Blok akses https Facebook di Mikrotik

tambahkan regex
/ip firewall layer7-protocol add name=blok regexp=facebook.com

tambahkan ip pengecualian yang dibolehkan akses facebook untuk percobaan
/ip firewall address-list add list=exeptions address=192.168.1.80

buat paketnya di mangle, taruh paket paling atas
/ip firewall mangle add chain=prerouting layer7-protocol=blok action=mark-packet new-packet-mark=blok passthrough=no

setelah itu bikin filternya untuk jump ke chain baru
/ip firewall filter add chain=forward packet-mark=blok action=jump jump-target=blok

setelah itu drop paket di chain yang baru
/ip firewall filter add chain=blok packet-mark=blok src-address-list=!exeption dst-address-list=!exeption action=drop


Source : (http://remukcorp.blogspot.com)

Port Forwarding in CentOS Using Iptables

check if IP forwarding is enabled:

/sbin/sysctl net.ipv4.ip_forward

if return
net.ipv4.ip_forward = 1
then it is enabled. if not edit /etc/sysctl.conf and set net.ipv4.ip_forward = 1
rerun

/sbin/sysctl -p /etc/sysctl.conf

/sbin/service iptables restart

Adding IP forwarding rules to IpTables

/sbin/iptables -I FORWARD 1 -m state --state ESTABLISHED,RELATED -j ACCEPT

/sbin/iptables -I FORWARD 1 -p tcp --dport 80 -j ACCEPT

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.1.1:8080

/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE

/sbin/service iptables save

/sbin/service iptables restart

 

The content of /etc/sysconfig/iptables files looks like:




# Generated by iptables-save v1.3.5 on Fri Mar  8 10:27:21 2013

*nat

:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.0.1.1:8080

-A POSTROUTING -j MASQUERADE

COMMIT

# Completed on Fri Mar  8 10:27:21 2013

# Generated by iptables-save v1.3.5 on Fri Mar  8 10:27:21 2013

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [234:26336]

:RH-Firewall-1-INPUT - [0:0]

-A INPUT -j RH-Firewall-1-INPUT

-A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -j RH-Firewall-1-INPUT

-A RH-Firewall-1-INPUT -i lo -j ACCEPT

-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT

-A RH-Firewall-1-INPUT -p esp -j ACCEPT

-A RH-Firewall-1-INPUT -p ah -j ACCEPT

-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT

-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 137 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 138 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 139 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 445 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 8082 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 5432 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 50010 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 50030 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 50060 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 50070 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 54310 -j ACCEPT

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 50075 -j ACCEPT

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

 

 

 

Source : http://b2ctran.wordpress.com