ROS计划任务--定时限速

ROS限速脚本+封网站端口IP+封迅雷VAGAA

192.168.0.250
封迅雷只要封住tcp3076和3077
封vagaa
/ ip firewall filter
add chain=forwaent="No VaGaa"
add chain=forward content= action=reject
限速脚本：（KB后面是5个0，MB是6个0）
真正限速脚本为下载640KB，上传512KB (dst)
:for szwm from 1 to 100 do={/queue ** add name=(sy . $szwm) dst-address=(192.168.0. . $szwm) max-limit=640000/512000 interface=all disabled=no}
640000 就是 640KB（后面有3个0），这样运行完脚本，
ROS2.927会自动除以8 换算出实际下载是 80KB 上传64KB。
就是你要限制300K 就是300*8=2400+后面加三个0=2400000（脚本的地方就要写这个）
如何封闭某一IP或网站或端口
1、封IP
/ ip firewall filter add chain=forward dst-address=127.0.0.1(请把这里换为你想封的IP) action=drop comment="这里注释,中文的好像不行"
add chain=forward protocol=udp dst-port=2004 action=drop
add chain=forward protocol=tcp dst-port=2005 action=drop

ROS用流量监控动态控制限速点

ROS用流量监控动态控制限速点1.gifwinbox-ip-firewall-mangle-+2.gif只标识大包3.gifpacket576-1536手工要输入,不是选的.4.gifwinbox-queues-queue types- +5.gif全部做好后,打开这窗口,可以看到rate值会自动改变.6.gifwinbox-queues-queue tree-+7.gifwinbox-system-scripts-+ source里填入本贴后面程序内容,里面数值要改,程序内有说明.8.gifwinbox-system-scheduler-+9.gifwinbox-queues-simple queues-+ 每台机做一个上行限速.######程序开始####################################################################### 程序名称:ROS用流量监控动态控制限速点# 程序版本:测试# 程序员:kuwin Email:kuwin@# 程序版权:免费软件(本程序可自由传播及修改,不必理会原创作者kuwin)# Ros版本:Ros2.8.27 Ros2.9.2 Ros2.9.7# 编写日期:2007-04-29# 修改日期:2007-05-05# 测试人员:kuwin# 测试结果:# 1.控制效果良好;# 2.程序消耗一定的cpu资源,K62-300的cpu资源要用4%-4%(暂停程序只占3%-6%),建议cpu# 要P3-500以上;(2007-05-05改动后已经大幅降低)# 3.Ros显示的流量要比下载软件(讯雷等)上显示的流量要大,原因未明.# 程序评级:无# 简要说明:# 1."预留带宽"是给网络游戏,浏览网页等一些不会抢带宽的程序突发使用,有趣的是,当这# 些程序用了"预留带宽",本程序又会从讯雷,BT等带宽大鳄那里抢回一部分带宽作"预留# 带宽",在恶劣的使用环境下(比如大家都在下载),最后的限制带宽就是"预留带宽". # 建议"预留带宽"值取256000-512000,太小影响网络游戏,浏览网页的速度,太大又会影# 响下载的速度;# 2."最大带宽"取你的路由器出口带宽值;# 3."步进带宽"是本程序自动设置限制带宽时的加减值,1兆路由器出口带宽设5000,2兆设# 10000,10兆设50000,其它按此类推.# 安装方法:# 1.首先要做好简单的PCQ限速,起名"PCQ-Download".上行PCQ限速不明显,建议不要做.# 上行要在queue simple里做单机限速.(很多网站介绍,上baidu搜pcq限速);# 2.winbox,system-scripts,按+,起名SCRIPT_PCQ_SET,source里贴入这里全部内容;# 3.winbox,system-scheduler,按+,起名"SCH_PCQ_SET",interval填00:00:01(这是秒杀,# 可设1-3秒),on event填SCRIPT_PCQ_SET;# 4.程序内字母大小写敏感,请注意;# 5.请特别注意PCQ名"PCQ-Download".还有网卡的名"public"和"local".# 更新说明:# 1.针对PCQ上行限速不明显,已去掉PCQ上行限速,请另作queue simple限速,# 如:limit-at=0/128000 max-limit=0/256000.(2007-05-05)# 2.原来每秒写硬盘一次!现在只有PCQ限速值改变时才会写硬盘.(2007-05-05)# 3.经过前两点修改,cpu使用率大幅下降.(2007-05-05)############################################################################### ######定义变量(注意在Ros2.8中可以不要后面的0):local RxCurRate 0:local RxCurSet 0:local RxResRate 0:local RxMaxRate 0:local RxStepRate 0#下行即时流量#interface monitor public once do={:set RxCurRate $received-bits-per-second}interface monitor local once do={:set RxCurRate $sent-bits-per-second}#下行当前设置:set RxCurSet [/queue type get [/queue type find name="PCQ-Download"] pcq-rate]#下行预留带宽:set RxResRate 256000#下行最大带宽:set RxMaxRate 1024000#下行步进带宽:set RxStepRate 10000#设置下行带宽:if($RxCurRate<($RxMaxRate+-$RxResRate)) do={:if($RxCurSet<$RxMaxRate) do={:set RxCurSet ($RxCurSet+$RxStepRate)/queue type set "PCQ-Download" kind=pcq pcq-rate=$RxCurSet pcq-classifier=dst-address}} else={:if($RxCurSet>$RxResRate) do={:set RxCurSet ($RxCurSet+-$RxStepRate)/queue type set "PCQ-Download" kind=pcq pcq-rate=$RxCurSet pcq-classifier=dst-address}}######程序结束#############################。

ROS时间段限速和动态限速

:if([:pick [/system clock get date] 4 7]="29/") do={:for szwm from=2 to=254 do={queue simple disable ("C" . $szwm)} }
:if([:pick [/system clock get date] 4 7]="29/") do={:for szwm from=2 to=254 do={queue simple disable ("A" . $szwm)} }
:if([:pick [/system clock get date] 4 7]="21/") do={:for szwm from=2 to=254 do={queue simple enable ("C" . $szwm)} }
:if([:pick [/system clock get date] 4 7]="21/") do={:for szwm from=2 to=254 do={queue simple disable ("A" . $szwm)} }
:if([:pick [/system clock get date] 4 7]="7/") do={:for szwm from=2 to=254 do={queue simple disable ("B" . $szwm)} }
:if([:pick [/system clock get date] 4 7]="8/") do={:for szwm from=2 to=254 do={queue simple enable ("B" . $szwm)} }

ros动态限速脚本l

ros动态限速脚本l网吧因客流比较大,所以网络流量变化也很大,单纯的单机限速,会造成大量的带宽被浪费掉.所以我们现在来考虑动态限速.我们简单的分为4个限速阶段,以30M带宽为例.1 不限速2 单机2M限速3 单机1M限速4 单机512K限速一限速策略的创建需要分2步1 建立新的队列类型/queue typeadd name="down_512k" kind=pcq pcq-rate=512000 pcq-limit=50 \pcq-classifier=dst-address pcq-total-limit=2000add name="down_1M" kind=pcq pcq-rate=1000000 pcq-limit=50 \pcq-classifier=dst-address pcq-total-limit=2000add name="down_2M" kind=pcq pcq-rate=2000000 pcq-limit=50 \pcq-classifier=dst-address pcq-total-limit=2000add name="up_512K" kind=pcq pcq-rate=512000 pcq-limit=50 \pcq-classifier=src-address pcq-total-limit=2000add name="up_1M" kind=pcq pcq-rate=1000000 pcq-limit=50 \pcq-classifier=src-address pcq-total-limit=2000add name="up_2M" kind=pcq pcq-rate=2000000 pcq-limit=50 \pcq-classifier=src-address pcq-total-limit=20002 建立新的简单队列简单队列的顺序一定要注意:按照512K在上,2M在下的原则排序(先小后大).因为此队列的执行原则是,先执行最上面的,后面的将被抛弃./ queue simpleadd name="PCQ_512K" dst-address=192.168.0.0/24 interface=Lan parent=none \ direction=both priority=8 queue=down_512k/up_512K limit-at=0/0 \max-limit=0/0 total-queue=default-small disabled=yesadd name="PCQ_1M" dst-address=192.168.0.0/24 interface=Lan parent=none \ direction=both priority=8 queue=up_1M/down_1M limit-at=0/0 max-limit=0/0 \ total-queue=default-small disabled=yesadd name="PCQ_2M" dst-address=192.168.0.0/24 interface=Lan parent=none \ direction=both priority=8 queue=up_2M/up_1M limit-at=0/0 max-limit=0/0 \total-queue=default-small disabled=yes二脚本的制作实际就是简单的允许某策略或不允许某策略,类似在winbox选中某策略,并点叉号或对号.这里操作的是前面建立的简单队列.来达到限速策略的开与关./ systemadd name="off512k" source="/queue sim disable PCQ_512k" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="on512k" source="/queue sim enable PCQ_512k" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="off1m" source="/queue sim disablePCQ_1M" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="on1m" source="/queue sim enable PCQ_1M" \ policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="off2m" source="/queue sim disable PCQ_2M" \ policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="on2m" source="/queue sim enable PCQ_2M" \ policy=ftp,reboot,read,write,policy,test,winbox,password三流量监控我们使用ROS自带的工具"通信监控"(tool traffic-monitor)来监视我们的网络流量.当流量达到一定数值,会自动运行前面制作的脚本.请注意:接口一定要选择你的外网网卡.这里的数据可根据实际情况修改，我是以自己30M带宽为例。

ROS命令大全

ROS通用脚本一：限速脚本:for wbsz from 1 to 254 do={/queue simple add name=(wbsz . $wbsz)dst-address=(192.168.0. . $wbsz) limit-at=1024K/1024K max-limit=1024K/1024K} 二：限制每台机最大线程数:for wbsz from 1 to 254 do={/ip firewall filter add chain=forwardsrc-address=(192.168.0. . $wbsz) protocol=tcp connection-limit=50,32action=drop}三：端口映射ip firewall nat add chain=dstnat dst-address=(202.96.134.134) protocol=tcp dst-port=80 to-addresses=(192.168.0.1) to-ports=80 action=dst-nat四：封端口号/ ip firewall filterad ch forward pr tcp dst-po 8000 act drop comment="Blockade QQ"五：更变telnet服务端口/ip service set telnet port=23六：更变SSH管理服务端口/ip service set ssh port=22七：更变www服务端口号/ip service set www port=80八：更变FTP服务端口号/ip service set ftp port=21十：删除限速脚本:for wbsz from 1 to 254 do={/queue simple remove (wbsz . $wbsz) }十一：封IP脚步本/ ip firewall filteradd chain=forward dst-address=58.60.13.38/32 action=drop comment="Blockade QQ" 十二：禁P2P脚本/ ip firewall filteradd chain=forward src-address=192.168.0.0/24 p2p=all-p2p action=drop comment="No P2P"十三：限制每台机最大的TCP线程数(线程数=60)/ ip firewall filteradd chain=forward protocol=tcp connection-limit=60,32 action=drop \disabled=no十四：一次性绑定所有在线机器MAC:foreach wbsz in=[/ip arp find dynamic=yes ] do=[/ip arp add copy-from=$wbsz] 十五：解除所以绑定的MAC:foreach wbsz in [/ip arp find] do={/ip arp remove $wbsz}十六：禁Ping/ ip firewall filteradd chain=output protocol=icmp action=drop comment="No Ping"十七：禁电驴/ ip firewall filteradd chain=forward protocol=tcp dst-port=4661-4662 action=drop comment="No Emule"add chain=forward protocol=tcp dst-port=4242 action=dropadd chain=forward dst-address=62.241.53.15 action=drop十八：禁PPLIVE/ ip firewall filteradd chain=forward protocol=tcp dst-port=8008 action=drop comment="No PPlive TV" add chain=forward protocol=udp dst-port=4004 action=dropadd chain=forward dst-address=218.108.237.11 action=drop十九：禁QQ直播/ ip firewall filteradd chain=forward protocol=udp dst-port=13000-14000 action=drop comment="No QQLive"二十：禁比特精灵/ ip firewall filteradd chain=forward protocol=tcp dst-port=16881 action=drop comment="No BitSpirit"二十一：禁QQ聊天(没事不要用)/ ip firewall filteradd chain=forward src-address=10.5.6.7/32 action=accept comment="No Tencent QQ" ad ch forward pr tcp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropadd chain=forward dst-address=61.144.238.0/24 action=dropadd chain=forward dst-address=61.152.100.0/24 action=dropadd chain=forward dst-address=61.141.194.0/24 action=dropadd chain=forward dst-address=202.96.170.163/32 action=dropadd chain=forward dst-address=202.104.129.0/24 action=dropadd chain=forward dst-address=202.104.193.20/32 action=dropadd chain=forward dst-address=202.104.193.11/32 action=dropadd chain=forward dst-address=202.104.193.12/32 action=dropadd chain=forward dst-address=218.17.209.23/32 action=dropadd chain=forward dst-address=218.18.95.153/32 action=dropadd chain=forward dst-address=218.18.95.165/32 action=dropadd chain=forward dst-address=218.18.95.220/32 action=dropadd chain=forward dst-address=218.85.138.70/32 action=dropadd chain=forward dst-address=219.133.38.0/24 action=dropadd chain=forward dst-address=219.133.49.0/24 action=dropadd chain=forward dst-address=220.133.40.0/24 action=dropadd chain=forward content=sz.tencent action=rejectadd chain=forward content=sz2.tencent action=rejectadd chain=forward content=sz3.tencent action=rejectadd chain=forward content=sz4.tencent action=rejectadd chain=forward content=sz5.tencent action=rejectadd chain=forward content=sz6.tencent action=rejectadd chain=forward content=sz7.tencent action=rejectadd chain=forward content=sz8.tencent action=rejecadd chain=forward content=sz9.tencent action=rejecadd chain=forward content=tcpconn.tencent action=rejectadd chain=forward content=tcpconn2.tencent action=rejectadd chain=forward content=tcpconn3.tencent action=rejectadd chain=forward content=tcpconn4.tencent action=rejectadd chain=forward content=tcpconn5.tencent action=rejectadd chain=forward content=tcpconn6.tencent action=rejectadd chain=forward content=tcpconn7.tencent action=rejectadd chain=forward content=tcpconn8.tencent action=rejectadd chain=forward content=qq action=rejectadd chain=forward content=www.qq action=reject二十二：防止灰鸽子入浸/ ip firewall filteradd chain=forward protocol=tcp dst-port=1999 action=dropcomment="Backdoor.GrayBird.ad"add chain=forward dst-address=80.190.240.125 action=dropadd chain=forward dst-address=203.209.245.168 action=dropadd chain=forward dst-address=210.192.122.106 action=dropadd chain=forward dst-address=218.30.88.43 action=dropadd chain=forward dst-address=219.238.233.110 action=dropadd chain=forward dst-address=222.186.8.88 action=dropadd chain=forward dst-address=124.42.125.37 action=dropadd chain=forward dst-address=210.192.122.107 action=dropadd chain=forward dst-address=61.147.118.198 action=dropadd chain=forward dst-address=219.238.233.11 action=drop二十三：防三波/ ip firewall filteradd chain=forward protocol=tcp dst-port=135-139 action=drop comment="No 3B"================================================================================ ================================================================================ ==================================以上脚本使用说明：用winbox.exe 登陆找到 System -- Script - 点击+ 将对应脚本复制其中后，点击 Run Script即脚本一、导出 ARP 列表ip arp export file arp这样就能将所有ARP列表导出到 arp.rsc 文件。

ROS简单队列限速自己理解整理

ROS 简单队列限速
limit-at--------保证限速
max-limit------最大限速我们最常用的地方，最大速度
burst-limit--------突破速度的最大值（突破最大值）
burst-thershold--------突破速度的阀值（突破阀值）
burst-time-------突破速度的时间值（突破时间）
官方例子: limit-at=1M , max-limit=2M , burst-threshold=1500k , burst-limit=4M time =16s
例子解释：在突破时间（burst-time=16秒）范围内，速度如果低于突破阀值（burst-thershold=1500K）就允许超过最大限速达到突破最大值（max-limit=4M）;速度如果达到或高于突破阀值（burst-thershold=1500K）就不允许突发，限速在最大限速（max-limit =2M）
注：突破阀值（burst-thershold=1500K）在保证限速（imit-at=1M）和最大限速（max-limit =2M）之间。

可以优化解决大型网络游戏卡的ROS限速脚本

可以优化解决大型网络游戏卡的ROS限速脚本ros软路由一直是网吧用的比较多的软路由。

的确，ros防ddos攻击还是比较有用的。

网上有很多的ros软路由教程，今天这个算是ros限速脚本吧。

安装就不说了，大家可以参照网上很多的ros软路由教程来安装。

这个ros限速脚本事针对大型网络游戏卡而写的。

ip firewall mangleadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=no直接复制上面。

ROS命令大全

ROS通用脚本一：限速脚本:for wbsz from 1 to 254 do={/queue simple add name=(wbsz . $wbsz)dst-address=(192.168.0. . $wbsz) limit-at=1024K/1024K max-limit=1024K/1024K} 二：限制每台机最大线程数:for wbsz from 1 to 254 do={/ip firewall filter add chain=forwardsrc-address=(192.168.0. . $wbsz) protocol=tcp connection-limit=50,32action=drop}三：端口映射ip firewall nat add chain=dstnat dst-address=(202.96.134.134) protocol=tcp dst-port=80 to-addresses=(192.168.0.1) to-ports=80 action=dst-nat四：封端口号/ ip firewall filterad ch forward pr tcp dst-po 8000 act drop comment="Blockade QQ"五：更变telnet服务端口/ip service set telnet port=23六：更变SSH管理服务端口/ip service set ssh port=22七：更变www服务端口号/ip service set www port=80八：更变FTP服务端口号/ip service set ftp port=21十：删除限速脚本:for wbsz from 1 to 254 do={/queue simple remove (wbsz . $wbsz) }十一：封IP脚步本/ ip firewall filteradd chain=forward dst-address=58.60.13.38/32 action=drop comment="Blockade QQ" 十二：禁P2P脚本/ ip firewall filteradd chain=forward src-address=192.168.0.0/24 p2p=all-p2p action=drop comment="No P2P"十三：限制每台机最大的TCP线程数(线程数=60)/ ip firewall filteradd chain=forward protocol=tcp connection-limit=60,32 action=drop \disabled=no十四：一次性绑定所有在线机器MAC:foreach wbsz in=[/ip arp find dynamic=yes ] do=[/ip arp add copy-from=$wbsz] 十五：解除所以绑定的MAC:foreach wbsz in [/ip arp find] do={/ip arp remove $wbsz}十六：禁Ping/ ip firewall filteradd chain=output protocol=icmp action=drop comment="No Ping"十七：禁电驴/ ip firewall filteradd chain=forward protocol=tcp dst-port=4661-4662 action=drop comment="No Emule"add chain=forward protocol=tcp dst-port=4242 action=dropadd chain=forward dst-address=62.241.53.15 action=drop十八：禁PPLIVE/ ip firewall filteradd chain=forward protocol=tcp dst-port=8008 action=drop comment="No PPlive TV" add chain=forward protocol=udp dst-port=4004 action=dropadd chain=forward dst-address=218.108.237.11 action=drop十九：禁QQ直播/ ip firewall filteradd chain=forward protocol=udp dst-port=13000-14000 action=drop comment="No QQLive"二十：禁比特精灵/ ip firewall filteradd chain=forward protocol=tcp dst-port=16881 action=drop comment="No BitSpirit"二十一：禁QQ聊天(没事不要用)/ ip firewall filteradd chain=forward src-address=10.5.6.7/32 action=accept comment="No Tencent QQ" ad ch forward pr tcp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropadd chain=forward dst-address=61.144.238.0/24 action=dropadd chain=forward dst-address=61.152.100.0/24 action=dropadd chain=forward dst-address=61.141.194.0/24 action=dropadd chain=forward dst-address=202.96.170.163/32 action=dropadd chain=forward dst-address=202.104.129.0/24 action=dropadd chain=forward dst-address=202.104.193.20/32 action=dropadd chain=forward dst-address=202.104.193.11/32 action=dropadd chain=forward dst-address=202.104.193.12/32 action=dropadd chain=forward dst-address=218.17.209.23/32 action=dropadd chain=forward dst-address=218.18.95.153/32 action=dropadd chain=forward dst-address=218.18.95.165/32 action=dropadd chain=forward dst-address=218.18.95.220/32 action=dropadd chain=forward dst-address=218.85.138.70/32 action=dropadd chain=forward dst-address=219.133.38.0/24 action=dropadd chain=forward dst-address=219.133.49.0/24 action=dropadd chain=forward dst-address=220.133.40.0/24 action=dropadd chain=forward content=sz.tencent action=rejectadd chain=forward content=sz2.tencent action=rejectadd chain=forward content=sz3.tencent action=rejectadd chain=forward content=sz4.tencent action=rejectadd chain=forward content=sz5.tencent action=rejectadd chain=forward content=sz6.tencent action=rejectadd chain=forward content=sz7.tencent action=rejectadd chain=forward content=sz8.tencent action=rejecadd chain=forward content=sz9.tencent action=rejecadd chain=forward content=tcpconn.tencent action=rejectadd chain=forward content=tcpconn2.tencent action=rejectadd chain=forward content=tcpconn3.tencent action=rejectadd chain=forward content=tcpconn4.tencent action=rejectadd chain=forward content=tcpconn5.tencent action=rejectadd chain=forward content=tcpconn6.tencent action=rejectadd chain=forward content=tcpconn7.tencent action=rejectadd chain=forward content=tcpconn8.tencent action=rejectadd chain=forward content=qq action=rejectadd chain=forward content=www.qq action=reject二十二：防止灰鸽子入浸/ ip firewall filteradd chain=forward protocol=tcp dst-port=1999 action=dropcomment="Backdoor.GrayBird.ad"add chain=forward dst-address=80.190.240.125 action=dropadd chain=forward dst-address=203.209.245.168 action=dropadd chain=forward dst-address=210.192.122.106 action=dropadd chain=forward dst-address=218.30.88.43 action=dropadd chain=forward dst-address=219.238.233.110 action=dropadd chain=forward dst-address=222.186.8.88 action=dropadd chain=forward dst-address=124.42.125.37 action=dropadd chain=forward dst-address=210.192.122.107 action=dropadd chain=forward dst-address=61.147.118.198 action=dropadd chain=forward dst-address=219.238.233.11 action=drop二十三：防三波/ ip firewall filteradd chain=forward protocol=tcp dst-port=135-139 action=drop comment="No 3B"================================================================================ ================================================================================ ==================================以上脚本使用说明：用winbox.exe 登陆找到 System -- Script - 点击+ 将对应脚本复制其中后，点击 Run Script即脚本一、导出 ARP 列表ip arp export file arp这样就能将所有ARP列表导出到 arp.rsc 文件。

RouterOS限速更高层次运用

RouterOS限速更高层次运用一般我们用ros限速只是使用了max-limit，其实ros限速可以更好的运用。

比如我们希望客户打开网页时速度可以快一些，下载时速度可以慢一些。

ros2.9就可以实现。

看下图:max-limit------我们最常用的地方，最大速度burst-limit--------突破速度的最大值burst-thershold--------突破速度的阀值burst-time-------突破速度的时间值解释一下图片的限制意义当客户机在30秒（burst-time）内的平均值小于突破速度阀值（burst-thershold）1 80K时，客户机的最大下载速率可以超过最大限速值（max-limit）200K，达到突破最大值（burst-limit）400K，如果30秒内平均值大于180K，那客户机的最大速度只能达到200K。

这样也就是当我们开网页时可以得到一个更大的速度400K，长时间下载时速度只能得到200K，使我们的带宽可以更有效的如何限制速度应许多朋友的要求，这里把如何限制局域网内机器的速度发一下（特指限制外网连接速度）winbox---queues----simple queues点“+”，NAME里随便填，下面是IP地址的确定①Target Address 不管，Dst. Address里填你要限制的内网机器的IP，比如我这里有个 1号机器 IP为 192.168.1.101，那dst.address 里就填 192.168.1.101 然后是/32（这里的32不是指掩码了，个人理解为指定的意思）！②interface里记着要选你连接外网那个卡，我这里分了“local和public”，所以选public③ 其他的不管，我们来看最重要的东西拉，Max limit ，这个东西是你限制的上限，注意的是这里的数值是比特位，比如我要限制下载的速度为 500K 那么就填入多少呢？500 X 1000 X 8=400 0000=4M。

ROS 完美限制速度

Name(脚本名程)
Source(脚本)
OK-选择要运行的脚本-Run Script
ROS限速的极致应用
一般我们用ros限速只是使用了max-limit，其实ros限速可以更好的运用。比如我们希望
客户打开网页时速度可以快一些，下载时速度可以慢一些。ros2.9就可以实现。
max-limit------我们最常用的地方，最大速度
General-In. Interface all(如果你是拨号的就选择pppoe的、固定IP选择all即可）
Dst. Address:外网IP/32
Dst. Port:要映射的端口
Protocol:tcp(如果映射反恐的就用udp)
Action action:nat
TO Dst.Addresses:你的内网IP
$aaa)]}）
脚本名：node_off
脚本内容：（:for aaa from 1 to 254 do={/queue sim dis [find name=(ip_ .
$aaa)]}）
scripts（脚本部分）以完成
打开 /tools/traffic monitor
新建：
名：node_18M traffic=received trigger=above on event=node_on
2 to 254是2~254
192.168.0. . $aaa是IP
上两句加起来是192.168.0.2~192.168.0.254
connection-limit=50是线程数这里为50
max-limit=2000000/2000000是上行／下行
使用：
WinBox-System-Scripts-＋

ROS最正确的限速

ROS最正确的限速--------小包优先+带宽均分+简单队列限制上传速度注意：本文针对10M带宽做出的限速说明，请根据自己的实际带宽更改相应的限速设置================================= START ========================一、小包优先的脚本如下：/ip firewall mangleadd chain=forward p2p=all-p2p action=mark-connection new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet new-packet-mark=general passthrough=yes comment="" disabled=noadd chain=forward packet-size=32-512 action=mark-packet new-packet-mark=small passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packet new-packet-mark=big passthrough=yes comment="" disabled=no/ queue treeadd name="p2pW" parent=WAN packet-mark=p2p limit-at=400000 queue=default priority=8 max-limit=400000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="p2pL" parent=LAN packet-mark=p2p limit-at=400000 queue=default priority=8 max-limit=400000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="ClassA" parent=LAN packet-mark="" limit-at=0 queue=default priority=8 max-limit=100000000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="ClassB" parent=ClassA packet-mark="" limit-at=0 queue=default priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf1" parent=ClassA packet-mark=general limit-at=0 queue=default priority=7 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf2" parent=ClassB packet-mark=big limit-at=0 queue=default priority=6 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf3" parent=ClassB packet-mark=small limit-at=0 queue=default priority=5 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no二、然后是带宽均分：这个例子示范了如何将10Mbps下载2Mbps上传，均分给网络10.10.12.0/24中的活动的用户# 所有来自本地网络192.168.0.0/24的流，标记一个用户标记/ip firewall mangle add chain=forward src-address=192.168.10.0/24 \action=mark-connection new-connection-mark=users-con/ip firewall mangle add connection-mark=users-con action=mark-packet \new-packet-mark=users chain=forward# 添加两个新的PCQ类型。

ROS动态限速

ROS动态限速/ ip firewall mangle add chain=prerouting action=mark-packet new-packet-mark=all-mark passthrough=yes/ queue type add name="PCQ-up" kind=pcq pcq-rate=1000000 pcq-limit=50 pcq-classifier=src-address pcq-total-limit=2000/ queue type add name="PCQ-down" kind=pcq pcq-rate=1600000 pcq-limit=50 pcq-classifier=dst-address pcq-total-limit=2000/ queue tree add name="PCQdown" parent=wan queue=PCQ-down packet-mark=all-mark/ queue tree add name="PCQup" parent=wan queue=PCQ-up packet-mark=all-mark/ queue simpleadd name="PCQ0" target-addresses=192.168.0.0/24 dst-address=0.0.0.0/0 \interface=all parent=none packet-marks=all-mark direction=both priority=1 \queue=PCQ-up/PCQ-down limit-at=0/0 max-limit=100000000/100000000 \total-queue=default-small disabled=yes/ queue simpleadd name="PCQ1" target-addresses=192.168.1.0/24 dst-address=0.0.0.0/0 \interface=all parent=none packet-marks=all-markdirection=both priority=1 \queue=PCQ-up/PCQ-down limit-at=0/0 max-limit=100000000/100000000 \total-queue=default-small disabled=yes/ tool traffic-monitoradd name="PCQdownon" interface=wan traffic=received trigger=above threshold=40000000 on-event=enable1 comment="" disabled=noadd name="PCQdownoff" interface=wan traffic=received trigger=below threshold=5000000 on-event=disable1 comment="" disabled=no/ system scriptadd name="disable0" source=":if $\[ /queue simple get \[/queue simple find \name=\"PCQ0\"\] disable \]=false $ do={/queue simple disable PCQ0}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="disable1" source=":if $\[ /queue simple get \[/queue simple find \name=\"PCQ1\"\] disable \]=false $ do={/queue simple disable PCQ1}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="enable0" source=":if $\[ /queue simple get \[/queue simple find \name=\"PCQ0\"\] disable \]=true $ do={/queue simple enable PCQ0}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="enable1" source=":if $\[ /queue simple get \[/queue simple find \name=\"PCQ1\"\] disable \]=true $ do={/queue simple enable PCQ1}" \policy=ftp,reboot,read,write,policy,test,winbox,password。

ROS限速、防syn、ip伪装、mac绑定、防火墙、各种命令使用详解、屏蔽端口

ROS限速、防syn、ip伪装、mac绑定、防火墙、各种命令使用详解、屏蔽端口:foreach i in=[/system logging facility find local=memory ] do=[/system logging facility set $ilocal=none]RO防synip-firewall-connectionsTracking:TCP Syn Sent Timeout:50TCP syn received timeout:30限线程脚本：:for aaa from 2 to 254 do={/ip firewall filter add chain=forward src-address=(192.168.0. . $aaa) protocol=tcp connection-limit=50,32 action=drop}RO端口的屏蔽ip-firewall-Filer Rules里面选择forward的意思代表包的转发firewall rule-GeneralDst.Address:要屏蔽的端口Protocol:tcpAction:drop(丢弃）ros限速手动限速winbox---queues----simple queues点“+”，NAME里随便填，下面是IP地址的确定①Target Address 不管，Dst. Address里填你要限制的内网机器的IP，比如我这里有个1号机器IP为192.168.1.101，那dst.address 里就填192.168.1.101 然后是/32（这里的32不是指掩码了，个人理解为指定的意思）！②interface里记着要选你连接外网那个卡，我这里分了“local和public”，所以选public③其他的不管，我们来看最重要的东西拉，Max limit ，这个东西是你限制的上限，注意的是这里的数值是比特位，比如我要限制下载的速度为500K 那么就填入多少呢？500 X 1000 X 8=400 0000=4M。

ROS按时限速

ROS按时限速按时间限速在Queues 同一IP设两个限速规则，time设置不同的时间，到转换时间时，限速失效因此，转为在system Schedule里设置以19:00:00--第二天02:59:55为高峰时段，限速为512K以03:00:00--18:59:55为闲时，限速为1M2.9.27版适用(后面一条是没有运行突发限制的，暂用它吧)第一条规则是删除01-152机器的限速规则，运行时间为18:59:55 :for aaa from=1 to=152 do={queue simple remove(HT . $aaa)} 第二条规则是高峰时段限速，运行时间为19:00:00:for aaa from 1 to 152 do={/queue simple add name=(HT . $aaa) dst-address=(192.168.0. . $aaa) limit-at=512000/512000 interface=all max-limit=512000/512000 burst-limit=2000000/2000000 burst-threshold=1000000/1000000 burst-time=8s/8s}:for aaa from 1 to 152 do={/queue simple add name=(HT . $aaa) dst-address=(192.168.0. . $aaa) limit-at=512000/512000 interface=all max-limit=512000/512000}第三条规则是删除01-152机器的限速规则，运行时间为02:59:55 :for aaa from=1 to=152 do={queue simple remove(HT . $aaa)} 第四条规则是闲时段限速，运行时间为03:00:00:for aaa from 1 to 152 do={/queue simple add name=(HT . $aaa) dst-address=(192.168.0. . $aaa) limit-at=512000/512000 interface=all max-limit=1000000/1000000 burst-limit=2000000/2000000 burst-threshold=1500000/1500000 burst-time=8s/8s}:for aaa from 1 to 152 do={/queue simple add name=(HT .$aaa) dst-address=(192.168.0. . $aaa) limit-at=512000/512000 interface=all max-limit=1000000/1000000}3.0以上版本适用第一条规则是删除01-152机器的限速规则，运行时间为18:59:55 :for aaa from=1 to=152 do={queue simple remove ("HT" . $aaa)}第二条规则是高峰时段限速，运行时间为19:00:00:for aaa from=1 to=152 do={/queue simple add name=("HT" . $aaa) target-address=("192.168.0." . $aaa) limit-at=512000/512000 interface=all max-limit=512000/512000 burst-limit=2000000/2000000 burst-threshold=1000000/1000000 burst-time=3s/3s}:for aaa from=1 to=152 do={/queue simple add name=("HT" . $aaa) target-address=("192.168.0." . $aaa) limit-at=512000/512000 interface=all max-limit=800000/800000} 第三条规则是删除01-152机器的限速规则，运行时间为02:59:55 :for aaa from=1 to=152 do={queue simple remove ("HT" . $aaa)}第四条规则是闲时段限速，运行时间为03:00:00:for aaa from=1 to=152 do={/queue simple add name=("HT" . $aaa) target-address=("192.168.0." . $aaa) limit-at=512000/512000 interface=all max-limit=1000000/1000000 burst-limit=2000000/2000000 burst-threshold=1500000/1500000 burst-time=3s/3s}:for aaa from=1 to=152 do={/queue simple add name=("HT" . $aaa) target-address=("192.168.0." . $aaa) limit-at=512000/512000 interface=all max-limit=1000000/1000000}feb/28/2011 18:42:36 system,error,critical login failure for user boryce from 121.10.243.21 via sshfeb/28/2011 18:42:36 system,error,critical login failure for user root from 121.10.243.21 via sshmar/03/2011 16:02:54 system,error,critical login failure for u ser administrator from 192.168.0.142 via winboxmar/07/2011 16:35:46 system,error,critical login failure for u ser administrator from 192.168.0.142 via winboxmar/08/2011 10:32:20 system,error,critical router was rebootedwithout proper shutdownmar/08/2011 12:47:00 system,error,critical login failure for u ser administrator from 192.168.0.141 via winboxmar/11/2011 14:31:22 system,error,critical login failure for u ser test from 192.168.0.142 via winboxmar/21/2011 20:44:45 system,error,critical router was rebootedwithout proper shutdown路由器每秒种都在计算前一时间段（burst-time）的平均速率。

ros帐号限速

authentication=pap,chap,mschap1,mschap2 keepalive-timeout=10
one-session-per-host=yes max-sessions=0
defaultdefault-profile=default-encryption
[admin@MikroTik] /interface PPPoE-server server> enable 0
authentication=pap,chap,mschap1,mschap2 keepalive-timeout=10
one-session-per-host=yesmax-sessions=0
defaultdefault-profile=default-encryption
解释一下相关参数：
interface指定内网网卡，提供PPPoE服务器的网卡接口，max-mtu和max-mru最大传输单元和最大接收单元，如果有发现部分网站无法访问时，可以把这个参数修改小些，如1460等，one-session-per-host是否限制主机同一时刻的会话数，基于物理地址来限制，如果是yes，则表明新会话建立时，旧的会话会断开，与参数keepalive-timeout一起使用：“The default keepalive-timeout value of 10 is OK in most cases. If you set it to 0, the router will not disconnect clients until they explicitly log out or the router is restarted. To resolve this problem, the one-session-per-host property can be used”

[转载]ROS中在透明模式环境下的流量限速方法

接下来，下面的实验使用的是RouterOS 4.9 L6的版本：
上述左边的图为原网络环境，原网络环境中，PC机的网关为路由器的接口地址：192.168.1.1。上述右边的图为：在交换机和路由器之间，断开原来的线路，将交换机与ROS的LAN口相连，路由器与ROS的WAN口相连。通过这样的连接后，就需要在ROS中做具体的设置了！
1、为了能够让所有的数据正常穿越ROS，我们需要设置桥接功能： name="Bridge" mtu=1500 l2mtu=65535 arp=enabled protocol-mode=none priority=0x8000 auto-mac=yes adminmac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6 ageing-time=5m
3、配置一个管理地址，方便以后进行登陆管理： address=192.168.1.2/24 network=192.168.1.0 broadcast=192.168.1.255 interface=Bridge actual-interface=Bridge
4、指定对某一个(或多个地址)IP的限速，如对192.168.1.69这个IP进行限速上行1M，下行2M： name="胡双全" target-addresses=192.168.1.69/32 dst-address=0.0.0.0/0 interface=all parent=none direction=both priority=8 queue=default-small/default-small limit-at=0/0 max-limit=1M/2M burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s totalqueue=default-small

技巧教你如何用ROS限制土豆优酷等在线视频网站速度

技巧教你如何用ROS限制土豆优酷等在线视频网站速度本人的网吧带宽紧张，偏偏碰上一些喜欢优酷，土豆的爷们，一到高峰期飞速土豆就显示出它的威力了。

汗。

为了更好的调节网吧的带宽，现在我向大家展示一下，如何在ROS里限制特定类型的传输速度。

第一步：我们明白其实土豆和优酷网上传播的都是FLV格式的视频。

OK，找到了这个规律就很好办事了。

在ROS的防火墙MANGLE里，有一个mark connection的功能，很显然，从字面上就能理解为“标记链接”它的功能就是让符合条件的链接都打上自己定义好的标记。

我们利用的就是这个功能，将所有链接为FLV格式的全部做标记为“flv”。

脚本如下/ip firewall mangleadd action=mark-connection chain=forward comment="" content=.flv disabled=no \\new-connection-mark=flv passthrough=yes src-address=10.128.7.0/24第二步：光标记的链接还没有用，我们还要对这个链接的数据包打上标记，让我们的路由知道哪些包是FLV格式的。

这就要使用到mark packet了，字面是理解，就是“标记包”，我们将所有被打上了"flv"标记的链接的数据包全部标上"flv2"脚本如下/ip firewall mangleadd action=mark-packet chain=forward comment=""connection-mark=flv disabled=\\no new-packet-mark=flv2 passthrough=yes src-address=10.128.7.0/24第三步：好了，我们已经找到所有需要的数据包了，现在就是对他们进行限速了，我们很自然的想到了QUEUE。