limit is reached. Parameters are written in following format: count[/time],burst:mode.
  • count - packet or bit count per time interval to match
  • time - specifies the time interval in which the packet or bit count cannot be exceeded (optional, 1s will be used if not specified)
  • burst - initial number of packets or bits to match: this number gets recharged every 10ms so burst should be at least 1/100 of rate per second
  • mode - packet or bit mode
log (yes | no; Default: ) Preferred method of logging instead of action=log
log-prefix (string; Default: ) Adds specified text at the beginning of every log message. Applicable if action=log
nth (integer,integer; Default: ) Matches every nth packet. Read more >>
out-interface (; Default: ) Interface the packet is leaving the router
out-interface-list (name; Default: ) Set of interfaces defined in interface list. Works the same as out-interface
packet-size (integer[-integer]:0..65535; Default: ) Matches packets of specified size or size range in bytes.
per-connection-classifier (ValuesToHash:Denominator/Remainder; Default: ) PCC matcher allows to divide traffic into equal streams with ability to keep packets with specific set of options in one particular stream. Read more >>
port (integer[-integer]: 0..65535; Default: ) Matches if any (source or destination) port matches the specified list of ports or port ranges. Applicable only if protocol is TCP or UDP
priority (integer: 0..63; Default:)
protocol (name or protocol ID; Default: tcp) Matches particular IP protocol specified by protocol name or number
psd (integer,time,integer,integer; Default: ) Attempts to detect TCP and UDP scans. Parameters are in following format WeightThreshold, DelayThreshold, LopPortWeight, HighPortWeight
  • WeightThreshold - total weight of the latest TCP/UDP packets with different destination ports coming from the same host to be treated as port scan sequence
  • DelayThreshold - delay for the packets with different destination ports coming from the same host to be treated as possible port scan subsequence
  • LowPortWeight - weight of the packets with privileged (<=1024) destination port
  • HighPortWeight - weight of the packet with non-priviliged destination port
random (integer: 1..99; Default: ) Matches packets randomly with given probability.
src-address (Ip/Netmaks, Ip range; Default: ) Matches packets which source is equal to specified IP or falls into specified IP range.
src-address-list (name; Default: ) Matches source address of a packet against user-defined address list
src-address-type (unicast | local | broadcast | multicast; Default: )

Matches source address type:

  • unicast - IP address used for point to point transmission
  • local - if address is assigned to one of router's interfaces
  • broadcast - packet is sent to all devices in subnet
  • multicast - packet is forwarded to defined group of devices
src-port (integer[-integer]: 0..65535; Default: ) List of source ports and ranges of source ports. Applicable only if protocol is TCP or UDP.
src-mac-address (MAC address; Default: ) Matches source MAC address of the packet
tcp-flags (ack | cwr | ece | fin | psh | rst | syn | urg; Default: ) Matches specified TCP flags
  • ack - acknowledging data
  • cwr - congestion window reduced
  • ece - ECN-echo flag (explicit congestion notification)
  • fin - close connection
  • psh - push function
  • rst - drop connection
  • syn - new connection
  • urg - urgent data
tcp-mss (integer: 0..65535; Default: ) Matches TCP MSS value of an IP packet
time (time-time,sat | fri | thu | wed | tue | mon | sun; Default: ) Allows to create filter based on the packets' arrival time and date or, for locally generated packets, departure time and date
ttl (integer: 0..255; Default: ) Matches packets TTL value
Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:IP/Firewall/Raw&oldid=28615"