ROS教程及一些防火墙规则和IP限速脚本

ros2.96秋风破解版安装教程（修正版）昨天晚上做的教程，因为半夜思路不清晰，做出了一个错误的垃圾教程~首先向下载过教程的朋友道歉~ 这次经过测试给大家重新做个教程~也是刚才到网盟看了一下~贴子还浮在上面~不能对不起大家，所以，不能误导大家，还是乖乖的重新做一个吧~废话少说了~先把需要的软件和部分策略说一下。

ROS2.96秋风破解版下载（网吧电信光纤，大家手下留情！）网通路由表、防火墙策略、自动切换脚本。

（绿字的教程附带，蓝字的请自己下载。

）接下来是说下具体步骤~这样思路会明确一些~1。

安装ROS系统，并选择所有服务。

硬盘接到IDE1，光驱接到IDE0。

BIOS里设置光驱引导系统,我拿虚拟机做演示，顺便虚拟机的使用大家也看下吧！需要安装的服务，全部选择即可。

全选输入A，同意选择输入I，回车，询问你：注意啦，所有数据（功能），都要被安装（选择的），是否继续，输入Y即可。

它又询问，是否保存旧配置，输入N。

接下来开始创建分区，格式化硬盘，安装服务。

提示软件安装完成，按回车重起。

这里多说一句，虚拟机如果安装完ROS后，会自动从硬盘启动，但是真实的计算机，就还是在光驱启动，所以这时候大家该把光盘拿出来了，BIOS里改为硬盘启动，ROS就会独立启动了。

启动后又问了，是否检测硬盘。

通常不必检测了，因为耽误时间。

默认他自动选N。

我们也可以直接输入N的。

他自动选了。

呵呵~2。

登陆ROS，修改网卡名字、填写另外两块网卡的IP信息。

ROS启动好后，在ROS主机上输入账号admin密码为空。

回车。

输入命令/int pri 查看系统检测到几块网卡~电信+网通双线切换路由，当然应该是3块网卡，如果少了，请自行检查问题所在！输入命令/ip address （设置IP命令）输入命令add address=192.168.0.1/24 interface=ether1 设置路由IP，也就是网关~（内网的网关地址）（内网网卡）通常是靠近CPU的为内网网卡，也就是ether1好了，网关设置好了，那我们登陆http://192.168.0.1来下载Winbox刚才我安装过一次，有遗留信息的。

PPPOE全自动智能限速脚本PPPOE全自动智能限速脚本#首先建一个脚本A，然后放到计划里执行。

内容如下######################################################################:local RxCurPacket 0:local RxCurAddress 0:local RxCurUser 0:local RxCurRate 0:local TxCurRate 0:local RxMaxRate 450000:local TxMaxRate 800000:local RxCurMax 400:local RxCurMaxb 200:foreach i in=[/interface find mtu=1480] do={/interface monitor $i once do={:set RxCurPacket ($received-packets-per-second+$sent-packets-per-second); :set RxCurRate ($received-bits-per-second); :set TxCurRate ($sent-bits-per-second); :set RxCurAddress [/ppp active get $i address]; :set RxCurUser [/ppp active get $i name]};:if($RxCurMax<$RxCurPacket) do={/ip firewall nat add chain=dstnat src-address=$RxCurAddress action=dst-nat to-addresses=192.168.0.25 to-ports=80 comment=$RxCurUser}; :if($RxCurMaxb<$RxCurPacket) do={/queue simple add name=$RxCurUser target-addresses=$RxCurAddress limit-at=0/0 max-limit=50000/250000 burst-limit=80000/500000 burst-threshold=70000/400000 burst-time=5/10}; :if($RxMaxRate<$RxCurRate) do={/queue simple add name=$RxCurUser target-addresses=$RxCurAddress limit-at=0/0 max-limit=50000/250000 burst-limit=80000/500000 burst-threshold=70000/400000 burst-time=5/10}; :if($TxMaxRate<$TxCurRate) do={/queue simple add name=$RxCurUser target-addresses=$RxCurAddress limit-at=0/0 max-limit=50000/250000 burst-limit=80000/500000 burst-threshold=70000/400000 burst-time=5/10}}:for aa from 1 to 200 do={/queue simple remove (queue . $aa)}############################################################################说明：我的环境是光纤50M 用户在200，所以分给每个人的速度还是比较大的。

ROS软路由防火墙配置规则Routeros防火墙功能非常灵活。

routeros防火墙属于包过滤防火墙，你可以定义一系列的规则过滤掉发往routeros、从routeros发出、通过routeros转发的数据包。

在routeros防火墙中定义了三个防火墙（过滤）链（即input、forward、output），你可以在这三个链当中定义你自己的规则。

input意思是指发往routeros自己的数据（也就是目的ip是routeros接口中的一个ip地址）；output意思是指从routeros发出去的数据（也就是数据包源ip是routeros接口中的一个ip地址）；forward意思是指通过routeros转发的（比如你内部计算机访问外部网络，数据需要通过你的routeros进行转发出去）。

禁止ping routeros，我们一般需要在input链中添加规则，因为数据包是发给routeros 的，数据包的目标ip是routeros的一个接口ip地址。

（当然如果你硬是要在output里建立一条规则过滤掉icmp信息也能做到ping不通，当你ping的数据包到达routeos时，routeos能接收这个数据包并做出回应，当routeros回应给你的包要发出去的时候会检查output的规则并过滤掉回应你的包。

）在每条链中的每条规则都有目标ip，源ip，进入的接口（in interface），非常灵活的去建立规则。

比如ROS禁止PING，禁止外网ping你routeros，只需要在in interface中选择你连外部网络的接口。

禁止内部ping的话可以选择连你内部网络的接口。

如果禁止所有的ping 的话，那么接口选择all。

当然禁止ping 协议要选择icmp ，action选择drop或reject。

另外要注意的就是，icmp协议并不是就指的是ping，而是ping是使用icmp协议中的一种（我们ping 出去发送的数据包icmp协议的类型为8 代码为0，在routeros中写为icmp-options=8：0；而我们对ping做出回应icmp类型为0 代码为0），还有很多东西也属于icmp协议。

网吧用ROS最正确的限速网吧用简单队列做限速完全是扯蛋。

网吧限速最好的办法应该是带宽均分，然后在用简单队列来限制上传。

在利用小包优先来处理游戏卡的问题。

经过2个网吧，一个月的测试，完全摆脱了到处喊卡的噩梦，现在把经验发来大家分享一下。

ROS不要用简单队列来限速，什么智能动态限速也不要用。

只需要用小包优先+带宽均分+简单队列限制上传速度。

小包优先的脚本如下：1./ ip firewall mangle2.add chain=forward protocol=tcp tcp-flags=syn action=change-mss new-mss=1440 comment="" disabled=no3.add chain=forward p2p=all-p2p action=mark-connection new-connection-mark=p2p_conn passthrough=yes comment="" disabled=no4.add chain=forward connection-mark=p2p_conn action=mark-packet new-packet-mark=p2p passthrough=yes comment="" disabled=no5.add chain=forward connection-mark=!p2p_conn action=mark-packet new-packet-mark=general passthrough=yes comment=""6.7.disabled=no8.add chain=forward packet-size=32-512 action=mark-packet new-packet-mark=all passthrough=yes comment="" disabled=no9.add chain=forward packet-size=512-1200 action=mark-packet new-packet-mark=big passthrough=yes comment=""disabled=no10.11.12./ queue tree13.add name="p2p1" parent=wan packet-mark=p2p limit-at=2000000 queue=default priority=8 max-limit=6000000 burst-limit=014.15.burst-threshold=0 burst-time=0s disabled=no16.add name="p2p2" parent=lan packet-mark=p2p limit-at=2000000 queue=default priority=8 max-limit=6000000 burst-limit=017.18.burst-threshold=0 burst-time=0s disabled=no19.add name="ClassA" parent=lan packet-mark="" limit-at=0 queue=default priority=8 max-limit=100000000 burst-limit=0 burst-20.21.threshold=0 burst-time=0s disabled=no22.add name="ClassB" parent=ClassA packet-mark="" limit-at=0 queue=default priority=8 max-limit=0 burst-limit=0 burst-23.24.threshold=0 burst-time=0s disabled=no25.add name="Leaf1" parent=ClassA packet-mark=general limit-at=0 queue=default priority=7 max-limit=0 burst-limit=0 burst-26.27.threshold=0 burst-time=0s disabled=no28.add name="Leaf2" parent=ClassB packet-mark=alllimit-at=0 queue=default priority=5 max-limit=0 burst-limit=0 burst-29.30.threshold=0 burst-time=0s disabled=no31.add name="Leaf3" parent=ClassB packet-mark=big limit-at=0 queue=default priority=6 max-limit=0 burst-limit=0 burst-32.33.threshold=0 burst-time=0s disabled=no复制代码然后是带宽均分：1./ ip firewall mangle add chain=forward src-address=192.168.0.0/24 \2.action=mark-connection new-connection-mark=users-con3./ip firewall mangle add connection-mark=users-con action=mark-packet \4.new-packet-mark=users chain=forward5./queue type add name=pcq-download kind=pcq pcq-classifier=dst-address6./queue type add name=pcq-upload kind=pcq pcq-classifier=src-address7./queue tree add name=Download parent=lan max-limit=10M8./queue tree add parent=Download queue=pcq-download packet-mark=users9./queue tree add name=Upload parent=wan max-limit=9M10./queue tree add parent=Upload queue=pcq-upload packet-mark=users复制代码请根据直接实际修改IP地址段，下载最大速度，上传最大速度,lan为我连接内网的网卡，wan是我连接外网的网卡限制上传速度的脚本：1.:for aaa from 5 to 253 do={/queue simple add name=(yp . $aaa) dst-address=(192.168.0. . $aaa) limit-at=10000000/30000002.3.max-limit=10000000/3000000}复制代码如果是3.2版本的，这个脚本自己要修改下，就用这3个部分，别的不需要的，绝对比什么智能动态限速好的多.。

192.168.0.250
封迅雷只要封住tcp3076和3077
封vagaa
/ ip firewall filter
add chain=forwaent="No VaGaa"
add chain=forward content= action=reject
限速脚本：（KB后面是5个0，MB是6个0）
真正限速脚本为 下载640KB，上传512KB (dst)
:for szwm from 1 to 100 do={/queue ** add name=(sy . $szwm) dst-address=(192.168.0. . $szwm) max-limit=640000/512000 interface=all disabled=no}
640000 就是 640KB（后面有3个0），这样运行完脚本 ，
ROS2.927会自动 除以8 换算出实际 下载是 80KB 上传64KB。
就是你要限制300K 就是300*8=2400+后面加三个0=2400000（脚本的地方就要写这个）
如何封闭某一IP或网站或端口
1、封IP
/ ip firewall filter add chain=forward dst-address=127.0.0.1(请把这里换为你想封的IP) action=drop comment="这里注释,中文的好像不行"
add chain=forward protocol=udp dst-port=2004 action=drop
add chain=forward protocol=tcp dst-port=2005 action=drop

ROS普通限速+PCQ限速+服务器不限速一. IP限速普通限速就这样：我刚刚调整的:for aPC from 1 to 239 do={/queue simple add name=(A0 . $aPC)dst-address=(192.168.0. . $aPC) interface=all priority=6max-limit=1600000/720000 burst-limit=2240000/800000burst-threshold=1024000/240000 burst-time=16s/10s }:for bPC from 1 to 239 do={/queue simple add name=(B0 . $bPC)dst-address=(192.168.1. . $bPC) interface=all priority=8max-limit=1024000/360000 burst-limit=1280000/480000burst-threshold=800000/240000 burst-time=10s/8s }二.PCQ限速1.PCQ和普通限速是没有冲突的，普通的限速基本上是大于PCQ的限速值，也就是说按10M光纤来说，已经有普通限速的基础上还是要快超过10M的，网速肯定就慢了，这时候马上使用PCQ的限速策略代替普通限速，保证带宽不超过10M。

PCQ启用后，带宽降下来后，那么就再使用普通限速，如此循环.那么有的朋友就会说有普通限速了还搞什么PCQ，直接把速度降低点不就OK了。

我们做PCQ 主要的目的是使10M的光纤得到充分利用，不浪费宝贵资源。

白了就是少人的时候带宽给他多用点，速度快点，高峰期的时候减低点，慢点，但不能离谱。

2.首先要保证你ROS是正常的能NAT，一切正常后我们开始做PCQ2.1 说明：其他设置值在最后面贴出2.2 注意：new packet mark:中的（all-mark）这个要自己打上的2.3 在QUEUE菜单里面选择Queue Types 创作PCQ限速的子项这里就决定了你的限制每个IP多少K的速度（2.9系列可以直接用K单位2.8 的不行）注意看图信息这里注意下TOTAL LIMIT 设置我这样吧--------------------------------------------------------------------------------------------------------------速度设置到底多少合适呢，如果是100M的就不搞什么PCQ了，我100M的网吧直接每台机器设置20M，用都用不完，他也很少会达到20M 哈哈10M的来说，130台这样吧，PCQ设置800K，最低的了。

可以优化解决大型网络游戏卡的ROS限速脚本ros软路由一直是网吧用的比较多的软路由。

的确，ros防ddos攻击还是比较有用的。

网上有很多的ros软路由教程，今天这个算是ros限速脚本吧。

安装就不说了，大家可以参照网上很多的ros软路由教程来安装。

这个ros限速脚本事针对大型网络游戏卡而写的。

ip firewall mangleadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment=""disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=noadd chain=forward p2p=all-p2p action=mark-connection \new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet \new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet \new-packet-mark=general passthrough=yes comment="" disabled=no add chain=forward packet-size=32-512 action=mark-packetnew-packet-mark=all \passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packetnew-packet-mark=big \passthrough=yes comment="" disabled=no直接复制上面。

ROS通用脚本一：限速脚本:for wbsz from 1 to 254 do={/queue simple add name=(wbsz . $wbsz)dst-address=(192.168.0. . $wbsz) limit-at=1024K/1024K max-limit=1024K/1024K} 二：限制每台机最大线程数:for wbsz from 1 to 254 do={/ip firewall filter add chain=forwardsrc-address=(192.168.0. . $wbsz) protocol=tcp connection-limit=50,32action=drop}三：端口映射ip firewall nat add chain=dstnat dst-address=(202.96.134.134) protocol=tcp dst-port=80 to-addresses=(192.168.0.1) to-ports=80 action=dst-nat四：封端口号/ ip firewall filterad ch forward pr tcp dst-po 8000 act drop comment="Blockade QQ"五：更变telnet服务端口/ip service set telnet port=23六：更变SSH管理服务端口/ip service set ssh port=22七：更变www服务端口号/ip service set www port=80八：更变FTP服务端口号/ip service set ftp port=21十：删除限速脚本:for wbsz from 1 to 254 do={/queue simple remove (wbsz . $wbsz) }十一：封IP脚步本/ ip firewall filteradd chain=forward dst-address=58.60.13.38/32 action=drop comment="Blockade QQ" 十二：禁P2P脚本/ ip firewall filteradd chain=forward src-address=192.168.0.0/24 p2p=all-p2p action=drop comment="No P2P"十三：限制每台机最大的TCP线程数(线程数=60)/ ip firewall filteradd chain=forward protocol=tcp connection-limit=60,32 action=drop \disabled=no十四：一次性绑定所有在线机器MAC:foreach wbsz in=[/ip arp find dynamic=yes ] do=[/ip arp add copy-from=$wbsz] 十五：解除所以绑定的MAC:foreach wbsz in [/ip arp find] do={/ip arp remove $wbsz}十六：禁Ping/ ip firewall filteradd chain=output protocol=icmp action=drop comment="No Ping"十七：禁电驴/ ip firewall filteradd chain=forward protocol=tcp dst-port=4661-4662 action=drop comment="No Emule"add chain=forward protocol=tcp dst-port=4242 action=dropadd chain=forward dst-address=62.241.53.15 action=drop十八：禁PPLIVE/ ip firewall filteradd chain=forward protocol=tcp dst-port=8008 action=drop comment="No PPlive TV" add chain=forward protocol=udp dst-port=4004 action=dropadd chain=forward dst-address=218.108.237.11 action=drop十九：禁QQ直播/ ip firewall filteradd chain=forward protocol=udp dst-port=13000-14000 action=drop comment="No QQLive"二十：禁比特精灵/ ip firewall filteradd chain=forward protocol=tcp dst-port=16881 action=drop comment="No BitSpirit"二十一：禁QQ聊天(没事不要用)/ ip firewall filteradd chain=forward src-address=10.5.6.7/32 action=accept comment="No Tencent QQ" ad ch forward pr tcp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropadd chain=forward dst-address=61.144.238.0/24 action=dropadd chain=forward dst-address=61.152.100.0/24 action=dropadd chain=forward dst-address=61.141.194.0/24 action=dropadd chain=forward dst-address=202.96.170.163/32 action=dropadd chain=forward dst-address=202.104.129.0/24 action=dropadd chain=forward dst-address=202.104.193.20/32 action=dropadd chain=forward dst-address=202.104.193.11/32 action=dropadd chain=forward dst-address=202.104.193.12/32 action=dropadd chain=forward dst-address=218.17.209.23/32 action=dropadd chain=forward dst-address=218.18.95.153/32 action=dropadd chain=forward dst-address=218.18.95.165/32 action=dropadd chain=forward dst-address=218.18.95.220/32 action=dropadd chain=forward dst-address=218.85.138.70/32 action=dropadd chain=forward dst-address=219.133.38.0/24 action=dropadd chain=forward dst-address=219.133.49.0/24 action=dropadd chain=forward dst-address=220.133.40.0/24 action=dropadd chain=forward content=sz.tencent action=rejectadd chain=forward content=sz2.tencent action=rejectadd chain=forward content=sz3.tencent action=rejectadd chain=forward content=sz4.tencent action=rejectadd chain=forward content=sz5.tencent action=rejectadd chain=forward content=sz6.tencent action=rejectadd chain=forward content=sz7.tencent action=rejectadd chain=forward content=sz8.tencent action=rejecadd chain=forward content=sz9.tencent action=rejecadd chain=forward content=tcpconn.tencent action=rejectadd chain=forward content=tcpconn2.tencent action=rejectadd chain=forward content=tcpconn3.tencent action=rejectadd chain=forward content=tcpconn4.tencent action=rejectadd chain=forward content=tcpconn5.tencent action=rejectadd chain=forward content=tcpconn6.tencent action=rejectadd chain=forward content=tcpconn7.tencent action=rejectadd chain=forward content=tcpconn8.tencent action=rejectadd chain=forward content=qq action=rejectadd chain=forward content=www.qq action=reject二十二：防止灰鸽子入浸/ ip firewall filteradd chain=forward protocol=tcp dst-port=1999 action=dropcomment="Backdoor.GrayBird.ad"add chain=forward dst-address=80.190.240.125 action=dropadd chain=forward dst-address=203.209.245.168 action=dropadd chain=forward dst-address=210.192.122.106 action=dropadd chain=forward dst-address=218.30.88.43 action=dropadd chain=forward dst-address=219.238.233.110 action=dropadd chain=forward dst-address=222.186.8.88 action=dropadd chain=forward dst-address=124.42.125.37 action=dropadd chain=forward dst-address=210.192.122.107 action=dropadd chain=forward dst-address=61.147.118.198 action=dropadd chain=forward dst-address=219.238.233.11 action=drop二十三：防三波/ ip firewall filteradd chain=forward protocol=tcp dst-port=135-139 action=drop comment="No 3B"================================================================================ ================================================================================ ==================================以上脚本使用说明：用winbox.exe 登陆找到 System -- Script - 点击+ 将对应脚本复制其中后，点击 Run Script即脚本一、导出 ARP 列表ip arp export file arp这样就能将所有ARP列表导出到 arp.rsc 文件。

Name(脚本名程)
Source(脚本)
OK-选择要运行的脚本-Run Script
ROS限速的极致应用
一般我们用ros限速只是使用了max-limit，其实ros限速可以更好的运用。比如我们希望
客户打开网页时速度可以快一些，下载时速度可以慢一些。ros2.9就可以实现。
max-limit------我们最常用的地方，最大速度
General-In. Interface all(如果你是拨号的就选择pppoe的、固定IP选择all即可）
Dst. Address:外网IP/32
Dst. Port:要映射的端口
Protocol:tcp(如果映射反恐的就用udp)
Action action:nat
TO Dst.Addresses:你的内网IP
$aaa)]}）
脚本名：node_off
脚本内容：（:for aaa from 1 to 254 do={/queue sim dis [find name=(ip_ .
$aaa)]}）
scripts（脚本部分）以完成
打开 /tools/traffic monitor
新建：
名：node_18M traffic=received trigger=above on event=node_on
2 to 254是2~254
192.168.0. . $aaa是IP
上两句加起来是192.168.0.2~192.168.0.254
connection-limit=50是线程数这里为50
max-limit=2000000/2000000是上行／下行
使用：
WinBox-System-Scripts-＋

ROS最正确的限速--------小包优先+带宽均分+简单队列限制上传速度注意：本文针对10M带宽做出的限速说明，请根据自己的实际带宽更改相应的限速设置================================= START ========================一、小包优先的脚本如下：/ip firewall mangleadd chain=forward p2p=all-p2p action=mark-connection new-connection-mark=p2p_conn passthrough=yes comment="" disabled=noadd chain=forward connection-mark=p2p_conn action=mark-packet new-packet-mark=p2p passthrough=yes comment="" disabled=noadd chain=forward connection-mark=!p2p_conn action=mark-packet new-packet-mark=general passthrough=yes comment="" disabled=noadd chain=forward packet-size=32-512 action=mark-packet new-packet-mark=small passthrough=yes comment="" disabled=noadd chain=forward packet-size=512-1200 action=mark-packet new-packet-mark=big passthrough=yes comment="" disabled=no/ queue treeadd name="p2pW" parent=WAN packet-mark=p2p limit-at=400000 queue=default priority=8 max-limit=400000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="p2pL" parent=LAN packet-mark=p2p limit-at=400000 queue=default priority=8 max-limit=400000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="ClassA" parent=LAN packet-mark="" limit-at=0 queue=default priority=8 max-limit=100000000 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="ClassB" parent=ClassA packet-mark="" limit-at=0 queue=default priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf1" parent=ClassA packet-mark=general limit-at=0 queue=default priority=7 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf2" parent=ClassB packet-mark=big limit-at=0 queue=default priority=6 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=noadd name="Leaf3" parent=ClassB packet-mark=small limit-at=0 queue=default priority=5 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s disabled=no二、然后是带宽均分：这个例子示范了如何将10Mbps下载2Mbps上传，均分给网络10.10.12.0/24中的活动的用户# 所有来自本地网络192.168.0.0/24的流，标记一个用户标记/ip firewall mangle add chain=forward src-address=192.168.10.0/24 \action=mark-connection new-connection-mark=users-con/ip firewall mangle add connection-mark=users-con action=mark-packet \new-packet-mark=users chain=forward# 添加两个新的PCQ类型。

ROS动态限速/ ip firewall mangle add chain=prerouting action=mark-packet new-packet-mark=all-mark passthrough=yes/ queue type add name="PCQ-up" kind=pcq pcq-rate=1000000 pcq-limit=50 pcq-classifier=src-address pcq-total-limit=2000/ queue type add name="PCQ-down" kind=pcq pcq-rate=1600000 pcq-limit=50 pcq-classifier=dst-address pcq-total-limit=2000/ queue tree add name="PCQdown" parent=wan queue=PCQ-down packet-mark=all-mark/ queue tree add name="PCQup" parent=wan queue=PCQ-up packet-mark=all-mark/ queue simpleadd name="PCQ0" target-addresses=192.168.0.0/24 dst-address=0.0.0.0/0 \interface=all parent=none packet-marks=all-mark direction=both priority=1 \queue=PCQ-up/PCQ-down limit-at=0/0 max-limit=100000000/100000000 \total-queue=default-small disabled=yes/ queue simpleadd name="PCQ1" target-addresses=192.168.1.0/24 dst-address=0.0.0.0/0 \interface=all parent=none packet-marks=all-markdirection=both priority=1 \queue=PCQ-up/PCQ-down limit-at=0/0 max-limit=100000000/100000000 \total-queue=default-small disabled=yes/ tool traffic-monitoradd name="PCQdownon" interface=wan traffic=received trigger=above threshold=40000000 on-event=enable1 comment="" disabled=noadd name="PCQdownoff" interface=wan traffic=received trigger=below threshold=5000000 on-event=disable1 comment="" disabled=no/ system scriptadd name="disable0" source=":if \(\[ /queue simple get \[/queue simple find \name=\"PCQ0\"\] disable \]=false \) do={/queue simple disable PCQ0}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="disable1" source=":if \(\[ /queue simple get \[/queue simple find \name=\"PCQ1\"\] disable \]=false \) do={/queue simple disable PCQ1}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="enable0" source=":if \(\[ /queue simple get \[/queue simple find \name=\"PCQ0\"\] disable \]=true \) do={/queue simple enable PCQ0}" \policy=ftp,reboot,read,write,policy,test,winbox,passwordadd name="enable1" source=":if \(\[ /queue simple get \[/queue simple find \name=\"PCQ1\"\] disable \]=true \) do={/queue simple enable PCQ1}" \policy=ftp,reboot,read,write,policy,test,winbox,password。

queue=PCQ-up/PCQ-down limit-at=0/0 max-limit=15000000/15000000 \
total-queue=default-small disabled=yes
到这里就是建立动态限速的策略了！192.168.0.0/24 改为你IP段！max-limit=15000000/15000000 这里
把最后一段替换成这段就是由时间段控制开关PCQ了！
add name="PCQON" interface=WAN traffic=received trigger=above \
threshold=14800000 on-event=PCQON comment="" disabled=no
add name="PCQOFF" interface=WAN traffic=received trigger=below \
的静态限速，这样一算，1.5*5=7.5M了，再加上玩网游的人，基本上就稳定在10M左右了！
然后再设置一个脚本，当总流量少于6M的话（也就算没那么多人下载了，流量下来了）那么1.5M的静态限
速脚本就会自动关闭，又打开了本来3M的限速了！
基本上原理就是这样。通过这个原理，网吧宽带利用就会越来越合理！
/system scheduler add name=timeoff interval=24h start-time=23:59:59 on-event={PCQOFF}
disabled=no
==============================================================
add name="PCQ-down" kind=pcq pcq-rate=1500000 pcq-limit=50 \

ROS软路由防火墙配置规则Routeros防火墙功能非常灵活。

routeros防火墙属于包过滤防火墙，你可以定义一系列的规则过滤掉发往routeros、从routeros发出、通过routeros转发的数据包。

在routeros防火墙中定义了三个防火墙（过滤）链（即input、forward、output），你可以在这三个链当中定义你自己的规则。

input意思是指发往routeros自己的数据（也就是目的ip是routeros接口中的一个ip地址）；output意思是指从routeros发出去的数据（也就是数据包源ip是routeros接口中的一个ip地址）；forward意思是指通过routeros转发的（比如你内部计算机访问外部网络，数据需要通过你的routeros进行转发出去）。

禁止ping routeros，我们一般需要在input链中添加规则，因为数据包是发给routeros 的，数据包的目标ip是routeros的一个接口ip地址。

（当然如果你硬是要在output里建立一条规则过滤掉icmp信息也能做到ping不通，当你ping的数据包到达routeos时，routeos能接收这个数据包并做出回应，当routeros回应给你的包要发出去的时候会检查output的规则并过滤掉回应你的包。

）在每条链中的每条规则都有目标ip，源ip，进入的接口（in interface），非常灵活的去建立规则。

比如ROS禁止PING，禁止外网ping你routeros，只需要在in interface中选择你连外部网络的接口。

禁止内部ping的话可以选择连你内部网络的接口。

如果禁止所有的ping 的话，那么接口选择all。

当然禁止ping 协议要选择icmp ，action选择drop或reject。

另外要注意的就是，icmp协议并不是就指的是ping，而是ping是使用icmp协议中的一种（我们ping 出去发送的数据包icmp协议的类型为8 代码为0，在routeros中写为icmp-options=8：0；而我们对ping做出回应icmp类型为0 代码为0），还有很多东西也属于icmp协议。

另类ROS限速让限速更稳定更智能!动态限速ROS动态限速(检查外部网络的总速度以切换限速)不用多说，让我们先看看脚本原理:WINBOX界面中引入了以下操作:在总速度不超过9M的情况下，所有生成的限速规则可以自动关闭，在总速度超过18M的情况下，所有生成的限速规则可以自动启动说明:输入文字内容时，不要两边都放()总速度=网卡的当前速度Open /system/scripts脚本::对于aaafrom1到254 do = {/queuesimladname =(IP _。

$ AAA)dst-地址= (192.168.0..$ aaa)接口= wanmax-limit = 256000/800000突发限制= 1000000/300000突发阈值= 128000/512000突发时间= 30s/1m}以上是由速度限制树生成的网段中所有IP的速度限制列表！让我们言归正传:脚本名称:node_on脚本内容:(:对于aaafrom1到254 do = {/queuesim[find name =(IP _ 1)。

$ aaa)]$ aaa)]= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =:对于aaa从1到25$ AAA)dst-地址=(192.168.0。

$ AAA)limit-at = 500000/500000 max-limit = 3000000/3000000 }/IP防火墙损坏add chain = pre routing action = mark-packet new-packet-mark = all-mark \ \ pass through = yes comment = \/queue typeadd name = \ pcq-classifier = src-address pcq-total-total threshold = 14800000 on-event = PCQON comment = \ add name = \ AN traffic = received trigger = below \ \ threshold = 5000000 on-event = PCQOF comment = \ = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =需要修改以下说明！以下是注15M。

ROS IP+MAC绑定,流量控制终极设置!2011-09-27 20:34最后一个初级教程了,谢谢各位水友帮顶与支持!!!初级教程贴,高手勿拍砖!错漏之处请谅解..搞好ROS安装,ADSL上网设置后,最实用的流量限制和 MAC+IP绑定功能,终极设置.ROS安装连接ROS ADSL拨号设置MAC地址+IP绑定...防止内网用户乱改IP....打开WINBOX...点击IP---ARP:弹出ARP LIST的菜单,......这菜单显示当前内网在线主机的MAC IP信息....双击其中一个用户点击COPY....再点击OK...建立该用户的ARP记录.再点击INTERFACE .....双击内网网卡LAN......在ARP选项中选择REPLY-ONLY...意思是:绑定了的用户才能上网终极流量控制理解图::点击...QUEUES...流量控制选项....再点击红色的+号...增加规则,注意看图中的说明:图例说明:点击BURST.....NAME :填规则名称,中英文都可以...TARGET ADDRESSES :填要限制流量的IP地址BURST LIME: 极限速度BURST THRESHOLD: 监控速度MAX LIMIT :限制速度...在设定时间里(图例是60秒)...在设定时间内平均下载/上传速度低于监控速度(256K)的话,就可以达到极限速度(512K).如果平均值大于监控速度(256K)的话,就被限制为限制速度(128K)....这样就保证了打开网页和下载小软件的带宽需求....要是长期下载大的文件或占用大的带宽就被限制流量了....单位是KPBS....化成KB是要除以8的...例:512KPBS====512/8.....64KB/S....。

ROS脚本大全(通用) – CentOS教程ROS脚本大全(通用)一：限速脚本:for wbsz from 1 to 254 do={/queue simple addname=(wbsz . $wbsz) dst-address=(192.168.0. . $wbsz) limit-at=1024K/1024K max-limit=1024K/1024K}二：限制每台机最大线程数:for wbsz from 1 to 254 do={/ip firewall filter addchain=forward src-address=(192.168.0. . $wbsz) protocol=tcp connection-limit=50,32 action=drop}三：端口映射ip firewall nat add chain=dstnatdst-address=(202.96.134.134) protocol=tcp dst-port=80 to-addresses=(192.168.0.1) to-ports=80 action=dst-nat四：封端口号/ ip firewall filterad ch forward pr tcp dst-po 8000 act drop comment=”Blockade QQ”五：更变telnet服务端口/ip service set telnet port=23六：更变SSH管理服务端口/ip service set ssh port=22七：更变www服务端口号/ip service set www port=80八：更变FTP服务端口号/ip service set ftp port=21九：增加本ROS管理用户/user add name=wbsz password=admin group=full十：删除限速脚本:for wbsz from 1 to 254 do={/queue simple remove (wbsz . $wbsz) }十一：封IP脚步本/ ip firewall filteradd chain=forward dst-address=58.60.13.38/32action=drop comment=”Blockade QQ”十二：禁P2P脚本/ ip firewall filteradd chain=forward src-address=192.168.0.0/24p2p=all-p2p action=drop comment=”No P2P”十三：限制每台机最大的TCP线程数(线程数=60)/ ip firewall filteradd chain=forward protocol=tcp connection-limit=60,32 action=drop \disabled=no十四：一次性绑定所有在线机器MAC:foreach wbsz in=[/ip arp find dynamic=yes ] do=[/ip arp add copy-from=$wbsz]十五：解除所以绑定的MAC:foreach wbsz in [/ip arp find] do={/ip arp remove $wbsz}十六：禁Ping/ ip firewall filteradd chain=output protocol=icmp action=dropcomment=”No Ping”十七：禁电驴/ ip firewall filteradd chain=forward protocol=tcp dst-port=4661-4662 action=drop comment=”No Emule”add chain=forward protocol=tcp dst-port=4242 action=dropadd chain=forward dst-address=62.241.53.15 action=drop十八：禁PPLIVE/ ip firewall filteradd chain=forward protocol=tcp dst-port=8008 action=drop comment=”No PPlive TV”add chain=forward protocol=udp dst-port=4004action=dropadd chain=forward dst-address=218.108.237.11 action=drop十九：禁QQ直播/ ip firewall filteradd chain=forward protocol=udp dst-port=13000-14000 action=drop comment=”No QQLive”二十：禁比特精灵/ ip firewall filteradd chain=forward protocol=tcp dst-port=16881action=drop comment=”No BitSpirit”二十一：禁QQ聊天(一般公司才需要)/ ip firewall filteradd chain=forward src-address=10.5.6.7/32 action=accept comment=”No Tencent QQ”ad ch forward pr tcp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropadd chain=forward dst-address=61.144.238.0/24action=dropadd chain=forward dst-address=61.152.100.0/24action=dropadd chain=forward dst-address=61.141.194.0/24action=dropadd chain=forward dst-address=202.96.170.163/32action=dropadd chain=forward dst-address=202.104.129.0/24 action=dropadd chain=forward dst-address=202.104.193.20/32 action=dropadd chain=forward dst-address=202.104.193.11/32 action=dropadd chain=forward dst-address=202.104.193.12/32 action=dropadd chain=forward dst-address=218.17.209.23/32 action=dropadd chain=forward dst-address=218.18.95.153/32 action=dropadd chain=forward dst-address=218.18.95.165/32 action=dropadd chain=forward dst-address=218.18.95.220/32 action=dropadd chain=forward dst-address=218.85.138.70/32 action=dropadd chain=forward dst-address=219.133.38.0/24 action=dropadd chain=forward dst-address=219.133.49.0/24 action=dropadd chain=forward dst-address=220.133.40.0/24 action=dropadd chain=forward content=sz.tencent action=rejectadd chain=forward content=sz2.tencent action=rejectadd chain=forward content=sz3.tencent action=rejectadd chain=forward content=sz4.tencent action=rejectadd chain=forward content=sz5.tencent action=rejectadd chain=forward content=sz6.tencent action=rejectadd chain=forward content=sz7.tencent action=rejectadd chain=forward content=sz8.tencent action=rejecadd chain=forward content=sz9.tencent action=rejecadd chain=forward content=tcpconn.tencent action=reject add chain=forward content=tcpconn2.tencent action=reject add chain=forward content=tcpconn3.tencent action=reject add chain=forward content=tcpconn4.tencent action=reject add chain=forward content=tcpconn5.tencent action=rejectadd chain=forward content=tcpconn6.tencent action=rejectadd chain=forward content=tcpconn7.tencent action=rejectadd chain=forward content=tcpconn8.tencent action=rejectadd chain=forward content=qq action=rejectadd chain=forward content=www.qq action=reject二十二：防止灰鸽子入浸/ ip firewall filteradd chain=forward protocol=tcp dst-port=1999 action=drop comment=”Backdoor.GrayBird.ad”add chain=forward dst-address=80.190.240.125action=dropadd chain=forward dst-address=203.209.245.168action=dropadd chain=forward dst-address=210.192.122.106action=dropadd chain=forward dst-address=218.30.88.43 action=dropadd chain=forward dst-address=219.238.233.110action=dropadd chain=forward dst-address=222.186.8.88 action=dropadd chain=forward dst-address=124.42.125.37action=dropadd chain=forward dst-address=210.192.122.107action=dropadd chain=forward dst-address=61.147.118.198action=dropadd chain=forward dst-address=219.238.233.11action=drop二十三：防三波/ ip firewall filteradd chain=forward protocol=tcp dst-port=135-139action=drop comment=”No 3B”以上脚本使用说明：用winbox.exe 登陆找到System — Script –点击+ 将对应脚本复制其中后，点击Run Script即脚本安装成功！。

ROS脚本大全一：限速脚本:for wbsz from 1 to 254 do={/queue ** add name=(wbsz . $wbsz) dst-address=(192.168.0. . $wbsz) limit-at=1024K/1024K max-limit=1024K/1024K}二：限制每台机最大线程数:for wbsz from 1 to 254 do={/ip firewall filter add chain=forward src-address=(192.168.0. . $wbsz) protocol=tcp connection-limit=50,32 action=drop}三：端口映射ip firewall nat add chain=dstnat dst-address=(202.96.134.134) protocol=tcp dst-port=80 to-addresses=(192.168.0.1) to-ports=80 action=dst-nat四：封端口号/ ip firewall filterad ch forward pr tcp dst-po 8000 act drop comment="Blockade QQ"五：更变telnet服务端口/ip service set telnet port=23六：更变SSH管理服务端口/ip service set ssh port=22七：更变www服务端口号/ip service set www port=80八：更变FTP服务端口号/ip service set ftp port=21九：增加本ROS管理用户/user add name=wbsz password=admin group=full十：删除限速脚本:for wbsz from 1 to 254 do={/queue ** remove (wbsz . $wbsz) }十一：封IP脚步本/ ip firewall filteradd chain=forward dst-address=58.60.13.38/32 action=drop comment="Blockade QQ"十二：禁P2P脚本/ ip firewall filteradd chain=forward src-address=192.168.0.0/24 p2p=all-p2p action=drop comment="No P2P"十三：限制每台机最大的TCP线程数(线程数=60)/ ip firewall filteradd chain=forward protocol=tcp connection-limit=60,32 action=drop \disabled=no十四：一次性绑定所有在线机器MAC:foreach wbsz in=[/ip arp find dynamic=yes ] do=[/ip arp add copy-from=$wbsz]十五：解除所以绑定的MAC:foreach wbsz in [/ip arp find] do={/ip arp remove $wbsz}十六：禁Ping/ ip firewall filteradd chain=output protocol=icmp action=drop comment="No Ping"十七：禁电驴/ ip firewall filteradd chain=forward protocol=tcp dst-port=4661-4662 action=drop comment="No Emule" add chain=forward protocol=tcp dst-port=4242 action=dropadd chain=forward dst-address=62.241.53.15 action=drop十八：禁PPLIVE/ ip firewall filteradd chain=forward protocol=tcp dst-port=8008 action=drop comment="No PPlive TV"add chain=forward protocol=udp dst-port=4004 action=dropadd chain=forward dst-address=218.108.237.11 action=drop十九：禁QQ直播/ ip firewall filteradd chain=forward protocol=udp dst-port=13000-14000 action=drop comment="No QQLive" 二十：禁比特精灵/ ip firewall filteradd chain=forward protocol=tcp dst-port=16881 action=drop comment="No BitSpirit"二十一：禁QQ聊天(一般公司才需要)/ ip firewall filteradd chain=forward src-address=10.5.6.7/32 action=accept comment="No Tencent QQ"ad ch forward pr tcp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropad ch forward pr udp dst-po 8000 act dropadd chain=forward dst-address=61.144.238.0/24 action=dropadd chain=forward dst-address=61.152.100.0/24 action=dropadd chain=forward dst-address=61.141.194.0/24 action=dropadd chain=forward dst-address=202.96.170.163/32 action=dropadd chain=forward dst-address=202.104.129.0/24 action=dropadd chain=forward dst-address=202.104.193.20/32 action=dropadd chain=forward dst-address=202.104.193.11/32 action=dropadd chain=forward dst-address=202.104.193.12/32 action=dropadd chain=forward dst-address=218.17.209.23/32 action=dropadd chain=forward dst-address=218.18.95.153/32 action=dropadd chain=forward dst-address=218.18.95.165/32 action=dropadd chain=forward dst-address=218.18.95.220/32 action=dropadd chain=forward dst-address=218.85.138.70/32 action=dropadd chain=forward dst-address=219.133.38.0/24 action=dropadd chain=forward dst-address=219.133.49.0/24 action=dropadd chain=forward dst-address=220.133.40.0/24 action=dropadd chain=forward content=sz.tencent action=rejectadd chain=forward content=sz2.tencent action=rejectadd chain=forward content=sz3.tencent action=rejectadd chain=forward content=sz4.tencent action=rejectadd chain=forward content=sz5.tencent action=rejectadd chain=forward content=sz6.tencent action=rejectadd chain=forward content=sz7.tencent action=rejectadd chain=forward content=sz8.tencent action=rejecadd chain=forward content=sz9.tencent action=rejecadd chain=forward content=tcpconn.tencent action=rejectadd chain=forward content=tcpconn2.tencent action=rejectadd chain=forward content=tcpconn3.tencent action=rejectadd chain=forward content=tcpconn4.tencent action=rejectadd chain=forward content=tcpconn5.tencent action=rejectadd chain=forward content=tcpconn6.tencent action=rejectadd chain=forward content=tcpconn7.tencent action=rejectadd chain=forward content=tcpconn8.tencent action=rejectadd chain=forward content=qq action=rejectadd chain=forward content=www.qq action=reject二十二：防止灰鸽子入浸/ ip firewall filteradd chain=forward protocol=tcp dst-port=1999 action=drop comment="Backdoor.GrayBird.ad" add chain=forward dst-address=80.190.240.125 action=dropadd chain=forward dst-address=203.209.245.168 action=dropadd chain=forward dst-address=210.192.122.106 action=dropadd chain=forward dst-address=218.30.88.43 action=dropadd chain=forward dst-address=219.238.233.110 action=dropadd chain=forward dst-address=222.186.8.88 action=dropadd chain=forward dst-address=124.42.125.37 action=dropadd chain=forward dst-address=210.192.122.107 action=dropadd chain=forward dst-address=61.147.118.198 action=dropadd chain=forward dst-address=219.238.233.11 action=drop二十三：防三波/ ip firewall filteradd chain=forward protocol=tcp dst-port=135-139 action=drop comment="No 3B"以上脚本使用说明：用winbox.exe 登陆找到System -- Script - 点击+ 将对应脚本复制其中后，点击Run Script 即脚本安装成功！。