No nepletiem si to s DHCP, ma to spolocne to ked sa zapne DHCP a astatic-only,staticke lease. No sak ak mozes tak mi to prosimta ukaz
tu je moj firewall,teda kusok :
/ ip firewall filter
add chain=input connection-state=established action=accept comment="accept \
established connection packets" disabled=no
add chain=input connection-state=related action=accept comment="accept related \
connection packets" disabled=no
add chain=input connection-state=invalid action=drop comment="drop invalid packets" \
disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and drop port \
scan connections" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
action=tarpit comment="suppress DoS attack" disabled=no
add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list \
address-list=black_list address-list-timeout=1d comment="detect DoS attack" \
disabled=no
add chain=input dst-address-type=!local action=drop comment="drop all that is not to \
local" disabled=yes
add chain=input src-address-type=!unicast action=drop comment="drop all that is not \
from unicast" disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to chain \
ICMP" disabled=no
add chain=input action=jump jump-target=services comment="jump to chain services" \
disabled=no
add chain=input action=log log-prefix="input" comment="" disabled=yes
add chain=input action=drop comment="drop everything else" disabled=yes
add chain=ICMP protocol=icmp icmp-options=0-255 limit=5,5 action=accept \
comment="0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3 limit=5,5 action=accept comment="3 \
and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3 limit=5,5 action=accept comment="3 \
and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=8-255 limit=5,5 action=accept \
comment="8 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=11-255 limit=5,5 action=accept \
comment="11 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp action=drop comment="Drop everything else" disabled=no
add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept \
comment="accept localhost" disabled=no
add chain=services protocol=tcp dst-port=20-21 action=accept comment="allow ftp" \
disabled=yes
add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, ssh" \
disabled=yes
add chain=services protocol=tcp dst-port=23 action=accept comment="allow telnet" \
disabled=no
add chain=services protocol=tcp dst-port=8088 action=accept comment="allow http, \
webbox" disabled=no
add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow winbox" \
disabled=no
add chain=services protocol=udp dst-port=20561 action=accept comment="allow \
MACwinbox " disabled=no
add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth \
server" disabled=yes
add chain=services protocol=udp dst-port=5678 action=accept comment=" MT Discovery \
Protocol" disabled=no
add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS \
request" disabled=no
add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS \
request" disabled=no
add chain=services protocol=udp dst-port=1701 action=accept comment="allow L2TP" \
disabled=yes
add chain=services protocol=tcp dst-port=1723 action=accept comment="allow PPTP" \
disabled=yes
add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" \
disabled=yes
add chain=services protocol=ipencap action=accept comment="allow IPIP" disabled=yes
add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" \
disabled=no
add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" \
disabled=no
add chain=services protocol=udp dst-port=67-68 action=accept comment="allow DHCP" \
disabled=no
add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web \
Proxy" disabled=yes
add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" \
disabled=no
add chain=services protocol=tcp dst-port=161 action=accept comment="allow SNMP" \
disabled=yes
add chain=services protocol=tcp dst-port=443 action=accept comment="allow https for \
Hotspot" disabled=yes
add chain=services protocol=tcp dst-port=1080 action=accept comment="allow Socks for \
Hotspot" disabled=yes
add chain=services protocol=udp dst-port=500 action=accept comment="allow IPSec \
connections" disabled=no
add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" \
disabled=no
add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" disabled=no
add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" \
disabled=yes
add chain=services protocol=udp dst-port=520-521 action=accept comment="allow RIP" \
disabled=yes
add chain=services protocol=ospf action=accept comment="allow OSPF" disabled=yes
add chain=services protocol=udp dst-port=5000-5100 action=accept comment="allow BGP" \
disabled=yes
add chain=services protocol=tcp dst-port=1720 action=accept comment="allow \
Telephony" disabled=yes
add chain=services protocol=udp dst-port=1719 action=accept comment="allow \
Telephony" disabled=yes
add chain=services protocol=vrrp action=accept comment="allow VRRP " disabled=yes
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop Blaster \
Worm" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop Messenger \
Worm" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster Worm" \
disabled=no
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="________" disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \
disabled=no
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \
disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \
disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" disabled=no
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \
disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \
disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop Beagle.C-K" \
disabled=no
add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \
OptixPro" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \
disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \
disabled=no
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop Dabber.A-B" \
disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop Dumaru.Y" \
disabled=no
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop MyDoom.B" \
disabled=no
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \
disabled=no
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \
disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop SubSeven" \
disabled=no
add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \
Gaobot" disabled=no
add chain=forward connection-state=established action=accept comment="accept \
established packets" disabled=no
add chain=forward connection-state=related action=accept comment="accept related \
packets" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid \
packets" disabled=no
add chain=forward src-address-type=!unicast action=drop comment="drop all that is \
not from unicast" disabled=yes
add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to chain \
ICMP" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to virus chain" \
disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.244 \
src-mac-address=00 action=accept comment="IP Mac pristup" \
disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.245 \
src-mac-address=00 action=accept comment="" disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.246 \
src-mac-address=00 action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.247 src-mac-address=00 \
action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.249 action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.251 src-mac-address=00 \
action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.0/24 action=add-src-to-address-list \
address-list=blacklist address-list-timeout=1d comment="block all" disabled=no
add chain=forward src-address-list=blacklist action=drop comment="" disabled=no
add chain=forward action=accept comment="Accept everything else" disabled=no
add chain=output connection-state=invalid action=drop comment="drop invalid packets" \
disabled=no
add chain=output connection-state=related action=accept comment="accept related \
packets" disabled=no
add chain=output connection-state=established action=accept comment="accept \
establised packets" disabled=no
add chain=output connection-state=established action=accept comment="accept established packets" disabled=no