國華的Blog 2010 (電腦相關)

國華的Blog

// ==UserScript==
// @author mungushume
// @version 1.7.3.1
// @name GoogleMonkeyR

第681行

if(this.numColumns>1)
{
style += ("#cnt.singleton #center_col, #cnt.singleton #foot, .mw {margin-left:0 !important;}");
}

增修改

if(this.numColumns>1)
{
style += ("#cnt.singleton #center_col, #cnt.singleton #foot, .mw {margin-left:0 !important;}");
}
style += ("div.col {width: 100% !important;}");

info
https://greasyfork.org/en/forum/discussion/10487/googlemonkeyr-broken-again#latest

fix.
20190718
https://greasyfork.org/zh-TW/scripts/378527-googlemonkeyr-modified-by-rampagex

使用這個外掛

GoogleMonkeyR (modified by rampageX)

版本

1.7.3.22

國華的Blog

# create script to Download fresh list and replace old one
/system script add name="Download_Ads_List" source="/tool fetch url=\"https://blocklister.gefoo.org/ads" dst-path=ads.rsc; /import file-name=ads.rsc;"

# create schedule to run script weekly
/system scheduler add comment="Download_Ads_List" interval=7d name="DownloadAdsList" on-event=Download_Ads_List start-date=jan/01/1970 start-time=02:42:00

# add firewall rule once
/ip firewall filter add chain=forward in-interface=bridge-local connection-state=new protocol=tcp dst-address-list=ads_list action=reject reject-with=tcp-reset comment="Ad-block list drop"

info

https://www.reddit.com/r/mikrotik/comments/3jf830/selfupdating_adblocker_script/

https://blocklister.gefoo.org/

組合技

最重要是紅色 get block lister .

/system script
add name=script1 owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon sourc
\_firewall filter\r\
\nadd action=drop chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g
1 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" disabled=no dst-port=21,22,23,
rotocol=tcp src-address-list=login_error_ip\r\
\nadd action=add-src-to-address-list address-list=login_error_ip addre
t-timeout=1d chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g\\A2h
2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disabled=no ds
=21,22,23,8291 protocol=tcp \\\r\
\n src-address-list=ros_service_login5\r\
\nadd action=add-src-to-address-list address-list=ros_service_login5 a
-list-timeout=1d30s chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A
h 3 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disable
st-port=21,22,23,8291 \\\r\
\n protocol=tcp src-address-list=ros_service_login4\r\
\nadd action=add-src-to-address-list address-list=ros_service_login4 a
-list-timeout=30s chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g
4 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disabled=
-port=21,22,23,8291 protocol=\\\r\
\n tcp src-address-list=ros_service_login3\r\
\nadd action=add-src-to-address-list address-list=ros_service_login3 a
-list-timeout=30s chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g
5 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disabled=
-port=21,22,23,8291 protocol=\\\r\
\n tcp src-address-list=ros_service_login2\r\
\nadd action=add-src-to-address-list address-list=ros_service_login2 a
-list-timeout=30s chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g
6 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disabled=
-port=21,22,23,8291 protocol=\\\r\
\n tcp src-address-list=ros_service_login1\r\
\nadd action=add-src-to-address-list address-list=ros_service_login1 a
-list-timeout=30s chain=input comment=\"\\A2b\\A2c\\A2d\\A2e\\A2f\\A2g
7 \\A2h\\A2g\\A2f\\A2e\\A2d\\A2c\\A2b\" connection-state=new disabled=
-port=21,22,23,8291 protocol=\\\r\
\n tcp src-address-list=!Lan_ip\r\
\n\r\
\n/ip firewall address-list\r\
\nadd address=172.16.0.0/12 disabled=no list=Lan_ip\r\
\nadd address=192.168.0.0/16 disabled=no list=Lan_ip\r\
\nadd address=10.0.0.0/8 disabled=no list=Lan_ip"
add name=Blocklister_download_Ads owner=admin policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon sourc
ol fetch url=\"https://blocklister.gefoo.org/ads\" dst-path=\"ads.rsc\
ort file-name=\"ads.rsc\";

另一個

增加時間自動更新

/system scheduler
add comment=Download_Ads_List interval=1w name=Blocklister_download_Ads \
on-event=Blocklister_download_Ads policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \

start-date=jan/01/1970 start-time=02:42:00

必須配合
ip
Filter Roules
設定使用 AD-BLOCK 只有抓下來沒有用就是沒用

add action=reject chain=forward comment="Ad-block list drop" connection-state=\
new dst-address-list=ads_list in-interface=bridge log=yes protocol=tcp \

reject-with=tcp-reset

add info
20180412
https://paul.is-a-geek.org/2018/02/dns-based-adblock-using-mikrotik-routeros/

-------------

20180518

blocklister 網站已經無法抓 ads 所以上述都失效

目前做法
抓
https://paul.is-a-geek.org/wp-content/uploads/2018/02/mikrotik_adblock.zip
解出檔案
mikrotik_adblock.rsc

使用到 Files 將mikrotik_adblock.rsc 傳上去
開New Terminal ( 也許重開機會自己跑，但我在這是直接套 run )
file
/import file-name=ads.rsc

套用後，在Firewall > address lists 會看到一大串

已經加入

套入使用

# add firewall rule once

/ip firewall filter add chain=forward in-interface=bridge1 connection-state=new protocol=tcp dst-address-list=ads_list action=reject reject-with=tcp-reset comment="Ad-block list drop"

並將條例加到前面

即可

維護
自己使用Ultra Edit 加入再匯入只能這樣了
不然就看誰要開網站

國華的Blog

http://forum.mikrotik.com/viewtopic.php?t=31994

設定black list
並在rules上設定一條即可

==
Use IP address list.
Create a list, e.g. 'blacklist' and put as few or as many IP addresses and CIDR blocks in the list as you need to block.
e.g.

Code: Select all

/ip firewall address-list
add list=blacklist address=1.1.1.1
add list=blacklist address=2.2.2.2
add list=blacklist address=3.3.0.0/16
...

Then you can use this list in any rule in any chain of any table of the firewall.
It's especially helpful because without the address list, if you have nat rules and filter rules and masquerade rules all having to do with the same set of addresses, if you add or remove any addresses from the set, then you'd have to go update all of your chains. If all of the chains refer to the same address list, changing the address list immediately affects all of the rules which refer to it.

You match an address list in your rules by using the criteria: src-address-list=blacklist or dst-address-list=blacklist
In Winbox / Webfig, the address list matchers are in the 'advanced' tab.

So for instance, to accomplish what the original poster asked, you would add the offending IP address to the blacklist and have a rule in the input chain:
/ip firewall filter add chain=input src-address-list=blacklist action=drop

I rarely use the output chain in Mikrotiks, but this is one place I will do it:
/ip firewall filter add chain=output dst-address-list=blacklist action=drop

However, this firewall 'mode' is not the best for a secure filter. It allows everything except specific exceptions. (blocked hosts) which you must manually detect and react to. (You can make firewall rules that automatically detect port scans and brute force attempts on telnet / ssh and add the sources to blacklists but that's beyond the scope of this post)

It's better to make your Mikrotik drop all input traffic on the WAN interface that it didn't request (e.g. ping replies, dns replies, http replies, etc). Suppose ether1 is the WAN interface:
/ip firewall filter add chain=input in-interface=ether1 connection-state=!established,related action=drop
One rule blocks the Internet from being able to initiate any interaction with your mikrotik at all. No blacklist is required.

===

國華的Blog

建議，對外的 www 改非80 . 或是關閉

ssh and telnet 比較麻煩

或是參考

2015年11月24日星期二

routeros 防止外部一直測試網路

國華的Blog

/ip firewall filter
chain=input in-interface= src-address=0.0.0.0/0 protocol=tcp dst-port=8080 action=drop

進來的所有 ip 到 port 8080 tcp 全部丟棄

add 還要加

In. Interface "WAN"

不然內部proxy會無法使用

即封掉全部的 8080 但要封的是訪問 wan 8080 port 的部份

國華的Blog

routeros 防止一直tray

/ip firewall filter
add action=drop chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 1 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" disabled=no dst-port=21,22,23,8291 protocol=tcp src-address-list=login_error_ip
add action=add-src-to-address-list address-list=login_error_ip address-list-timeout=1d chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 2 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 protocol=tcp \
src-address-list=ros_service_login5
add action=add-src-to-address-list address-list=ros_service_login5 address-list-timeout=1d30s chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 3 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 \
protocol=tcp src-address-list=ros_service_login4
add action=add-src-to-address-list address-list=ros_service_login4 address-list-timeout=30s chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 4 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 protocol=\
tcp src-address-list=ros_service_login3
add action=add-src-to-address-list address-list=ros_service_login3 address-list-timeout=30s chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 5 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 protocol=\
tcp src-address-list=ros_service_login2
add action=add-src-to-address-list address-list=ros_service_login2 address-list-timeout=30s chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 6 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 protocol=\
tcp src-address-list=ros_service_login1
add action=add-src-to-address-list address-list=ros_service_login1 address-list-timeout=30s chain=input comment="\A2b\A2c\A2d\A2e\A2f\A2g\A2h 7 \A2h\A2g\A2f\A2e\A2d\A2c\A2b" connection-state=new disabled=no dst-port=21,22,23,8291 protocol=\
tcp src-address-list=!Lan_ip

/ip firewall address-list
add address=172.16.0.0/12 disabled=no list=Lan_ip
add address=192.168.0.0/16 disabled=no list=Lan_ip
add address=10.0.0.0/8 disabled=no list=Lan_ip

source: http://sg.ros.tw/wp/?p=148

2015. 11.30 加注
以上如果有設定，要放在前面，
和 rputeros proxy 防護的部份放後面

目前這組效率相對好

國華的Blog

如何透過FunTime找到最便宜機票… 超級簡單! 你可以用以下 2 種方式1. 搜尋FunTime機票比價 http://www.funtime.com.tw/oveticket/選擇你想要飛往的目的地進行比價，票價資訊、未稅價、稅金、總價標示一目了然，和哪一家旅行社買最便宜又划算，馬上就知道了! 喜歡的話，點選訂購即可向該旅行社購買 :)2. 便宜機票價格追蹤 http://www.funtime.com.tw/oveticket/

比價背包客棧
http://www.backpackers.com.tw/forum/airfare.php'

星期二、三
4.7.9.10 月四月最少
全套機票
註冊航空公司會員

國華的Blog 2010 (電腦相關)

2016年7月18日星期一

GoogleMonkeyR 版本1.7.3.22

GoogleMonkeyR (modified by rampageX)

2016年7月2日星期六

讓routeros 具有adblock 功能

2015年11月30日星期一

routeros 設定黑名單 ip

routeros 服務port

2015年11月24日星期二

routeros 防止外部一直測試網路

有設定 web proxy 須要加強設定的部份

2015年11月24日星期二

routeros 防止外部一直測試網路

2015年11月17日星期二

買飛機票最便宜

標籤

我的網誌清單

Picasa Web Album

關於我自己

== 網站 ==

網誌存檔

2016年7月18日 星期一

GoogleMonkeyR (modified by rampageX)

2016年7月2日 星期六

2015年11月30日 星期一

2015年11月24日 星期二

2015年11月24日 星期二

2015年11月17日 星期二

標籤

訂閱

我的網誌清單

Picasa Web Album

關於我自己

== 網 站 ==

網誌存檔

2016年7月18日星期一

2016年7月2日星期六

2015年11月30日星期一

2015年11月24日星期二

2015年11月24日星期二

2015年11月17日星期二

== 網站 ==