> For the complete documentation index, see [llms.txt](https://www.winbox.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.winbox.org/firewall/firewall-v6.md).

# 官方设备内置防火墙

注意！不要远程使用，会被阻拦在外面！建议在本地可控的设备上使用

高能警告！不了解不要直接远程导入使用.

```
# by RouterOS 6.44.3
/ip firewall filter add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
/ip firewall filter add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
/ip firewall filter add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
/ip firewall filter add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec  
/ip firewall filter add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
/ip firewall filter add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
/ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
/ip firewall filter add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
```

![](https://296990390-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LYTqCnvQ7_cVIl1ZPou%2F-LstWoQxrABwOCwG2_BG%2F-LstWs46uhhEquYKDNDA%2FSnipaste_2019-11-05_11-06-25.png?alt=media\&token=28ebe141-8bac-4035-a7bf-dbe57e4ea663)