net: April 2011

Senin, 18 April 2011

STEP BY STEP WINBOX BANDWIDTH MANAGEMEN TERMUDAH UNTUK PEMULA

CONTOH KASUS :
WARNET
BANDWITH TOTAL= 1024 kbps
JUMLAH CPU = 10 Cpu
NO PROXY SERVER
ETHER 1 = PUBLIK <- mohon ini di perhatikan sesuaikan dengan konfigurasi di router masing masing
ETHER 2 = LOCAL <- mohon ini di perhatikan sesuaikan dengan konfigurasi di router masing masing
KELUHAN : KALAU DI LIMIT PER IP JIKA SEDANG DOWNLOAD.. AKSES BROWSINGNYA KALAH
SOLUSI : PISAHKAN AKSES DOWNLOAD LALU BATASI.. DAN AKSES BROWSING DIBEBASKAN.
AKSI :
adhielesmana marking
1. Buat Conn Mark
WINBOX > IP > FIREWALL > MANGLE>
[+] ADD NEW
chain = forward
protocol = TCP(6)
in interface = ETHER 1
out interface = ETHER 2
(masuk ke TAB advance)
connection bytes = 262146-4294967295 ( artinya batas file ter kecil yang kena filter 256kb)
(masuk TAB action)
Action = mark connection
New Connection Mark = Download
Passtrough = [V] <- centang

adhielesmana marking
2. Buat Packet Mark
[+] ADD NEW
chain = forward
protocol = TCP(6)
in interface = ETHER 1
out interface = ETHER 2
Connection Mark = Download
(masuk TAB action)
Action = mark packet
New Packet Mark = Download

adhielesmana marking
3. Buat Queue Type
WINBOX > QUEUES > QUEUE TYPES
[+] ADD NEW
name = shape
kind = pcq
( pindah tab setting )
rate = 256000 <- kita batasi Download hanya di 256kbps...
limit dan total limit biarin tetep..
clasifier = dst. Address [v] <-- centang

adhielesmana marking
4.Buat Queue Tree
WINBOX > QUEUES > QUEUE TREE
[+] ADD NEW
name = Download
parent = global out
packet mark = Download
queue type = shape
max limit = 256000

adhielesmana marking
5. SELESAI

LIMIT DOWNLOAD VERSI TERBARU LEBIH MANTAB

1. Buat Conn Mark
WINBOX > IP > FIREWALL > MANGLE>
[+] ADD NEW
chain = Prerouting
protocol = TCP(6)
src Port = 21,80 ( umumnya download ambil dari port 80 dan 21 ( http dan ftp ) )
in interface = ETHER 1
(masuk ke TAB advance)
connection bytes = 262146-4294967295 ( artinya batas file ter kecil yang kena filter 256kb)
(masuk TAB action)
Action = mark connection
New Connection Mark = Download
Passtrough = [V] <- centang

2. Buat Packet Mark
[+] ADD NEW
chain = Prerouting
in interface = ETHER 1
Connection Mark = Download
(masuk TAB action)
Action = mark packet
New Packet Mark = Download

3. Buat Queue Type
WINBOX > QUEUES > QUEUE TYPES
[+] ADD NEW
name = shape
kind = pcq
( pindah tab setting )
rate = 256000 <- kita batasi Download hanya di 256kbps...
limit dan total limit biarin tetep..
clasifier = src. Address [v] <-- centang

4.Buat Queue Tree
WINBOX > QUEUES > QUEUE TREE
[+] ADD NEW
name = Download
parent = global in
packet mark = Download
queue type = shape
max limit = 256000

add chain=prerouting in-interface=Public

prerouting adalah mangle dengan parameter berdasar sumber, jadi ketika anda menerapkan rule saya, mangle tersebut hanya mengenali ip sumber ( src address ) yang masuk dari interface publik.

sedangkan forward itu mangle dengan parameter berdasar sumber dan tujuan. jadi bisa diterapkan untuk mengenali ip sumber ( src address ) dan tujuan ( dst address )

istilahnya gampangnya:
prerouting itu from who ? <- dari mana = dari sumber
sedangkan
forward itu from who forward to who? <- darimana diteruskan kemana = dari sumber diforward ( diteruskan ) ke tujuan
lain lagi postrouting
postrouting itu to who? <- kemana = ke tujuan
global in bisa digunakan apabila parameter yang akan kita filter adalah segala sesuatu yang masuk ke mikrotik.
global out bisa kita gunakan apabila kita akan memfilter segala sesuatu yang keluar dari mikrotik.

sumber

Sabtu, 16 April 2011

script firewall filter (untuk blok port virus dan spam)

/ip firewall filter
add chain=virus protocol=udp action=drop dst-port=1 comment="Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=2 comment="Death"
add chain=virus protocol=tcp action=drop dst-port=20 comment="Senna Spy FTP server"
add chain=virus protocol=tcp action=drop dst-port=21 comment="Back Construction, Blade Runner, Cattivik FTP Server, CC Invader, Dark FTP, Doly Trojan, Fore, Invisible FTP, Juggernaut 42, Larva, MotIv FTP, Net Administrator, Ramen, Senna Spy FTP server, The Flu, Traitor 21, WebEx, WinCrash"
add chain=virus protocol=tcp action=drop dst-port=22 comment="Shaft"
add chain=virus protocol=tcp action=drop dst-port=23 comment="Fire HacKer, Tiny Telnet Server TTS, Truva Atl"
add chain=virus protocol=tcp action=drop dst-port=25 comment="Ajan, Antigen, Barok, Email Password Sender EPS, EPS II, Gip, Gris, Happy99, Hpteam mail, Hybris, I love you, Kuang2, Magic Horse, MBT Mail Bombing Trojan, Moscow Email trojan, Naebi, NewApt worm, ProMail trojan, Shtirlitz, Stealth, Tapiras, Terminator, WinPC, WinSpy"
add chain=virus protocol=tcp action=drop dst-port=30 comment="Agent 40421"
add chain=virus protocol=tcp action=drop dst-port=31 comment="Agent 31, Hackers Paradise, Masters Paradise"
add chain=virus protocol=tcp action=drop dst-port=41 comment="Deep Throat, Foreplay"
add chain=virus protocol=tcp action=drop dst-port=48 comment="DRAT"
add chain=virus protocol=tcp action=drop dst-port=50 comment="DRAT"
add chain=virus protocol=tcp action=drop dst-port=58 comment="DMSetup"
add chain=virus protocol=tcp action=drop dst-port=59 comment="DMSetup"
add chain=virus protocol=tcp action=drop dst-port=79 comment="CDK, Firehotcker"
add chain=virus protocol=tcp action=drop dst-port=80 comment="711 trojan, Seven Eleven, AckCmd, Back End, Back Orifice 2000 Plug-Ins, Cafeini, CGI Backdoor, Executor, God Message, God Message Creator, Hooker, IISworm, MTX, NCX, Reverse WWW Tunnel Backdoor, RingZero, Seeker, WAN Remote, Web Server CT, WebDownloader"
add chain=virus protocol=tcp action=drop dst-port=81 comment="RemoConChubo"
add chain=virus protocol=tcp action=drop dst-port=99 comment="Hidden Port, NCX"
add chain=virus protocol=tcp action=drop dst-port=110 comment="ProMail trojan"
add chain=virus protocol=tcp action=drop dst-port=113 comment="Invisible Identd Deamon, Kazimas"
add chain=virus protocol=tcp action=drop dst-port=119 comment="Happy99"
add chain=virus protocol=tcp action=drop dst-port=121 comment="Attack Bot, God Message, JammerKillah"
add chain=virus protocol=tcp action=drop dst-port=123 comment="Net Controller"
add chain=virus protocol=tcp action=drop dst-port=133 comment="Farnaz"
add chain=virus protocol=tcp action=drop dst-port=135-139 comment="Blaster worm"
add chain=virus protocol=udp action=drop dst-port=135-139 comment="messenger worm
add chain=virus protocol=tcp action=drop dst-port=142 comment="NetTaxi"
add chain=virus protocol=tcp action=drop dst-port=146 comment="Infector"
add chain=virus protocol=udp action=drop dst-port=146 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=170 comment="A-trojan"
add chain=virus protocol=tcp action=drop dst-port=334 comment="Backage"
add chain=virus protocol=tcp action=drop dst-port=411 comment="Backage"
add chain=virus protocol=tcp action=drop dst-port=420 comment="Breach, Incognito"
add chain=virus protocol=tcp action=drop dst-port=421 comment="TCP Wrappers trojan"
add chain=virus protocol=tcp action=drop dst-port=445 comment="Blaster worm
add chain=virus protocol=udp action=drop dst-port=445 comment="Blaster worm
add chain=virus protocol=tcp action=drop dst-port=455 comment="Fatal Connections"
add chain=virus protocol=tcp action=drop dst-port=456 comment="Hackers Paradise"
add chain=virus protocol=tcp action=drop dst-port=513 comment="Grlogin"
add chain=virus protocol=tcp action=drop dst-port=514 comment="RPC Backdoor"
add chain=virus protocol=tcp action=drop dst-port=531 comment="Net666, Rasmin"
add chain=virus protocol=tcp action=drop dst-port=555 comment="711 trojan, Seven Eleven, Ini-Killer, Net Administrator, Phase Zero, Phase-0, Stealth Spy"
add chain=virus protocol=tcp action=drop dst-port=605 comment="Secret Service"
add chain=virus protocol=tcp action=drop dst-port=666 comment="Attack FTP, Back Construction, BLA trojan, Cain & Abel, NokNok, Satans Back Door SBD, ServU, Shadow Phyre, th3r1pp3rz Therippers"
add chain=virus protocol=tcp action=drop dst-port=667 comment="SniperNet"
add chain=virus protocol=tcp action=drop dst-port=669 comment="DP trojan"
add chain=virus protocol=tcp action=drop dst-port=692 comment="GayOL"
add chain=virus protocol=tcp action=drop dst-port=777 comment="AimSpy, Undetected"
add chain=virus protocol=tcp action=drop dst-port=808 comment="WinHole"
add chain=virus protocol=tcp action=drop dst-port=911 comment="Dark Shadow"
add chain=virus protocol=tcp action=drop dst-port=999 comment="Deep Throat, Foreplay, WinSatan"
add chain=virus protocol=tcp action=drop dst-port=1000 comment="Der Spaeher, Direct Connection"
add chain=virus protocol=tcp action=drop dst-port=1001 comment="Der Spaeher, Le Guardien, Silencer, WebEx"
add chain=virus protocol=tcp action=drop dst-port=1010-1016 comment="Doly Trojan"
add chain=virus protocol=tcp action=drop dst-port=1020 comment="Vampire"
add chain=virus protocol=tcp action=drop dst-port=1024 comment="Jade, Latinus, NetSpy"
add chain=virus protocol=tcp action=drop dst-port=1025 comment="Remote Storm"
add chain=virus protocol=udp action=drop dst-port=1025 comment="Remote Storm"
add chain=virus protocol=tcp action=drop dst-port=1035 comment="Multidropper"
add chain=virus protocol=tcp action=drop dst-port=1042 comment="BLA trojan"
add chain=virus protocol=tcp action=drop dst-port=1045 comment="Rasmin"
add chain=virus protocol=tcp action=drop dst-port=1049 comment="sbin initd"
add chain=virus protocol=tcp action=drop dst-port=1050 comment="MiniCommand"
add chain=virus protocol=tcp action=drop dst-port=1053 comment="The Thief"
add chain=virus protocol=tcp action=drop dst-port=1054 comment="AckCmd"
add chain=virus protocol=tcp action=drop dst-port=1080-1083 comment="WinHole"
add chain=virus protocol=tcp action=drop dst-port=1090 comment="Xtreme"
add chain=virus protocol=tcp action=drop dst-port=1095-1098 comment="Remote Administration Tool RAT"
add chain=virus protocol=tcp action=drop dst-port=1099 comment="Blood Fest Evolution, Remote Administration Tool RAT"
add chain=virus protocol=tcp action=drop dst-port=1150-1151 comment="Orion"
add chain=virus protocol=tcp action=drop dst-port=1170 comment="Psyber Stream Server PSS, Streaming Audio Server, Voice"
add chain=virus protocol=udp action=drop dst-port=1200-1201 comment="NoBackO"
add chain=virus protocol=tcp action=drop dst-port=1207 comment="SoftWAR"
add chain=virus protocol=tcp action=drop dst-port=1208 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=1212 comment="Kaos"
add chain=virus protocol=tcp action=drop dst-port=1234 comment="SubSeven Java client, Ultors Trojan"
add chain=virus protocol=tcp action=drop dst-port=1243 comment="BackDoor-G, SubSeven, SubSeven Apocalypse, Tiles"
add chain=virus protocol=tcp action=drop dst-port=1245 comment="VooDoo Doll"
add chain=virus protocol=tcp action=drop dst-port=1255 comment="Scarab"
add chain=virus protocol=tcp action=drop dst-port=1256 comment="Project nEXT"
add chain=virus protocol=tcp action=drop dst-port=1269 comment="Matrix"
add chain=virus protocol=tcp action=drop dst-port=1272 comment="The Matrix"
add chain=virus protocol=tcp action=drop dst-port=1313 comment="NETrojan"
add chain=virus protocol=tcp action=drop dst-port=1338 comment="Millenium Worm"
add chain=virus protocol=tcp action=drop dst-port=1349 comment="Bo dll"
add chain=virus protocol=tcp action=drop dst-port=1394 comment="GoFriller, Backdoor G-1"
add chain=virus protocol=tcp action=drop dst-port=1441 comment="Remote Storm"
add chain=virus protocol=tcp action=drop dst-port=1492 comment="FTP99CMP"
add chain=virus protocol=tcp action=drop dst-port=1524 comment="Trinoo"
add chain=virus protocol=tcp action=drop dst-port=1568 comment="Remote Hack"
add chain=virus protocol=tcp action=drop dst-port=1600 comment="Direct Connection, Shivka-Burka"
add chain=virus protocol=tcp action=drop dst-port=1703 comment="Exploiter"
add chain=virus protocol=tcp action=drop dst-port=1777 comment="Scarab"
add chain=virus protocol=tcp action=drop dst-port=1807 comment="SpySender"
add chain=virus protocol=tcp action=drop dst-port=1966 comment="Fake FTP"
add chain=virus protocol=tcp action=drop dst-port=1967 comment="WM FTP Server"
add chain=virus protocol=tcp action=drop dst-port=1969 comment="OpC BO"
add chain=virus protocol=tcp action=drop dst-port=1981 comment="Bowl, Shockrave"
add chain=virus protocol=tcp action=drop dst-port=1999 comment="Back Door, SubSeven, TransScout"
add chain=virus protocol=tcp action=drop dst-port=2000 comment="Der Spaeher, Insane Network, Last 2000, Remote Explorer 2000, Senna Spy Trojan Generator"
add chain=virus protocol=tcp action=drop dst-port=2001 comment="Der Spaeher, Trojan Cow"
add chain=virus protocol=tcp action=drop dst-port=2023 comment="Ripper Pro"
add chain=virus protocol=tcp action=drop dst-port=2080 comment="WinHole"
add chain=virus protocol=tcp action=drop dst-port=2115 comment="Bugs"
add chain=virus protocol=udp action=drop dst-port=2130 comment="Mini Backlash"
add chain=virus protocol=tcp action=drop dst-port=2140 comment="The Invasor"
add chain=virus protocol=udp action=drop dst-port=2140 comment="Deep Throat, Foreplay"
add chain=virus protocol=tcp action=drop dst-port=2155 comment="Illusion Mailer"
add chain=virus protocol=tcp action=drop dst-port=2255 comment="Nirvana"
add chain=virus protocol=tcp action=drop dst-port=2283 comment="Hvl RAT"
add chain=virus protocol=tcp action=drop dst-port=2300 comment="Xplorer"
add chain=virus protocol=tcp action=drop dst-port=2311 comment="Studio 54"
add chain=virus protocol=tcp action=drop dst-port=2330-2339 comment="Contact"
add chain=virus protocol=udp action=drop dst-port=2339 comment="Voice Spy"
add chain=virus protocol=tcp action=drop dst-port=2345 comment="Doly Trojan"
add chain=virus protocol=tcp action=drop dst-port=2565 comment="Striker trojan"
add chain=virus protocol=tcp action=drop dst-port=2583 comment="WinCrash"
add chain=virus protocol=tcp action=drop dst-port=2600 comment="Digital RootBeer"
add chain=virus protocol=tcp action=drop dst-port=2716 comment="The Prayer"
add chain=virus protocol=tcp action=drop dst-port=2773-2774 comment="SubSeven, SubSeven 2.1 Gold"
add chain=virus protocol=tcp action=drop dst-port=2801 comment="Phineas Phucker"
add chain=virus protocol=udp action=drop dst-port=2989 comment="Remote Administration Tool RAT"
add chain=virus protocol=tcp action=drop dst-port=3000 comment="Remote Shut"
add chain=virus protocol=tcp action=drop dst-port=3024 comment="WinCrash"
add chain=virus protocol=tcp action=drop dst-port=3031 comment="Microspy"
add chain=virus protocol=tcp action=drop dst-port=3128 comment="Reverse WWW Tunnel Backdoor, RingZero"
add chain=virus protocol=tcp action=drop dst-port=3129 comment="Masters Paradise"
add chain=virus protocol=tcp action=drop dst-port=3150 comment="The Invasor"
add chain=virus protocol=udp action=drop dst-port=3150 comment="Deep Throat, Foreplay, Mini Backlash"
add chain=virus protocol=tcp action=drop dst-port=3456 comment="Terror trojan"
add chain=virus protocol=tcp action=drop dst-port=3459 comment="Eclipse 2000, Sanctuary"
add chain=virus protocol=tcp action=drop dst-port=3700 comment="Portal of Doom"
add chain=virus protocol=tcp action=drop dst-port=3777 comment="PsychWard"
add chain=virus protocol=tcp action=drop dst-port=3791-3801 comment="Total Solar Eclypse"
add chain=virus protocol=tcp action=drop dst-port=4000 comment="SkyDance"
add chain=virus protocol=tcp action=drop dst-port=4092 comment="WinCrash"
add chain=virus protocol=tcp action=drop dst-port=4242 comment="Virtual Hacking Machine VHM"
add chain=virus protocol=tcp action=drop dst-port=4321 comment="BoBo"
add chain=virus protocol=tcp action=drop dst-port=4444 comment="Prosiak, Swift Remote"
add chain=virus protocol=tcp action=drop dst-port=4567 comment="File Nail"
add chain=virus protocol=tcp action=drop dst-port=4590 comment="ICQ Trojan"
add chain=virus protocol=tcp action=drop dst-port=4950 comment="ICQ Trogen Lm"
add chain=virus protocol=tcp action=drop dst-port=5000 comment="Back Door Setup, Blazer5, Bubbel, ICKiller, Ra1d, Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=5001 comment="Back Door Setup, Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=5002 comment="cd00r, Shaft"
add chain=virus protocol=tcp action=drop dst-port=5010 comment="Solo"
add chain=virus protocol=tcp action=drop dst-port=5011 comment="One of the Last Trojans OOTLT, One of the Last Trojans OOTLT, modified"
add chain=virus protocol=tcp action=drop dst-port=5025 comment="WM Remote KeyLogger"
add chain=virus protocol=tcp action=drop dst-port=5031-5032 comment="Net Metropolitan"
add chain=virus protocol=tcp action=drop dst-port=5321 comment="Firehotcker"
add chain=virus protocol=tcp action=drop dst-port=5333 comment="Backage, NetDemon"
add chain=virus protocol=tcp action=drop dst-port=5343 comment="wCrat WC Remote Administration Tool"
add chain=virus protocol=tcp action=drop dst-port=5400-5402 comment="Back Construction, Blade Runner"
add chain=virus protocol=tcp action=drop dst-port=5512 comment="Illusion Mailer"
add chain=virus protocol=tcp action=drop dst-port=5534 comment="The Flu"
add chain=virus protocol=tcp action=drop dst-port=5550 comment="Xtcp"
add chain=virus protocol=tcp action=drop dst-port=5555 comment="ServeMe"
add chain=virus protocol=tcp action=drop dst-port=5556-5557 comment="BO Facil"
add chain=virus protocol=tcp action=drop dst-port=5569 comment="Robo-Hack"
add chain=virus protocol=tcp action=drop dst-port=5637-5638 comment="PC Crasher"
add chain=virus protocol=tcp action=drop dst-port=5742 comment="WinCrash"
add chain=virus protocol=tcp action=drop dst-port=5760 comment="Portmap Remote Root Linux Exploit"
add chain=virus protocol=tcp action=drop dst-port=5880-5889 comment="Y3K RAT"
add chain=virus protocol=tcp action=drop dst-port=6000 comment="The Thing"
add chain=virus protocol=tcp action=drop dst-port=6006 comment="Bad Blood"
add chain=virus protocol=tcp action=drop dst-port=6272 comment="Secret Service"

part 2
add chain=virus protocol=tcp action=drop dst-port=6400 comment="The Thing"
add chain=virus protocol=tcp action=drop dst-port=6661 comment="TEMan, Weia-Meia"
add chain=virus protocol=tcp action=drop dst-port=6666 comment="Dark Connection Inside, NetBus worm"
add chain=virus protocol=tcp action=drop dst-port=6667 comment="Dark FTP, ScheduleAgent, SubSeven, Subseven 2.1.4 DefCon 8, Trinity, WinSatan"
add chain=virus protocol=tcp action=drop dst-port=6669 comment="Host Control, Vampire"
add chain=virus protocol=tcp action=drop dst-port=6670 comment="BackWeb Server, Deep Throat, Foreplay, WinNuke eXtreame"
add chain=virus protocol=tcp action=drop dst-port=6711 comment="BackDoor-G, SubSeven, VP Killer"
add chain=virus protocol=tcp action=drop dst-port=6712 comment="Funny trojan, SubSeven"
add chain=virus protocol=tcp action=drop dst-port=6713 comment="SubSeven"
add chain=virus protocol=tcp action=drop dst-port=6723 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=6771 comment="Deep Throat, Foreplay"
add chain=virus protocol=tcp action=drop dst-port=6776 comment="2000 Cracks, BackDoor-G, SubSeven, VP Killer"
add chain=virus protocol=udp action=drop dst-port=6838 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=6883 comment="Delta Source DarkStar"
add chain=virus protocol=tcp action=drop dst-port=6912 comment="Shit Heep"
add chain=virus protocol=tcp action=drop dst-port=6939 comment="Indoctrination"
add chain=virus protocol=tcp action=drop dst-port=6969-6970 comment="GateCrasher, IRC 3, Net Controller, Priority"
add chain=virus protocol=tcp action=drop dst-port=7000 comment="Exploit Translation Server, Kazimas, Remote Grab, SubSeven, SubSeven 2.1 Gold"
add chain=virus protocol=tcp action=drop dst-port=7001 comment="Freak88, Freak2k"
add chain=virus protocol=tcp action=drop dst-port=7215 comment="SubSeven, SubSeven 2.1 Gold"
add chain=virus protocol=tcp action=drop dst-port=7300-7308 comment="NetMonitor"
add chain=virus protocol=tcp action=drop dst-port=7424 comment="Host Control"
add chain=virus protocol=udp action=drop dst-port=7424 comment="Host Control"
add chain=virus protocol=tcp action=drop dst-port=7597 comment="Qaz"
add chain=virus protocol=tcp action=drop dst-port=7626 comment="Glacier"
add chain=virus protocol=tcp action=drop dst-port=7777 comment="God Message, Tini"
add chain=virus protocol=tcp action=drop dst-port=7789 comment="Back Door Setup, ICKiller"
add chain=virus protocol=tcp action=drop dst-port=7891 comment="The ReVeNgEr"
add chain=virus protocol=tcp action=drop dst-port=7983 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=8787 comment="Back Orifice 2000"
add chain=virus protocol=tcp action=drop dst-port=8988 comment="BacHack"
add chain=virus protocol=tcp action=drop dst-port=8989 comment="Rcon, Recon, Xcon"
add chain=virus protocol=tcp action=drop dst-port=9000 comment="Netministrator"
add chain=virus protocol=udp action=drop dst-port=9325 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=9400 comment="InCommand"
add chain=virus protocol=tcp action=drop dst-port=9872-9875 comment="Portal of Doom"
add chain=virus protocol=tcp action=drop dst-port=9876 comment="Cyber Attacker, Rux"
add chain=virus protocol=tcp action=drop dst-port=9878 comment="TransScout"
add chain=virus protocol=tcp action=drop dst-port=9989 comment="Ini-Killer"
add chain=virus protocol=tcp action=drop dst-port=9999 comment="The Prayer"
add chain=virus protocol=tcp action=drop dst-port=10000-10005 comment="OpwinTRojan"
add chain=virus protocol=udp action=drop dst-port=10067 comment="Portal of Doom"
add chain=virus protocol=tcp action=drop dst-port=10085-10086 comment="Syphillis"
add chain=virus protocol=tcp action=drop dst-port=10100 comment="Control Total, Gift trojan"
add chain=virus protocol=tcp action=drop dst-port=10101 comment="BrainSpy, Silencer"
add chain=virus protocol=udp action=drop dst-port=10167 comment="Portal of Doom"
add chain=virus protocol=tcp action=drop dst-port=10520 comment="Acid Shivers"
add chain=virus protocol=tcp action=drop dst-port=10528 comment="Host Control"
add chain=virus protocol=tcp action=drop dst-port=10607 comment="Coma"
add chain=virus protocol=udp action=drop dst-port=10666 comment="Ambush"
add chain=virus protocol=tcp action=drop dst-port=11000 comment="Senna Spy Trojan Generator"
add chain=virus protocol=tcp action=drop dst-port=11050-11051 comment="Host Control"
add chain=virus protocol=tcp action=drop dst-port=11223 comment="Progenic trojan, Secret Agent"
add chain=virus protocol=tcp action=drop dst-port=12076 comment="Gjamer"
add chain=virus protocol=tcp action=drop dst-port=12223 comment="Hack´99 KeyLogger"
add chain=virus protocol=tcp action=drop dst-port=12345 comment="Ashley, cron crontab, Fat Bitch trojan, GabanBus, icmp_client.c, icmp_pipe.c, Mypic, NetBus, NetBus Toy, NetBus worm, Pie Bill Gates, Whack Job, X-bill"
add chain=virus protocol=tcp action=drop dst-port=12346 comment="Fat Bitch trojan, GabanBus, NetBus, X-bill"
add chain=virus protocol=tcp action=drop dst-port=12349 comment="BioNet"
add chain=virus protocol=tcp action=drop dst-port=12361-12363 comment="Whack-a-mole"
add chain=virus protocol=udp action=drop dst-port=12623 comment="DUN Control"
add chain=virus protocol=tcp action=drop dst-port=12624 comment="ButtMan"
add chain=virus protocol=tcp action=drop dst-port=12631 comment="Whack Job"
add chain=virus protocol=tcp action=drop dst-port=12754 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=13000 comment="Senna Spy Trojan Generator, Senna Spy Trojan Generator"
add chain=virus protocol=tcp action=drop dst-port=13010 comment="Hacker Brasil HBR"
add chain=virus protocol=tcp action=drop dst-port=13013-13014 comment="PsychWard"
add chain=virus protocol=tcp action=drop dst-port=13223 comment="Hack´99 KeyLogger"
add chain=virus protocol=tcp action=drop dst-port=13473 comment="Chupacabra"
add chain=virus protocol=tcp action=drop dst-port=14500-14503 comment="PC Invader"
add chain=virus protocol=tcp action=drop dst-port=15000 comment="NetDemon"
add chain=virus protocol=tcp action=drop dst-port=15092 comment="Host Control"
add chain=virus protocol=tcp action=drop dst-port=15104 comment="Mstream"
add chain=virus protocol=tcp action=drop dst-port=15382 comment="SubZero"
add chain=virus protocol=tcp action=drop dst-port=15858 comment="CDK"
add chain=virus protocol=tcp action=drop dst-port=16484 comment="Mosucker"
add chain=virus protocol=tcp action=drop dst-port=16660 comment="Stacheldraht"
add chain=virus protocol=tcp action=drop dst-port=16772 comment="ICQ Revenge"
add chain=virus protocol=tcp action=drop dst-port=16959 comment="SubSeven, Subseven 2.1.4 DefCon 8"
add chain=virus protocol=tcp action=drop dst-port=16969 comment="Priority"
add chain=virus protocol=tcp action=drop dst-port=17166 comment="Mosaic"
add chain=virus protocol=tcp action=drop dst-port=17300 comment="Kuang2 the virus"
add chain=virus protocol=tcp action=drop dst-port=17449 comment="Kid Terror"
add chain=virus protocol=tcp action=drop dst-port=17499-17500 comment="CrazzyNet"
add chain=virus protocol=tcp action=drop dst-port=17569 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=17593 comment="Audiodoor"
add chain=virus protocol=tcp action=drop dst-port=17777 comment="Nephron"
add chain=virus protocol=udp action=drop dst-port=18753 comment="Shaft"
add chain=virus protocol=tcp action=drop dst-port=19864 comment="ICQ Revenge"
add chain=virus protocol=tcp action=drop dst-port=20000 comment="Millenium"
add chain=virus protocol=tcp action=drop dst-port=20001 comment="Millenium, Millenium Lm"
add chain=virus protocol=tcp action=drop dst-port=20002 comment="AcidkoR"
add chain=virus protocol=tcp action=drop dst-port=20005 comment="Mosucker"
add chain=virus protocol=tcp action=drop dst-port=20023 comment="VP Killer"
add chain=virus protocol=tcp action=drop dst-port=20034 comment="NetBus 2.0 Pro, NetBus 2.0 Pro Hidden, NetRex, Whack Job"
add chain=virus protocol=tcp action=drop dst-port=20203 comment="Chupacabra"
add chain=virus protocol=tcp action=drop dst-port=20331 comment="BLA trojan"
add chain=virus protocol=tcp action=drop dst-port=20432 comment="Shaft"
add chain=virus protocol=udp action=drop dst-port=20433 comment="Shaft"
add chain=virus protocol=tcp action=drop dst-port=21544 comment="GirlFriend, Kid Terror"
add chain=virus protocol=tcp action=drop dst-port=21554 comment="Exploiter, Kid Terror, Schwindler, Winsp00fer"
add chain=virus protocol=tcp action=drop dst-port=22222 comment="Donald Dick, Prosiak, Ruler, RUX The TIc.K"
add chain=virus protocol=tcp action=drop dst-port=23005-23006 comment="NetTrash"
add chain=virus protocol=tcp action=drop dst-port=23023 comment="Logged"
add chain=virus protocol=tcp action=drop dst-port=23032 comment="Amanda"
add chain=virus protocol=tcp action=drop dst-port=23432 comment="Asylum"
add chain=virus protocol=tcp action=drop dst-port=23456 comment="Evil FTP, Ugly FTP, Whack Job"
add chain=virus protocol=tcp action=drop dst-port=23476 comment="Donald Dick"
add chain=virus protocol=udp action=drop dst-port=23476 comment="Donald Dick"
add chain=virus protocol=tcp action=drop dst-port=23477 comment="Donald Dick"
add chain=virus protocol=tcp action=drop dst-port=23777 comment="InetSpy"
add chain=virus protocol=tcp action=drop dst-port=24000 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=25685-25982 comment="Moonpie"
add chain=virus protocol=udp action=drop dst-port=26274 comment="Delta Source"
add chain=virus protocol=tcp action=drop dst-port=26681 comment="Voice Spy"
add chain=virus protocol=tcp action=drop dst-port=27374 comment="Bad Blood, Ramen, Seeker, SubSeven, SubSeven 2.1 Gold, Subseven 2.1.4 DefCon 8, SubSeven Muie, Ttfloader"
add chain=virus protocol=udp action=drop dst-port=27444 comment="Trinoo"
add chain=virus protocol=tcp action=drop dst-port=27573 comment="SubSeven"
add chain=virus protocol=tcp action=drop dst-port=27665 comment="Trinoo"
add chain=virus protocol=tcp action=drop dst-port=28678 comment="Exploit"er
add chain=virus protocol=tcp action=drop dst-port=29104 comment="NetTrojan"
add chain=virus protocol=tcp action=drop dst-port=29369 comment="ovasOn"
add chain=virus protocol=tcp action=drop dst-port=29891 comment="The Unexplained"
add chain=virus protocol=tcp action=drop dst-port=30000 comment="Infector"
add chain=virus protocol=tcp action=drop dst-port=30001 comment="ErrOr32"
add chain=virus protocol=tcp action=drop dst-port=30003 comment="Lamers Death"
add chain=virus protocol=tcp action=drop dst-port=30029 comment="AOL trojan"
add chain=virus protocol=tcp action=drop dst-port=30100-30133 comment="NetSphere"
add chain=virus protocol=udp action=drop dst-port=30103 comment="NetSphere"
add chain=virus protocol=tcp action=drop dst-port=30303 comment="Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=30947 comment="Intruse"
add chain=virus protocol=tcp action=drop dst-port=30999 comment="Kuang2"
add chain=virus protocol=tcp action=drop dst-port=31335 comment="Trinoo"
add chain=virus protocol=tcp action=drop dst-port=31336 comment="Bo Whack, Butt Funnel"
add chain=virus protocol=tcp action=drop dst-port=31337 comment="Back Fire, Back Orifice 1.20 patches, Back Orifice Lm, Back Orifice russian, Baron Night, Beeone, BO client, BO Facil, BO spy, BO2, cron crontab, Freak88, Freak2k, icmp_pipe.c, Sockdmini"
add chain=virus protocol=udp action=drop dst-port=31337 comment="Back Orifice, Deep BO"
add chain=virus protocol=tcp action=drop dst-port=31338 comment="Back Orifice, Butt Funnel, NetSpy DK"
add chain=virus protocol=udp action=drop dst-port=31338 comment="Deep BO"
add chain=virus protocol=tcp action=drop dst-port=31339 comment="NetSpy DK"
add chain=virus protocol=tcp action=drop dst-port=31666 comment="BOWhack"
add chain=virus protocol=tcp action=drop dst-port=31785-31792 comment="Hack a Tack"
add chain=virus protocol=udp action=drop dst-port=31791-31792 comment="Hack a Tack"
add chain=virus protocol=tcp action=drop dst-port=32001 comment="Donald Dick"
add chain=virus protocol=tcp action=drop dst-port=32100 comment="Peanut Brittle, Project nEXT"
add chain=virus protocol=tcp action=drop dst-port=32418 comment="Acid Battery"
add chain=virus protocol=tcp action=drop dst-port=33270 comment="Trinity"
add chain=virus protocol=tcp action=drop dst-port=33333 comment="Blakharaz, Prosiak"
add chain=virus protocol=tcp action=drop dst-port=33577-33777 comment="Son of PsychWard"
add chain=virus protocol=tcp action=drop dst-port=33911 comment="Spirit 2000, Spirit 2001"
add chain=virus protocol=tcp action=drop dst-port=34324 comment="Big Gluck, TN"
add chain=virus protocol=tcp action=drop dst-port=34444 comment="Donald Dick"
add chain=virus protocol=udp action=drop dst-port=34555-35555 comment="Trinoo for Windows"
add chain=virus protocol=tcp action=drop dst-port=37237 comment="Mantis"
add chain=virus protocol=tcp action=drop dst-port=37651 comment="Yet Another Trojan YAT"
add chain=virus protocol=tcp action=drop dst-port=40412 comment="The Spy"
add chain=virus protocol=tcp action=drop dst-port=40421 comment="Agent 40421, Masters Paradise"
add chain=virus protocol=tcp action=drop dst-port=40422-40426 comment="Masters Paradise"
add chain=virus protocol=tcp action=drop dst-port=41337 comment="Storm"
add chain=virus protocol=tcp action=drop dst-port=41666 comment="Remote Boot Tool RBT, Remote Boot Tool RBT"
add chain=virus protocol=tcp action=drop dst-port=44444 comment="Prosiak"
add chain=virus protocol=tcp action=drop dst-port=44575 comment="Exploiter"
add chain=virus protocol=udp action=drop dst-port=47262 comment="Delta Source"
add chain=virus protocol=tcp action=drop dst-port=49301 comment="OnLine KeyLogger"
add chain=virus protocol=tcp action=drop dst-port=50130 comment="Enterprise"
add chain=virus protocol=tcp action=drop dst-port=50505 comment="Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=50766 comment="Fore, Schwindler"
add chain=virus protocol=tcp action=drop dst-port=51966 comment="Cafeini"
add chain=virus protocol=tcp action=drop dst-port=52317 comment="Acid Battery 2000"
add chain=virus protocol=tcp action=drop dst-port=53001 comment="Remote Windows Shutdown RWS"

part 3

add chain=virus protocol=tcp action=drop dst-port=54283 comment="SubSeven, SubSeven 2.1 Gold"
add chain=virus protocol=tcp action=drop dst-port=54320 comment="Back Orifice 2000"
add chain=virus protocol=tcp action=drop dst-port=54321 comment="Back Orifice 2000, School Bus"
add chain=virus protocol=tcp action=drop dst-port=55165 comment="File Manager trojan, File Manager trojan, WM Trojan Generator"
add chain=virus protocol=tcp action=drop dst-port=55166 comment="WM Trojan Generator"
add chain=virus protocol=tcp action=drop dst-port=57341 comment="NetRaider"
add chain=virus protocol=tcp action=drop dst-port=58339 comment="Butt Funnel"
add chain=virus protocol=tcp action=drop dst-port=60000 comment="Deep Throat, Foreplay, Sockets des Troie"
add chain=virus protocol=tcp action=drop dst-port=60001 comment="Trinity"
add chain=virus protocol=tcp action=drop dst-port=60068 comment="Xzip 6000068"
add chain=virus protocol=tcp action=drop dst-port=60411 comment="Connection"
add chain=virus protocol=tcp action=drop dst-port=61348 comment="Bunker-Hill"
add chain=virus protocol=tcp action=drop dst-port=61466 comment="TeleCommando"
add chain=virus protocol=tcp action=drop dst-port=61603 comment="Bunker-Hill"
add chain=virus protocol=tcp action=drop dst-port=63485 comment="Bunker-Hill"
add chain=virus protocol=tcp action=drop dst-port=64101 comment="Taskman"
add chain=virus protocol=tcp action=drop dst-port=65000 comment="Devil, Sockets des Troie, Stacheldraht"
add chain=virus protocol=tcp action=drop dst-port=65390 comment="Eclypse"
add chain=virus protocol=tcp action=drop dst-port=65421 comment="Jade"
add chain=virus protocol=tcp action=drop dst-port=65432 comment="The Traitor th3tr41t0r"
add chain=virus protocol=udp action=drop dst-port=65432 comment="The Traitor th3tr41t0r"
add chain=virus protocol=tcp action=drop dst-port=65534 comment="sbin initd"
add chain=virus protocol=tcp action=drop dst-port=65535 comment="RC1 trojan"
add chain=forward action=jump jump-target=virus comment="jump to the virus chain"

sumber

Daftar Port Virus di mikrotik

add chain=forward connection-state=invalid action=drop comment=”drop invalid connections” disabled=no
add chain=forward protocol=tcp dst-port=28 action=drop comment=” Amanda.200″
add chain=forward protocol=tcp dst-port=31 action=drop comment=” MastersParadise.920″
add chain=forward protocol=tcp dst-port=68 action=drop comment=” Subseven.100″
add chain=forward protocol=tcp dst-port=142 action=drop comment=” NetTaxi.180″
add chain=forward protocol=tcp dst-port=146 action=drop comment=” Infector.141, Intruder.100, Intruder.100″
add chain=forward protocol=tcp dst-port=171 action=drop comment=” ATrojan.200″
add chain=forward protocol=tcp dst-port=285-286 action=drop comment=” WCTrojan.100″
add chain=forward protocol=tcp dst-port=334 action=drop comment=” Backage.310″
add chain=forward protocol=tcp dst-port=370 action=drop comment=” NeuroticKat.120, NeuroticKat.130″
add chain=forward protocol=tcp dst-port=413 action=drop comment=” Coma.109″
add chain=forward protocol=tcp dst-port=420 action=drop comment=” Breach.450″
add chain=forward protocol=tcp dst-port=555 action=drop comment=” Id2001.100, PhaseZero.100, StealthSpy.100″
add chain=forward protocol=tcp dst-port=623 action=drop comment=” Rtb666.160″
add chain=forward protocol=tcp dst-port=660 action=drop comment=” Zaratustra.100″
add chain=forward protocol=tcp dst-port=661 action=drop comment=” Noknok.800, Noknok.820″
add chain=forward protocol=tcp dst-port=666 action=drop comment=” BackConstruction.210, BackConstruction.250, Bla.100, Bla.200, Bla.400, Bla.503, Cain.150, Dimbus.100, Noknok.820, Ripper.100, SatansBackdoor.100, SatansBackdoor.101, SatansBackdoor.102, Unicorn.100, Unicorn.101, Unicorn.110″
add chain=forward protocol=tcp dst-port=667 action=drop comment=” SniperNet.210, Snipernet.220″
add chain=forward protocol=tcp dst-port=668 action=drop comment=” Unicorn.101, Unicorn.110″
add chain=forward protocol=tcp dst-port=680 action=drop comment=” Rtb666.160″
add chain=forward protocol=tcp dst-port=777 action=drop comment=” Tiny.100, Undetected.230, Undetected.300, Undetected.310, Undetected.320, Undetected.330, Undetected.331, Undetected.332″
add chain=forward protocol=tcp dst-port=785 action=drop comment=” NetworkTerrorist.100″
add chain=forward protocol=tcp dst-port=800 action=drop comment=” NeuroticKitten.010″
add chain=forward protocol=tcp dst-port=831 action=drop comment=” NeuroticKat.100, NeuroticKat.120, NeuroticKat.130″
add chain=forward protocol=tcp dst-port=901 action=drop comment=” NetDevil.130, NetDevil.140″
add chain=forward protocol=tcp dst-port=1000 action=drop comment=” DerSpaeher.200″
add chain=forward protocol=tcp dst-port=1001 action=drop comment=” Silencer.100″
add chain=forward protocol=tcp dst-port=1008 action=drop comment=” AutoSpy.100″
add chain=forward protocol=tcp dst-port=1010 action=drop comment=” DerSpaeher.200″
add chain=forward protocol=tcp dst-port=1015 action=drop comment=” Doly.150″
add chain=forward protocol=tcp dst-port=1111 action=drop comment=” TPort.100″
add chain=forward protocol=tcp dst-port=1130 action=drop comment=” Noknok.800, Noknok.820″
add chain=forward protocol=tcp dst-port=1207 action=drop comment=” SoftWAR.100″
add chain=forward protocol=tcp dst-port=1243 action=drop comment=” Subseven.100, SubSeven.110, SubSeven.180, SubSeven.190, Subseven.200″
add chain=forward protocol=tcp dst-port=1245 action=drop comment=” VoodooDoll.006″
add chain=forward protocol=tcp dst-port=1269 action=drop comment=” Matrix.130″
add chain=forward protocol=tcp dst-port=1480 action=drop comment=” RemoteHack.130″
add chain=forward protocol=tcp dst-port=1568 action=drop comment=” RemoteHack.100, RemoteHack.110″
add chain=forward protocol=tcp dst-port=1600-1602 action=drop comment=” DirectConnection.100″
add chain=forward protocol=tcp dst-port=1634 action=drop comment=” NetCrack.100″
add chain=forward protocol=tcp dst-port=1784 action=drop comment=” Snid.120, Snid.212″
add chain=forward protocol=tcp dst-port=1999 action=drop comment=” TransmissionScout.100, TransmissionScout.110″
add chain=forward protocol=tcp dst-port=2000 action=drop comment=” ATrojan.200, InsaneNetwork.400″
add chain=forward protocol=tcp dst-port=2001 action=drop comment=” DIRT.220, TrojanCow.100″
add chain=forward protocol=tcp dst-port=2003 action=drop comment=” TransmissionScout.100, TransmissionScout.110″
add chain=forward protocol=tcp dst-port=2023 action=drop comment=” RipperPro.100″
add chain=forward protocol=tcp dst-port=2040 action=drop comment=” InfernoUploader.100″
add chain=forward protocol=tcp dst-port=2115 action=drop comment=” Bugs.100″
add chain=forward protocol=tcp dst-port=2140 action=drop comment=” DeepThroat.100, DeepThroat.200, DeepThroat.310″
add chain=forward protocol=tcp dst-port=2332 action=drop comment=” SilentSpy.202″
add chain=forward protocol=tcp dst-port=2589 action=drop comment=” Dagger.140″
add chain=forward protocol=tcp dst-port=2600 action=drop comment=” DigitalRootbeer.100″
add chain=forward protocol=tcp dst-port=2989 action=drop comment=” Rat.200″
add chain=forward protocol=tcp dst-port=3128 action=drop comment=” MastersParadise.970″
add chain=forward protocol=tcp dst-port=3129 action=drop comment=” MastersParadise.920, MastersParadise.970″
add chain=forward protocol=tcp dst-port=3150 action=drop comment=” DeepThroat.100, DeepThroat.200, DeepThroat.310, MiniBacklash.110″
add chain=forward protocol=tcp dst-port=3215 action=drop comment=” BlackStar.100, Ghost.230″
add chain=forward protocol=tcp dst-port=3333 action=drop comment=” Daodan.123″
add chain=forward protocol=tcp dst-port=3410 action=drop comment=” OptixPro.100, OptixPro.110″
add chain=forward protocol=tcp dst-port=3456 action=drop comment=” Force.155, TerrorTrojan.100″
add chain=forward protocol=tcp dst-port=3505 action=drop comment=” AutoSpy.130, AutoSpy.140″
add chain=forward protocol=tcp dst-port=3586 action=drop comment=” Snid.120, Snid.212″
add chain=forward protocol=tcp dst-port=3700 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=3723 action=drop comment=” Mantis.100″
add chain=forward protocol=tcp dst-port=3800 action=drop comment=” Eclypse.100″
add chain=forward protocol=tcp dst-port=3996 action=drop comment=” RemoteAnything.364″
add chain=forward protocol=tcp dst-port=4000 action=drop comment=” SkyDance.220, SkyDance.229″
add chain=forward protocol=tcp dst-port=4201 action=drop comment=” Wartrojan.160, Wartrojan.200″
add chain=forward protocol=tcp dst-port=4225 action=drop comment=” SilentSpy.202″
add chain=forward protocol=tcp dst-port=4321 action=drop comment=” Bobo.100″
add chain=forward protocol=tcp dst-port=4444 action=drop comment=” AlexTrojan.200, Crackdown.100″
add chain=forward protocol=tcp dst-port=4488 action=drop comment=” EventHorizon.100″
add chain=forward protocol=tcp dst-port=4523 action=drop comment=” Celine.100″
add chain=forward protocol=tcp dst-port=4545 action=drop comment=” InternalRevise.100, RemoteRevise.150″
add chain=forward protocol=tcp dst-port=4567 action=drop comment=” FileNail.100″
add chain=forward protocol=tcp dst-port=4666 action=drop comment=” Mneah.100″
add chain=forward protocol=tcp dst-port=4950 action=drop comment=” ICQTrojan.100″
add chain=forward protocol=tcp dst-port=5005 action=drop comment=” Aladino.060″
add chain=forward protocol=tcp dst-port=5025 action=drop comment=” Keylogger.WMRemote.100″
add chain=forward protocol=tcp dst-port=5031 action=drop comment=” NetMetro.104″
add chain=forward protocol=tcp dst-port=5032 action=drop comment=” NetMetro.104″
add chain=forward protocol=tcp dst-port=5033 action=drop comment=” NetMetro.104″
add chain=forward protocol=tcp dst-port=5151 action=drop comment=” OptixLite.020, OptixLite.030, OptixLite.040″
add chain=forward protocol=tcp dst-port=5190 action=drop comment=” MBomber.100″
add chain=forward protocol=tcp dst-port=5277 action=drop comment=” WinShell.400″
add chain=forward protocol=tcp dst-port=5343 action=drop comment=” WCRat.100″
add chain=forward protocol=tcp dst-port=5400 action=drop comment=” BackConstruction.120, BackConstruction.150, BladeRunner.080, DeepThroat.300″
add chain=forward protocol=tcp dst-port=5401 action=drop comment=” BackConstruction.120, BackConstruction.150, BackConstruction.210, BackConstruction.250, BladeRunner.080, DeepThroat.300, Mneah.100″
add chain=forward protocol=tcp dst-port=5402 action=drop comment=” BackConstruction.210, BackConstruction.250, BladeRunner.080, DeepThroat.300, Mneah.100″
add chain=forward protocol=tcp dst-port=5534 action=drop comment=” TheFlu.100″
add chain=forward protocol=tcp dst-port=5550 action=drop comment=” XTCP.200, XTCP.201″
add chain=forward protocol=tcp dst-port=5555 action=drop comment=” Noxcape.100, Noxcape.200″
add chain=forward protocol=tcp dst-port=5695 action=drop comment=” Assassin.100″
add chain=forward protocol=tcp dst-port=5714 action=drop comment=” WinCrash.100″
add chain=forward protocol=tcp dst-port=5741 action=drop comment=” WinCrash.100″
add chain=forward protocol=tcp dst-port=5742 action=drop comment=” WinCrash.103″
add chain=forward protocol=tcp dst-port=5802 action=drop comment=” Y3KRat.160″
add chain=forward protocol=tcp dst-port=5810 action=drop comment=” Y3KRat.160″
add chain=forward protocol=tcp dst-port=5838 action=drop comment=” Y3KRat.170″
add chain=forward protocol=tcp dst-port=5858 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5880 action=drop comment=” Y3KRat.140″
add chain=forward protocol=tcp dst-port=5881 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5882 action=drop comment=” Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150″
add chain=forward protocol=tcp dst-port=5883 action=drop comment=” Y3KRat.110, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5884 action=drop comment=” Y3KRat.140, Y3KRat.150″
add chain=forward protocol=tcp dst-port=5885 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5886 action=drop comment=” Y3KRat.120, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5887 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=tcp dst-port=5888 action=drop comment=” Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150″
add chain=forward protocol=tcp dst-port=5889 action=drop comment=” Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150″
add chain=forward protocol=tcp dst-port=5890 action=drop comment=” Y3KRat.140″
add chain=forward protocol=tcp dst-port=6400 action=drop comment=” Thething.100, Thething.150″
add chain=forward protocol=tcp dst-port=6556 action=drop comment=” AutoSpy.120, AutoSpy.122″
add chain=forward protocol=tcp dst-port=6655 action=drop comment=” Aqua.020″
add chain=forward protocol=tcp dst-port=6660 action=drop comment=” LameSpy.095″
add chain=forward protocol=tcp dst-port=6666 action=drop comment=” LameRemote.100, ProjectMayhem.100″
add chain=forward protocol=tcp dst-port=6669 action=drop comment=” Vampire.100″
add chain=forward protocol=tcp dst-port=6670 action=drop comment=” DeepThroat.200, DeepThroat.210″
add chain=forward protocol=tcp dst-port=6671 action=drop comment=” DeepThroat.310″
add chain=forward protocol=tcp dst-port=6699 action=drop comment=” HostControl.101″
add chain=forward protocol=tcp dst-port=6711 action=drop comment=” DeepThroat.300, Noknok.820, SubSeven.180, SubSeven.190″
add chain=forward protocol=tcp dst-port=6712 action=drop comment=” Subseven.100″
add chain=forward protocol=tcp dst-port=6713 action=drop comment=” Subseven.100″
add chain=forward protocol=tcp dst-port=6767 action=drop comment=” NTRC.120″
add chain=forward protocol=tcp dst-port=6776 action=drop comment=” SubSeven.180, SubSeven.190, Subseven.200″
add chain=forward protocol=tcp dst-port=6789 action=drop comment=” Doly.200″
add chain=forward protocol=tcp dst-port=6796 action=drop comment=” SubSeven.214″
add chain=forward protocol=tcp dst-port=6912 action=drop comment=” ShitHeep.100″
add chain=forward protocol=tcp dst-port=6939 action=drop comment=” Indoctrination.100″
add chain=forward protocol=tcp dst-port=6953 action=drop comment=” Lithium.100″
add chain=forward protocol=tcp dst-port=6969 action=drop comment=” 2000Cracks.100, Bigorna.100, Danton.110, Danton.210, Danton.220, Danton.310, Danton.320, Danton.330, GateCrasher.110, NetController.108, Sparta.110, VagrNocker.120″
add chain=forward protocol=tcp dst-port=6970 action=drop comment=” Danton.330″
add chain=forward protocol=tcp dst-port=7001 action=drop comment=” Freak88.100″
add chain=forward protocol=tcp dst-port=7119 action=drop comment=” Massaker.100″
add chain=forward protocol=tcp dst-port=7200 action=drop comment=” Massaker.110″
add chain=forward protocol=tcp dst-port=7300 action=drop comment=” Coced.221″
add chain=forward protocol=tcp dst-port=7301action=drop comment=” Coced.221″
add chain=forward protocol=tcp dst-port=7306 action=drop comment=” NetSpy.200, NetSpy.200″
add chain=forward protocol=tcp dst-port=7410 action=drop comment=” Phoenix.190, Phoenix.200″
add chain=forward protocol=tcp dst-port=7511 action=drop comment=” Genue.100″
add chain=forward protocol=tcp dst-port=7609 action=drop comment=” Snid.120, Snid.212″
add chain=forward protocol=tcp dst-port=7614 action=drop comment=” Wollf.130″
add chain=forward protocol=tcp dst-port=7648 action=drop comment=” BlackStar.100, Ghost.230″
add chain=forward protocol=tcp dst-port=7788 action=drop comment=” Last.2000, Matrix.200″
add chain=forward protocol=tcp dst-port=7826 action=drop comment=” MiniOblivion.010, Oblivion.010″
add chain=forward protocol=tcp dst-port=7887 action=drop comment=” SmallFun.110″
add chain=forward protocol=tcp dst-port=7891 action=drop comment=” Revenger.100″
add chain=forward protocol=tcp dst-port=7979 action=drop comment=” VagrNocker.200″
add chain=forward protocol=tcp dst-port=7997 action=drop comment=” VagrNocker.200″
add chain=forward protocol=tcp dst-port=8000 action=drop comment=” XConsole.100″
add chain=forward protocol=tcp dst-port=8011 action=drop comment=” Way.240″
add chain=forward protocol=tcp dst-port=8012 action=drop comment=” Ptakks.215, Ptakks.217″
add chain=forward protocol=tcp dst-port=8110 action=drop comment=” LoseLove.100″
add chain=forward protocol=tcp dst-port=8111 action=drop comment=” LoseLove.100″
add chain=forward protocol=tcp dst-port=8301 action=drop comment=” LoseLove.100″
add chain=forward protocol=tcp dst-port=8302 action=drop comment=” LoseLove.100″
add chain=forward protocol=tcp dst-port=8372 action=drop comment=” NetBoy.100″
add chain=forward protocol=tcp dst-port=8720 action=drop comment=” Connection.130″
add chain=forward protocol=tcp dst-port=8734 action=drop comment=” AutoSpy.110″
add chain=forward protocol=tcp dst-port=8811 action=drop comment=” Force.155″
add chain=forward protocol=tcp dst-port=8899 action=drop comment=” Last.2000″
add chain=forward protocol=tcp dst-port=9000 action=drop comment=” Aristotles.100″
add chain=forward protocol=tcp dst-port=9301 action=drop comment=” LoseLove.100″
add chain=forward protocol=tcp dst-port=9400 action=drop comment=” InCommand.100, InCommand.110, InCommand.120, InCommand.130, InCommand.140, InCommand.150, InCommand.153, InCommand.160, InCommand.167, InCommand.170″
add chain=forward protocol=tcp dst-port=9401 action=drop comment=” InCommand.100, InCommand.110, InCommand.170″
add chain=forward protocol=tcp dst-port=9402 action=drop comment=” InCommand.100, InCommand.110″
add chain=forward protocol=tcp dst-port=9561 action=drop comment=” CRatPro.110″
add chain=forward protocol=tcp dst-port=9563 action=drop comment=” CRatPro.110″
add chain=forward protocol=tcp dst-port=9580 action=drop comment=” TheefLE.100″
add chain=forward protocol=tcp dst-port=9696 action=drop comment=” Danton.210, Ghost.230″
add chain=forward protocol=tcp dst-port=9697 action=drop comment=” Danton.320, Danton.330, Ghost.230″
add chain=forward protocol=tcp dst-port=9870 action=drop comment=” R3C.100″
add chain=forward protocol=tcp dst-port=9872 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=9873 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=9874 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=9875 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=9876 action=drop comment=” Rux.100, SheepGoat.100″
add chain=forward protocol=tcp dst-port=9877 action=drop comment=” SmallBigBrother.020″
add chain=forward protocol=tcp dst-port=9878 action=drop comment=” SmallBigBrother.020, TransmissionScout.100, TransmissionScout.110, TransmissionScout.120″
add chain=forward protocol=tcp dst-port=9879 action=drop comment=” SmallBigBrother.020″
add chain=forward protocol=tcp dst-port=9999 action=drop comment=” ForcedEntry.100, Infra.100, Prayer.120, Prayer.130, TakeOver.200, TakeOver.300″
add chain=forward protocol=tcp dst-port=10001 action=drop comment=” DTr.130, DTr.140″
add chain=forward protocol=tcp dst-port=10013 action=drop comment=” Amanda.200″
add chain=forward protocol=tcp dst-port=10067 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=10100 action=drop comment=” Gift.240″
add chain=forward protocol=tcp dst-port=10101 action=drop comment=” NewSilencer.100″
add chain=forward protocol=tcp dst-port=10167 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=tcp dst-port=10528 action=drop comment=” HostControl.100, HostControl.260″
add chain=forward protocol=tcp dst-port=10607 action=drop comment=” Coma.109″
add chain=forward protocol=tcp dst-port=10666 action=drop comment=” Ambush.100″
add chain=forward protocol=tcp dst-port=11011 action=drop comment=” Amanda.200″
add chain=forward protocol=tcp dst-port=11050 action=drop comment=” HostControl.101″
add chain=forward protocol=tcp dst-port=11051 action=drop comment=” HostControl.100, HostControl.260″
add chain=forward protocol=tcp dst-port=11223 action=drop comment=” AntiNuke.100, Progenic.100, Progenic.110″
add chain=forward protocol=tcp dst-port=11225 action=drop comment=” Cyn.100, Cyn.103, Cyn.120″
add chain=forward protocol=tcp dst-port=11306 action=drop comment=” Noknok.800, Noknok.820″
add chain=forward protocol=tcp dst-port=11831 action=drop comment=” Katux.200, Latinus.140, Latinus.150, Pest.100, Pest.400″
add chain=forward protocol=tcp dst-port=11991 action=drop comment=” PitfallSurprise.100″
add chain=forward protocol=tcp dst-port=12043 action=drop comment=” Frenzy.2000″
add chain=forward protocol=tcp dst-port=12345 action=drop comment=” Fade.100, Netbus.160, Netbus.170, VagrNocker.400″
add chain=forward protocol=tcp dst-port=12346 action=drop comment=” Netbus.160, Netbus.170″
add chain=forward protocol=tcp dst-port=12348 action=drop comment=” Bionet.210, Bionet.261, Bionet.280, Bionet.302, Bionet.305, Bionet.311, Bionet.313, Bionet.316, Bionet.317″
add chain=forward protocol=tcp dst-port=12349 action=drop comment=” Bionet.084, Bionet.261, Bionet.280, Bionet.302, Bionet.305, Bionet.311, Bionet.313, Bionet.314, Bionet.316, Bionet.317, Bionet.401, Bionet.402″
add chain=forward protocol=tcp dst-port=12389 action=drop comment=” KheSanh.210″
add chain=forward protocol=tcp dst-port=12478 action=drop comment=” Bionet.210″
add chain=forward protocol=tcp dst-port=12623 action=drop comment=” Buttman.090, Buttman.100″
add chain=forward protocol=tcp dst-port=12624 action=drop comment=” Buttman.090, Buttman.100″
add chain=forward protocol=tcp dst-port=12625 action=drop comment=” Buttman.100″
add chain=forward protocol=tcp dst-port=12904 action=drop comment=” Akropolis.100, Rocks.100″
add chain=forward protocol=tcp dst-port=13473 action=drop comment=” Chupacabra.100″
add chain=forward protocol=tcp dst-port=13753 action=drop comment=” AFTP.010″
add chain=forward protocol=tcp dst-port=14100 action=drop comment=” Eurosol.100″
add chain=forward protocol=tcp dst-port=14194 action=drop comment=” CyberSpy.840″
add chain=forward protocol=tcp dst-port=14286 action=drop comment=” HellDriver.100″
add chain=forward protocol=tcp dst-port=14500 action=drop comment=” PCInvader.050, PCInvader.060, PCInvader.070″
add chain=forward protocol=tcp dst-port=14501 action=drop comment=” PCInvader.060, PCInvader.070″
add chain=forward protocol=tcp dst-port=14502 action=drop comment=” PCInvader.050, PCInvader.060, PCInvader.070″
add chain=forward protocol=tcp dst-port=14503 action=drop comment=” PCInvader.050, PCInvader.060, PCInvader.070″
add chain=forward protocol=tcp dst-port=14504 action=drop comment=” PCInvader.050, PCInvader.060″
add chain=forward protocol=tcp dst-port=15092 action=drop comment=” HostControl.100, HostControl.260″
add chain=forward protocol=tcp dst-port=15382 action=drop comment=” SubZero.100″
add chain=forward protocol=tcp dst-port=15432 action=drop comment=” Cyn.210″
add chain=forward protocol=tcp dst-port=15555 action=drop comment=” ICMIBC.100″
add chain=forward protocol=tcp dst-port=16322 action=drop comment=” LastDoor.100″
add chain=forward protocol=tcp dst-port=16484 action=drop comment=” MoSucker.110″
add chain=forward protocol=tcp dst-port=16661 action=drop comment=” Dfch.010″
add chain=forward protocol=tcp dst-port=16969 action=drop comment=” Progenic.100″
add chain=forward protocol=tcp dst-port=16982 action=drop comment=” AcidShiver.100″
add chain=forward protocol=tcp dst-port=17300 action=drop comment=” Kuang.200″
add chain=forward protocol=tcp dst-port=17499 action=drop comment=” CrazzyNet.370, CrazzyNet.375, CrazzyNet.521″
add chain=forward protocol=tcp dst-port=17500 action=drop comment=” CrazzyNet.370, CrazzyNet.375, CrazzyNet.521″
add chain=forward protocol=tcp dst-port=17569 action=drop comment=” Infector.141, Infector.160, Infector.170, Infector.180, Infector.190, Infector.200, Intruder.100, Intruder.100″
add chain=forward protocol=tcp dst-port=17593 action=drop comment=” AudioDoor.120″
add chain=forward protocol=tcp dst-port=19191 action=drop comment=” BlueFire.035, BlueFire.041″
add chain=forward protocol=tcp dst-port=19604 action=drop comment=” Metal.270″
add chain=forward protocol=tcp dst-port=19605 action=drop comment=” Metal.270″
add chain=forward protocol=tcp dst-port=19991 action=drop comment=” Dfch.010″
add chain=forward protocol=tcp dst-port=20000 action=drop comment=” Millenium.100″
add chain=forward protocol=tcp dst-port=20001 action=drop comment=” Millenium.100, PshychoFiles.180″
add chain=forward protocol=tcp dst-port=20002 action=drop comment=” AcidKor.100, PshychoFiles.180″
add chain=forward protocol=tcp dst-port=20005 action=drop comment=” MoSucker.200, MoSucker.210, MoSucker.220″
add chain=forward protocol=tcp dst-port=21212 action=drop comment=” Schwindler.182″
add chain=forward protocol=tcp dst-port=21554 action=drop comment=” Exploiter.100, Exploiter.110, Girlfriend.130, GirlFriend.135″
add chain=forward protocol=tcp dst-port=21579 action=drop comment=” Breach.2001″
add chain=forward protocol=tcp dst-port=21584 action=drop comment=” Breach.2001″
add chain=forward protocol=tcp dst-port=21684 action=drop comment=” Intruse.134″
add chain=forward protocol=tcp dst-port=22068 action=drop comment=” AcidShiver.110″
add chain=forward protocol=tcp dst-port=22115 action=drop comment=” Cyn.120″
add chain=forward protocol=tcp dst-port=22222 action=drop comment=” Prosiak.047, Ruler.141, Rux.300, Rux.400, Rux.500, Rux.600″
add chain=forward protocol=tcp dst-port=22223 action=drop comment=” Rux.400, Rux.500, Rux.600″
add chain=forward protocol=tcp dst-port=22456 action=drop comment=” Bla.200, Bla.503″
add chain=forward protocol=tcp dst-port=22457 action=drop comment=” AcidShiver.120, Bla.200, Bla.503″
add chain=forward protocol=tcp dst-port=22784 action=drop comment=” Intruzzo.110″
add chain=forward protocol=tcp dst-port=22845 action=drop comment=” Breach.450″
add chain=forward protocol=tcp dst-port=22847 action=drop comment=” Breach.450″
add chain=forward protocol=tcp dst-port=23005 action=drop comment=” Infinaeon.110, NetTrash.100, Oxon.110, WinRat.100″
add chain=forward protocol=tcp dst-port=23006 action=drop comment=” Infinaeon.110, NetTrash.100, Oxon.110, WinRat.100″
add chain=forward protocol=tcp dst-port=23032 action=drop comment=” Amanda.200″
add chain=forward protocol=tcp dst-port=23432 action=drop comment=” Asylum.010, Asylum.012, Asylum.013, Asylum.014, MiniAsylum.110″
add chain=forward protocol=tcp dst-port=23456 action=drop comment=” EvilFTP.100, VagrNocker.400″
add chain=forward protocol=tcp dst-port=23476 action=drop comment=” DonaldDick.153, DonaldDick.154, DonaldDick.155″
add chain=forward protocol=tcp dst-port=23477 action=drop comment=” DonaldDick.153″
add chain=forward protocol=tcp dst-port=24000 action=drop comment=” Infector.170″
add chain=forward protocol=tcp dst-port=24307 action=drop comment=” Wildek.020″
add chain=forward protocol=tcp dst-port=25386 action=drop comment=” MoonPie.220″
add chain=forward protocol=tcp dst-port=25486 action=drop comment=” MoonPie.220″
add chain=forward protocol=tcp dst-port=25555 action=drop comment=” FreddyK.100, FreddyK.200″
add chain=forward protocol=tcp dst-port=25556 action=drop comment=” FreddyK.100″
add chain=forward protocol=tcp dst-port=25685 action=drop comment=” MoonPie.010, MoonPie.012, MoonPie.130, MoonPie.220, MoonPie.240, MoonPie.400″
add chain=forward protocol=tcp dst-port=25686 action=drop comment=” MoonPie.135, MoonPie.200, MoonPie.400″
add chain=forward protocol=tcp dst-port=25982 action=drop comment=” MoonPie.135, MoonPie.200″
add chain=forward protocol=tcp dst-port=26274 action=drop comment=” Delta.050″
add chain=forward protocol=tcp dst-port=27160 action=drop comment=” MoonPie.135, MoonPie.200″
add chain=forward protocol=tcp dst-port=27184 action=drop comment=” Alvgus.100, Alvgus.800″
add chain=forward protocol=tcp dst-port=27374 action=drop comment=” Muerte.110, Subseven.210, SubSeven.213″
add chain=forward protocol=tcp dst-port=28429-28436 action=drop comment=” Hack’a'Tack.2000″
add chain=forward protocol=tcp dst-port=29559 action=drop comment=” DuckToy.100, DuckToy.101, Katux.200, Latinus.140, Latinus.150, Pest.100, Pest.400″
add chain=forward protocol=tcp dst-port=29891 action=drop comment=” Unexplained.100″
add chain=forward protocol=tcp dst-port=30000 action=drop comment=” Infector.170″
add chain=forward protocol=tcp dst-port=30001 action=drop comment=” Error32.100″
add chain=forward protocol=tcp dst-port=30003 action=drop comment=” LamersDeath.100″
add chain=forward protocol=tcp dst-port=30029action=drop comment=” AOLTrojan.110″
add chain=forward protocol=tcp dst-port=30100-30103 action=drop comment=” NetSphere.127, NetSphere.130, NetSphere.131″
add chain=forward protocol=tcp dst-port=30103 action=drop comment=” NetSphere.131″
add chain=forward protocol=tcp dst-port=30947 action=drop comment=” Intruse.134″
add chain=forward protocol=tcp dst-port=31320 action=drop comment=” LittleWitch.400, LittleWitch.420″
add chain=forward protocol=tcp dst-port=31337 action=drop comment=” BackOrifice.120, Khaled.100, OPC.200″
add chain=forward protocol=tcp dst-port=31415 action=drop comment=” Lithium.101″
add chain=forward protocol=tcp dst-port=31416 action=drop comment=” Lithium.100, Lithium.101″
add chain=forward protocol=tcp dst-port=31557 action=drop comment=” Xanadu.110″
add chain=forward protocol=tcp dst-port=31631 action=drop comment=” CleptoManicos.100″
add chain=forward protocol=tcp dst-port=31745 action=drop comment=” Buschtrommel.100, Buschtrommel.122″
add chain=forward protocol=tcp dst-port=31785 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=tcp dst-port=31787 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=tcp dst-port=31789 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=tcp dst-port=31791 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=tcp dst-port=31887 action=drop comment=” BDDT.100″
add chain=forward protocol=tcp dst-port=31889 action=drop comment=” BDDT.100″
add chain=forward protocol=tcp dst-port=32100 action=drop comment=” ProjectNext.053″
add chain=forward protocol=tcp dst-port=32418 action=drop comment=” AcidBattery.100″
add chain=forward protocol=tcp dst-port=32791 action=drop comment=” Akropolis.100, Rocks.100″
add chain=forward protocol=tcp dst-port=33291 action=drop comment=” RemoteHak.001″
add chain=forward protocol=tcp dst-port=33333 action=drop comment=” Blackharaz.100, Prosiak.047, SubSeven.214″
add chain=forward protocol=tcp dst-port=33577 action=drop comment=” SonOfPsychward.020″
add chain=forward protocol=tcp dst-port=34324 action=drop comment=” TelnetServer.100″
add chain=forward protocol=tcp dst-port=34763 action=drop comment=” Infector.180, Infector.190, Infector.200″
add chain=forward protocol=tcp dst-port=35000 action=drop comment=” Infector.190, Infector.200″
add chain=forward protocol=tcp dst-port=35600 action=drop comment=” Subsari.140″
add chain=forward protocol=tcp dst-port=36794 action=drop comment=” BugBear.100″
add chain=forward protocol=tcp dst-port=37237 action=drop comment=” Mantis.020″
add chain=forward protocol=tcp dst-port=37651 action=drop comment=” YAT.210″
add chain=forward protocol=tcp dst-port=37653 action=drop comment=” YAT.310″
add chain=forward protocol=tcp dst-port=40308 action=drop comment=” Subsari.140″
add chain=forward protocol=tcp dst-port=40412 action=drop comment=” TheSpy.100″
add chain=forward protocol=tcp dst-port=40421 action=drop comment=” MastersParadise.970″
add chain=forward protocol=tcp dst-port=40422 action=drop comment=” MastersParadise.970″
add chain=forward protocol=tcp dst-port=40999 action=drop comment=” DiemsMutter.110, DiemsMutter.140″
add chain=forward protocol=tcp dst-port=41626 action=drop comment=” Shah.100″
add chain=forward protocol=tcp dst-port=44444 action=drop comment=” Prosiak.070″
add chain=forward protocol=tcp dst-port=45673 action=drop comment=” Akropolis.100, Rocks.100″
add chain=forward protocol=tcp dst-port=47262 action=drop comment=” Delta.050″
add chain=forward protocol=tcp dst-port=48006 action=drop comment=” Fragglerock.200″
add chain=forward protocol=tcp dst-port=49683 action=drop comment=” HolzPferd.210″
add chain=forward protocol=tcp dst-port=50000 action=drop comment=” Infector.180″
add chain=forward protocol=tcp dst-port=50130 action=drop comment=” Enterprise.100″
add chain=forward protocol=tcp dst-port=50766 action=drop comment=” Fore.100″
add chain=forward protocol=tcp dst-port=51234 action=drop comment=” Cyn.210″
add chain=forward protocol=tcp dst-port=51966 action=drop comment=” Cafeini.080, Cafeini.110″
add chain=forward protocol=tcp dst-port=54321 action=drop comment=” PCInvader.010″
add chain=forward protocol=tcp dst-port=57341 action=drop comment=” NetRaider.100″
add chain=forward protocol=tcp dst-port=57922 action=drop comment=” Bionet.084″
add chain=forward protocol=tcp dst-port=58008 action=drop comment=” Tron.100″
add chain=forward protocol=tcp dst-port=58009 action=drop comment=” Tron.100″
add chain=forward protocol=tcp dst-port=59090 action=drop comment=” AcidReign.200″
add chain=forward protocol=tcp dst-port=59211 action=drop comment=” DuckToy.100, DuckToy.101″
add chain=forward protocol=tcp dst-port=59345 action=drop comment=” NewFuture.100″
add chain=forward protocol=tcp dst-port=60000 action=drop comment=” DeepThroat.300, MiniBacklash.100, MiniBacklash.101, MiniBacklash.101″
add chain=forward protocol=tcp dst-port=60411 action=drop comment=” Connection.100, Connection.130″
add chain=forward protocol=tcp dst-port=60412 action=drop comment=” Connection.130″
add chain=forward protocol=tcp dst-port=60552 action=drop comment=” RoxRat.100″
add chain=forward protocol=tcp dst-port=63536 action=drop comment=” InsaneNetwork.500″
add chain=forward protocol=tcp dst-port=63878 action=drop comment=” AphexFTP.100″
add chain=forward protocol=tcp dst-port=63879 action=drop comment=” AphexFTP.100″
add chain=forward protocol=tcp dst-port=64969 action=drop comment=” Lithium.100″
add chain=forward protocol=tcp dst-port=65000 action=drop comment=” Socket.100″
add chain=forward protocol=udp dst-port=1 action=drop comment=” SocketsDeTroie.250″
add chain=forward protocol=udp dst-port=666 action=drop comment=” Bla.200, Bla.400, Bla.503, Noknok.820″
add chain=forward protocol=udp dst-port=1130 action=drop comment=” Noknok.800, Noknok.820″
add chain=forward protocol=udp dst-port=2140 action=drop comment=” DeepThroat.100, DeepThroat.200, DeepThroat.310″
add chain=forward protocol=udp dst-port=2989 action=drop comment=” Rat.200″
add chain=forward protocol=udp dst-port=3128 action=drop comment=” MastersParadise.970″
add chain=forward protocol=udp dst-port=3129 action=drop comment=” MastersParadise.920, MastersParadise.970″
add chain=forward protocol=udp dst-port=3150 action=drop comment=” DeepThroat.100, DeepThroat.200, DeepThroat.310, MiniBacklash.110″
add chain=forward protocol=udp dst-port=3333 action=drop comment=” Daodan.123″
add chain=forward protocol=udp dst-port=3800 action=drop comment=” Eclypse.100″
add chain=forward protocol=udp dst-port=3996 action=drop comment=” RemoteAnything.364″
add chain=forward protocol=udp dst-port=4000 action=drop comment=” RemoteAnything.364″
add chain=forward protocol=udp dst-port=5555 action=drop comment=” Daodan.123″
add chain=forward protocol=udp dst-port=5881 action=drop comment=” Y3KRat.110, Y3KRat.140″
add chain=forward protocol=udp dst-port=5882 action=drop comment=” Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.140, Y3KRat.150″
add chain=forward protocol=udp dst-port=5883 action=drop comment=” Y3KRat.110, Y3KRat.140″
add chain=forward protocol=udp dst-port=5884 action=drop comment=” Y3KRat.140, Y3KRat.150″
add chain=forward protocol=udp dst-port=5885 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=udp dst-port=5886 action=drop comment=” Y3KRat.120, Y3KRat.140″
add chain=forward protocol=udp dst-port=5887 action=drop comment=” Y3KRat.110, Y3KRat.120, Y3KRat.140″
add chain=forward protocol=udp dst-port=5888 action=drop comment=” Y3KRat.100, Y3KRat.110, Y3KRat.120, Y3KRat.150″
add chain=forward protocol=udp dst-port=6953 action=drop comment=” Lithium.100″
add chain=forward protocol=udp dst-port=8012 action=drop comment=” Ptakks.217″
add chain=forward protocol=udp dst-port=10067 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=udp dst-port=10167 action=drop comment=” PortalOfDoom.100″
add chain=forward protocol=udp dst-port=10666 action=drop comment=” Ambush.100″
add chain=forward protocol=udp dst-port=11225 action=drop comment=” Cyn.100, Cyn.103, Cyn.120″
add chain=forward protocol=udp dst-port=11306 action=drop comment=” Noknok.800, Noknok.820″
add chain=forward protocol=udp dst-port=12389 action=drop comment=” KheSanh.210″
add chain=forward protocol=udp dst-port=12623 action=drop comment=” Buttman.090, Buttman.100″
add chain=forward protocol=udp dst-port=12625 action=drop comment=” Buttman.100″
add chain=forward protocol=udp dst-port=14100 action=drop comment=” Eurosol.100″
add chain=forward protocol=udp dst-port=23476 action=drop comment=” DonaldDick.155″
add chain=forward protocol=udp dst-port=26274 action=drop comment=” Delta.050″
add chain=forward protocol=udp dst-port=27184 action=drop comment=” Alvgus.100″
add chain=forward protocol=udp dst-port=28431-28436 action=drop comment=” Hack’a'Tack.2000″
add chain=forward protocol=udp dst-port=29891 action=drop comment=” Unexplained.100″
add chain=forward protocol=udp dst-port=30103 action=drop comment=” NetSphere.131″
add chain=forward protocol=udp dst-port=31320 action=drop comment=” LittleWitch.400, LittleWitch.420″
add chain=forward protocol=udp dst-port=31337 action=drop comment=” BackOrifice.120, OPC.200″
add chain=forward protocol=udp dst-port=31416 action=drop comment=” Lithium.100, Lithium.101″
add chain=forward protocol=udp dst-port=31789 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=udp dst-port=31791 action=drop comment=” Hack’a'Tack.100, Hack’a'Tack.112″
add chain=forward protocol=udp dst-port=33333 action=drop comment=” Blackharaz.100″
add chain=forward protocol=udp dst-port=47262 action=drop comment=” Delta.050″
add chain=forward protocol=udp dst-port=49683 action=drop comment=” HolzPferd.210″
add chain=forward protocol=udp dst-port=60000 action=drop comment=” MiniBacklash.100″

add chain=forward protocol=tcp dst-port=135-139 action=drop comment=”Drop Blaster Worm” disabled=no
add chain=forward protocol=tcp dst-port=1433-1434 action=drop comment=”Worm” disabled=no
add chain=forward protocol=tcp dst-port=445 action=drop comment=”Drop Blaster Worm” disabled=no
add chain=forward protocol=udp dst-port=445 action=drop comment=”Drop Blaster Worm” disabled=no
add chain=forward protocol=tcp dst-port=593 action=drop comment=”________” disabled=no
add chain=forward protocol=tcp dst-port=1024-1030 action=drop comment=”________” disabled=no
add chain=forward protocol=tcp dst-port=1080 action=drop comment=”Drop MyDoom” disabled=no
add chain=forward protocol=tcp dst-port=1214 action=drop comment=”________” disabled=no
add chain=forward protocol=tcp dst-port=1363 action=drop comment=”ndm reques ter” disabled=no
add chain=forward protocol=tcp dst-port=1364 action=drop comment=”ndm server” disabled=no
add chain=forward protocol=tcp dst-port=1368 action=drop comment=”screen cast” disabled=no
add chain=forward protocol=tcp dst-port=1373 action=drop comment=”hromgrafx” disabled=no
add chain=forward protocol=tcp dst-port=1377 action=drop comment=”cichlid” disabled=no
add chain=forward protocol=tcp dst-port=2745 action=drop comment=”Bagle forward” disabled=no
add chain=forward protocol=tcp dst-port=2283 action=drop comment=”Drop Dumaru.Y” disabled=no
add chain=forward protocol=tcp dst-port=2535 action=drop comment=”Drop Beagle” disabled=no
add chain=forward protocol=tcp dst-port=2745 action=drop comment=”Drop Beagle.C-K” disabled=no
add chain=forward protocol=tcp dst-port=3127 action=drop comment=”Drop MyDoom” disabled=no
add chain=forward protocol=tcp dst-port=3410 action=drop comment=”Drop Backdoor OptixPro” disabled=no
add chain=forward protocol=tcp dst-port=4444 action=drop comment=”Worm” disabled=no
add chain=forward protocol=udp dst-port=4444 action=drop comment=”Worm” disabled=no
add chain=forward protocol=tcp dst-port=5554 action=drop comment=”Drop Sasser” disabled=no
add chain=forward protocol=tcp dst-port=8866 action=drop comment=”Drop Beagle.B” disabled=no
add chain=forward protocol=tcp dst-port=9898 action=drop comment=”Drop Dabber.A-B” disabled=no
add chain=forward protocol=tcp dst-port=10000 action=drop comment=”Drop Dumaru.Y, sebaiknya di didisable karena juga sering digunakan utk vpn atau webmin” disabled=yes
add chain=forward protocol=tcp dst-port=10080 action=drop comment=”Drop MyDoom.B” disabled=no
add chain=forward protocol=tcp dst-port=12345 action=drop comment=”Drop NetBus” disabled=no
add chain=forward protocol=tcp dst-port=17300 action=drop comment=”Drop Kuang2″ disabled=no
add chain=forward protocol=tcp dst-port=27374 action=drop comment=”Drop SubSeven” disabled=no
add chain=forward protocol=tcp dst-port=65506 action=drop comment=”Drop PhatBot, Agobot, Gaobot” disabled=no

sumber