/interface list
add name=wan
/interface list member
add interface=ether1 list=wan
/ip firewall address-list
add address=10.0.0.0/8 comment="Rede Local" list=rede-local
add address=192.168.0.0/16 comment="Rede Local" list=rede-local
add address=172.16.0.0/12 comment="Rede Local" list=rede-local
add address=100.64.0.0/10 comment="Rede Local" list=rede-local
/ip firewall filter
add action=accept chain=input comment=\
    "Aceitar Conexoes Input established,related" connection-state=\
    established,related
add action=drop chain=input comment="Descartar Conexoes Input Invalidas" \
    connection-state=invalid log-prefix=invalid
add action=fasttrack-connection chain=forward comment="ATIVAR SOMENTE QUANDO F\
    OR BORDA, CASO CONTRARIO FICARA SEM CONTROLE DE BANDA" connection-state=\
    established,related disabled=yes
add action=accept chain=forward comment="ATIVAR SOMENTE QUANDO FOR BORDA, CASO\
    \_CONTRARIO FICARA SEM CONTROLE DE BANDA" connection-state=\
    established,related disabled=yes
add action=drop chain=forward comment="Descartar Conexoes Forward Invalidas" \
    connection-state=invalid log-prefix=invalid
add action=jump chain=forward comment="Anti-Spoofing Mitigacao DDOS" \
    connection-state=new jump-target=block-ddos log-prefix=block-ddos
add action=jump chain=input connection-state=new jump-target=block-ddos \
    log-prefix=block-ddos
add action=return chain=block-ddos dst-limit=32,32,src-and-dst-addresses/10s \
    log-prefix=DDOS_TCP protocol=tcp tcp-flags=syn,ack
add action=return chain=block-ddos dst-limit=500,32,src-and-dst-addresses/10s
add action=return chain=block-ddos limit=5k,3k:packet log-prefix=block-ddos
add action=add-src-to-address-list address-list=ddos_blacklist \
    address-list-timeout=5m chain=block-ddos log=yes
add action=add-src-to-address-list address-list=ftp_blacklist \
    address-list-timeout=5m chain=input comment=\
    "FTP Brute Forces para blacklist" dst-port=21 in-interface-list=wan \
    protocol=tcp src-address-list=ftp_stage2
add action=add-src-to-address-list address-list=ftp_stage2 \
    address-list-timeout=5m chain=input dst-port=21 in-interface-list=wan \
    protocol=tcp src-address-list=ftp_stage1
add action=add-src-to-address-list address-list=ftp_stage1 \
    address-list-timeout=5m chain=input dst-port=21 in-interface-list=wan \
    protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=5m chain=input comment=\
    "SSH Brute Forces para blacklist" dst-port=22 in-interface-list=wan \
    protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
    address-list-timeout=5m chain=input dst-port=22 in-interface-list=wan \
    protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
    address-list-timeout=5m chain=input dst-port=22 in-interface-list=wan \
    protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=telnet_blacklist \
    address-list-timeout=5m chain=input comment=\
    "Telnet Brute Forces para blacklist" dst-port=23 in-interface-list=wan \
    protocol=tcp src-address-list=telnet_stage2
add action=add-src-to-address-list address-list=telnet_stage2 \
    address-list-timeout=5m chain=input dst-port=23 in-interface-list=wan \
    protocol=tcp src-address-list=telnet_stage1
add action=add-src-to-address-list address-list=telnet_stage1 \
    address-list-timeout=5m chain=input dst-port=23 in-interface-list=wan \
    protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=winbox_blacklist \
    address-list-timeout=5m chain=input comment=\
    "Winbox Brute Forces para blacklist" dst-port=8291,8292 \
    in-interface-list=wan protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 \
    address-list-timeout=1m chain=input dst-port=8291,8292 in-interface-list=\
    wan protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 \
    address-list-timeout=1m chain=input dst-port=8291,8292 in-interface-list=\
    wan protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=dude_stage2 \
    address-list-timeout=1m chain=input dst-port=2210 in-interface-list=wan \
    protocol=tcp src-address-list=dude_stage1
add action=add-src-to-address-list address-list=dude_stage1 \
    address-list-timeout=1m chain=input dst-port=2210 in-interface-list=wan \
    protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=api_blacklist \
    address-list-timeout=5m chain=input comment=\
    "API Brute Forces para blacklist" dst-port=8728,8729 in-interface-list=\
    wan protocol=tcp src-address-list=api_stage2
add action=add-src-to-address-list address-list=api_stage2 \
    address-list-timeout=5m chain=input dst-port=8728,8729 in-interface-list=\
    wan protocol=tcp src-address-list=api_stage1
add action=add-src-to-address-list address-list=api_stage1 \
    address-list-timeout=5m chain=input dst-port=8728,8729 in-interface-list=\
    wan protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=pptp_blacklist \
    address-list-timeout=5m chain=input comment=\
    "PPTP Brute Forces para blacklist" dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage15
add action=add-src-to-address-list address-list=pptp_stage15 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage14
add action=add-src-to-address-list address-list=pptp_stage14 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage13
add action=add-src-to-address-list address-list=pptp_stage13 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage12
add action=add-src-to-address-list address-list=pptp_stage12 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage11
add action=add-src-to-address-list address-list=pptp_stage11 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage10
add action=add-src-to-address-list address-list=pptp_stage10 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage9
add action=add-src-to-address-list address-list=pptp_stage9 \
    address-list-timeout=50s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage8
add action=add-src-to-address-list address-list=pptp_stage8 \
    address-list-timeout=8s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage7
add action=add-src-to-address-list address-list=pptp_stage7 \
    address-list-timeout=7s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage6
add action=add-src-to-address-list address-list=pptp_stage6 \
    address-list-timeout=6s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage5
add action=add-src-to-address-list address-list=pptp_stage5 \
    address-list-timeout=5s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage4
add action=add-src-to-address-list address-list=dude_blacklist \
    address-list-timeout=5m chain=input comment=\
    "The Dude Brute Forces para blacklist" dst-port=2210 in-interface-list=\
    wan protocol=tcp src-address-list=dude_stage2
add action=add-src-to-address-list address-list=pptp_stage4 \
    address-list-timeout=4s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage3
add action=add-src-to-address-list address-list=pptp_stage3 \
    address-list-timeout=3s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage2
add action=add-src-to-address-list address-list=pptp_stage2 \
    address-list-timeout=2s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=pptp_stage1
add action=add-src-to-address-list address-list=pptp_stage1 \
    address-list-timeout=1s chain=input dst-port=1723 in-interface-list=wan \
    protocol=tcp src-address-list=!rede-local
add action=add-src-to-address-list address-list=l2tp_blacklist \
    address-list-timeout=5m chain=input comment=\
    "l2tp Brute Forces para blacklist" dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage15
add action=add-src-to-address-list address-list=l2tp_stage15 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage14
add action=add-src-to-address-list address-list=l2tp_stage14 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage13
add action=add-src-to-address-list address-list=l2tp_stage13 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage12
add action=add-src-to-address-list address-list=l2tp_stage12 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage11
add action=add-src-to-address-list address-list=l2tp_stage11 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage10
add action=add-src-to-address-list address-list=l2tp_stage10 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage9
add action=add-src-to-address-list address-list=l2tp_stage9 \
    address-list-timeout=50s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage8
add action=add-src-to-address-list address-list=l2tp_stage8 \
    address-list-timeout=8s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage7
add action=add-src-to-address-list address-list=l2tp_stage7 \
    address-list-timeout=7s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage6
add action=add-src-to-address-list address-list=l2tp_stage6 \
    address-list-timeout=6s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage5
add action=add-src-to-address-list address-list=l2tp_stage5 \
    address-list-timeout=5s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage4
add action=add-src-to-address-list address-list=l2tp_stage4 \
    address-list-timeout=4s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage3
add action=add-src-to-address-list address-list=l2tp_stage3 \
    address-list-timeout=3s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage2
add action=add-src-to-address-list address-list=l2tp_stage2 \
    address-list-timeout=2s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=l2tp_stage1
add action=add-src-to-address-list address-list=l2tp_stage1 \
    address-list-timeout=1s chain=input dst-port=500,1701,4500 \
    in-interface-list=wan protocol=tcp src-address-list=!rede-local
add action=accept chain=input comment=Winbox dst-port=8291 in-interface-list=\
    wan protocol=tcp
add action=accept chain=input comment=API dst-port=8728,8729 \
    in-interface-list=wan protocol=tcp
add action=accept chain=input comment=HTTP dst-port=5050 in-interface-list=\
    wan protocol=tcp
add action=accept chain=input comment=SSH disabled=yes dst-port=22 \
    in-interface-list=wan protocol=tcp
add action=accept chain=input comment="NAT traversal" dst-port=4500 \
    in-interface-list=wan protocol=udp
add action=accept chain=input comment=L2TP dst-port=1701 in-interface-list=\
    wan protocol=udp
add action=accept chain=input comment=PPTP dst-port=1723 in-interface-list=\
    wan protocol=tcp
add action=accept chain=input comment="Internet Key Exchange (IKE)" dst-port=\
    500 in-interface-list=wan protocol=udp
add action=accept chain=input comment="Encapsulation Header (ESP)" \
    in-interface-list=wan protocol=ipsec-esp
add action=accept chain=input comment="Authentication Header (AH)" \
    in-interface-list=wan protocol=ipsec-ah
add action=accept chain=input comment=GRE in-interface-list=wan protocol=gre
add action=accept chain=input comment=OSPF in-interface-list=!wan protocol=\
    ospf
add action=accept chain=input comment=BGP disabled=yes dst-port=179 \
    in-interface-list=wan protocol=tcp
add action=accept chain=input comment=SNMP dst-port=161,162 \
    in-interface-list=!wan protocol=udp
add action=accept chain=input comment=ICMP icmp-options=8:0 \
    in-interface-list=wan protocol=icmp
add action=drop chain=input comment="Bloqueia o Restante do Trafego" \
    in-interface-list=wan log-prefix=drop_restante
/ip firewall raw
add action=jump chain=prerouting comment="Fluxo ICMP" jump-target=icmp \
    protocol=icmp
add action=jump chain=output jump-target=icmp protocol=icmp
add action=accept chain=icmp comment="Echo Request" icmp-options=8:0 \
    protocol=icmp
add action=accept chain=icmp comment="Echo Reply" icmp-options=0:0 protocol=\
    icmp
add action=accept chain=icmp comment="Time Exceeded" icmp-options=11:0 \
    protocol=icmp
add action=accept chain=icmp comment="Destination Unreachable" icmp-options=\
    3:0-3 protocol=icmp
add action=accept chain=icmp comment=PMTUD icmp-options=3:4 protocol=icmp
add action=drop chain=icmp comment="Drop Outros ICMP" log-prefix=icmp \
    protocol=icmp
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment="Port scanners to list" \
    in-interface-list=wan protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment="NMAP FIN Stealth" \
    in-interface-list=wan protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment=SYN/FIN \
    in-interface-list=wan protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment=SYN/RST \
    in-interface-list=wan protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment=FIN/PSH/URG \
    in-interface-list=wan protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment=ALL/ALL \
    in-interface-list=wan protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=5m chain=prerouting comment="NMAP NULL" \
    in-interface-list=wan protocol=tcp tcp-flags=\
    !fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=prerouting comment="Drop Port Scanner" \
    in-interface-list=wan log-prefix=log_portscanner protocol=tcp \
    src-address-list=port_scanners
add action=drop chain=prerouting comment=\
    "Anti-spoofing Mitigacao DDOS Conexoes Simultaneas" log-prefix=log_ddos \
    src-address-list=ddos_blacklist
add action=drop chain=prerouting comment="Drop HTTP" dst-port=80 \
    in-interface-list=wan log-prefix=log_http protocol=tcp
add action=drop chain=prerouting comment="Drop Winbox" dst-port=8291,8292 \
    in-interface-list=wan log-prefix=log_winbox protocol=tcp \
    src-address-list=winbox_blacklist
add action=drop chain=prerouting comment="Drop Dude" dst-port=2210 \
    in-interface-list=wan log-prefix=log_dude protocol=tcp src-address-list=\
    dude_blacklist
add action=drop chain=prerouting comment="Drop Telnet" dst-port=23 \
    in-interface-list=wan log-prefix=log_telnet protocol=tcp \
    src-address-list=telnet_blacklist
add action=drop chain=prerouting comment="Drop SSH" dst-port=22 \
    in-interface-list=wan log-prefix=log_ssh protocol=tcp src-address-list=\
    ssh_blacklist
add action=drop chain=prerouting comment="Drop FTP" dst-port=21 \
    in-interface-list=wan log-prefix=log_ftp protocol=tcp src-address-list=\
    ftp_blacklist
add action=drop chain=prerouting comment="Drop API" dst-port=8728 \
    in-interface-list=wan log-prefix=log_api protocol=tcp src-address-list=\
    api_blacklist
add action=drop chain=prerouting comment="Drop PPTP" in-interface-list=wan \
    log-prefix=log_pptp protocol=tcp src-address-list=pptp_blacklist
add action=drop chain=prerouting comment="Drop L2TP" dst-port=500,1701,4500 \
    in-interface-list=wan log-prefix=log_l2tp protocol=udp src-address-list=\
    l2tp_blacklist
add action=drop chain=prerouting comment="Requisi\E7\E3o originada fora da red\
    e para acesso a servidor SMTP rede clientes" log-prefix=\
    "fora rede acesso SMTP clientes" protocol=udp src-port=25
add action=drop chain=prerouting log-prefix="fora rede acesso SMTP clientes" \
    protocol=tcp src-port=25
add action=drop chain=prerouting comment=\
    "Requisi\E7\E3o SMTP com origem externa" dst-port=25 in-interface-list=\
    wan log-prefix="rede clientes para serv ext SMTP" protocol=udp
add action=drop chain=prerouting dst-port=25 in-interface-list=wan \
    log-prefix="rede clientes para serv ext SMTP" protocol=tcp
add action=drop chain=prerouting comment=\
    "Requisi\E7\E3o SMTP com origem rede clientes para servidor externo" \
    dst-port=25 in-interface-list=!wan log-prefix=\
    "rede clientes para serv ext SMTP" protocol=udp
add action=drop chain=prerouting dst-port=25 in-interface-list=!wan \
    log-prefix="rede clientes para serv ext SMTP" protocol=tcp
add action=drop chain=prerouting comment="Requisi\E7\E3o originada fora da red\
    e para resolver DNS rede clientes e/ou provedor" dst-port=53 \
    in-interface-list=wan log-prefix=Bloqueia_requisicoes_dns protocol=udp
add action=drop chain=prerouting dst-port=53 in-interface-list=wan \
    log-prefix=Bloqueia_requisicoes_dns protocol=tcp