Dynamic address‑list yaratish va telnet trafikini bloklash

RouterOS‑da IP manzillarni guruhlash va ularga asoslangan filterlar yaratish ko‘p hollarda xavfsizlikni mustahkamlaydi. Ayniqsa, telnet (port 23) kabi eski protokollarni vaqtinchalik bloklash foydali. Ushbu qo‘llanma static va dinamik address‑list yaratish hamda ularni filter bilan birlashtirishni ko‘rsatadi.

00Talablar

• RouterOS terminaliga admin huquqi bilan kirish
• Firewall funksiyalari yoqilgan MikroTik router

01Sozlash bosqichlari

1. Statik address‑list qo‘shish

Statik entry qo‘shish uchun quyidagi buyruqni bajarish kifoya. Bu buyruq list=drop_traffic nomli address‑listga 192.0.34.166/32 manzilini qo‘shadi.

/ip firewall address-list add list=drop_traffic address=192.0.34.166/32

2. Address‑listni tekshirish

Address‑listni ko‘rish uchun print buyrug‘ini ishlating. Natijada static yozuv ko‘rinadi.

/ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST         ADDRESS
 0   drop_traffic 192.0.34.166

3. Telnet trafikini dinamik ro‘yxatga qo‘shish

Telnet (port 23) trafikini dinamik ro‘yxatga qo‘shish uchun mangle qoidasi va keyin filter qoidasini yaratamiz. Mangle action=add-src-to-address-list bilan manbani drop_traffic ro‘yxatiga 5 min timeout bilan qo‘shadi, filter esa shu ro‘yxatdan kelgan paketlarni rad etadi.

/ip firewall mangle add action=add-src-to-address-list address-list=drop_traffic address-list-timeout=5m chain=prerouting dst-port=23 protocol=tcp
/ip firewall filter add action=drop chain=input src-address-list=drop_traffic

4. Dinamik ro‘yxatni tasdiqlash

Dinamik yozuvlar qo‘shilgandan keyin address‑listni yana bir bor print qilib ko‘rish. Dinamik yozuvlar D bayrog‘i bilan belgilanadi.

/ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST         ADDRESS
 0   drop_traffic 192.0.34.166
 1 D drop_traffic 1.1.1.1
 2 D drop_traffic 10.5.11.8

02Tekshirish

Print buyrug‘i natijasida ro‘yxatda static va dinamik yozuvlar ko‘rinadi.

/ip firewall address-list print
Flags: X - disabled, D - dynamic
 #   LIST         ADDRESS
 0   drop_traffic 192.0.34.166
 1 D drop_traffic 1.1.1.1
 2 D drop_traffic 10.5.11.8

03Muammolar va yechimlar

Dinamik yozuvlar ko‘rinmayapti

Telnet sessiyasini routerga yo‘naltiring yoki mangle qoidasining chain va port parametrlarini tekshiring.

04Xulosa

Static va dinamik address‑listlar yordamida telnet trafikini vaqtinchalik bloklash oson. Bu usul boshqa protokollar uchun ham moslashtirilishi mumkin.