Brasil 2019

Fluxo dos Pacotes

(Packet Flow)
Completo, Simples e Útil
João Krieger
 Conteúdo

1. Modelos OSI e TCP/IP (Revisão)

2. Diagrama do Fluxo dos Pacotes
3. Firewall
1. Filter / NAT / Mangle / Raw / Connections

4. Dicas pro Dia a Dia

 Modelo OSI e TCP/IP

7 APLICAÇÃO APLICAÇÃO
DADOS
6 APRESENTAÇÃO HTTP, HTTPS 5
DNS, DHCP, FTP
5 SESSÃO SSH, TELNET

Porta TCP e UDP

4 TRANSPORTE 4
22, 80, 443
IP
3 REDE 3
172.30.1.1
MAC
2 ENLACE 2
6C:3B:6B:40:0D:53
bits
1 FÍSICA 1
1110101010110111
Camada 3, Rede - Cabeçalho IPv4
Diagrama do Fluxo de Pacotes

● Porque é necessário conhecê-lo?

1. Para sabermos quando, porque e
onde passam os pacotes no RouterOS
2. Resolver tarefas mais complicadas
como bloqueios
3. Fazer redirecionamentos, marcações
e classificações
4. Priorizar tráfego e fazer QoS
5. Criar políticas de roteamento
6. E…
Diagrama em Blocos do Fluxo de Pacotes

https://wiki.mikrotik.com/wiki/Manual:Packet_Flow
Fluxo de Pacotes em Blocos Simples

In-Interface - Decapsulate

Bridge MPLS Routing Local

(Camada 2) (Camada 2,5) (Camada 3) Process

Out-Interface - Encapsulate
Decisões Expandidas
Chains (corrente) de Fluxo dos Pacotes
 Fluxo dos Pacotes IP Completo
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “HTB GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “HTB GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
 Tabelas em /ip firewall

1. Filter Rules: Filtra pacotes

2. NAT: Traduz endereços e portas

3. Mangle: Marca conexões, pacotes e roteamento,

também pode alterar campos no cabeçalho

4. Raw: Salta a Conntrack, protege e agiliza

5. Connections: Rastreia conexões (ConnTrack)

/ip firewall filter add chain=
 /ip firewall filter add chain=
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
 /ip firewall filter add chain=

FORWARD

INPUT OUTPUT

OUTPUT INPUT

FORWARD

FORWARD – Pacote vem de fora e passa ATRAVÉS DO ROUTER

INPUT – Pacote vem de fora e vai PARA O ROUTER
OUTPUT – Pacote é ORIGINADO NO ROUTER
 /ip firewall connection

Src: 192.168.10.10
Dst: 192.168.20.20

192.168.10.10/24 192.168.20.20/24

Src: 192.168.20.20
Dst: 192.168.10.10
Conexão Estabelecida
Fluxo de Pacotes Connection Tracking
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
/ip firewall nat add chain=
 Fluxo de Pacotes src-nat e dst-nat
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
 /ip firewall nat add chain=srcnat

Src: 192.168.1.2 Src: 200.1.1.1

Dst: 8.8.8.8 Dst: 8.8.8.8

192.168.1.2/24 200.1.1.1 8.8.8.8

 /ip firewall nat add chain=dstnat

Src: 177.1.1.1:5781 Src: 177.1.1.1:5781

Dst: 192.168.1.2:80 Dst: 200.1.1.1:80

192.168.1.1/24

192.168.1.2:80 177.1.1.1:5781
200.1.1.1:80
 /ip firewall nat add chain=dstnat
DICA

Objetivo

• Usar a action=redirect pra enviar ao próprio Router as consultas DNS

/ip firewall mangle add chain=
 Fluxo de Pacotes Mangle
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
Camada 3, Rede - Cabeçalho IPv4
 Fluxo de Pacotes TTL-1
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
/ip firewall mangle set action=change-ttl
Objetivo
• Não redistribuir Internet ao acrescentar um novo Router DICA

TTL = 2 TTL = 1

1 2 3

TTL = 1

1 2
/ip firewall raw add chain=
 Fluxo de Pacotes Raw
FORWARD

ROUTING MANGLE FILTER

DECISION
TTL-1 ACCOUNTING
FORWARD FORWARD

PRE POST
ROUTING INPUT OUTPUT ROUTING
ROUTING
MANGLE MANGLE
DST-NAT ADJUSTA-
INPUT MENT POSTROUTING

MANGLE FILTER FILTER

SRC-NAT
PREROUTING INPUT OUTPUT

CONNECTION QUEUE TREE MANGLE HOTSPOT

TRACKING “GLOBAL” OUTPUT OUT

RAW SIMPLE CONNECTION QUEUE TREE

PREROUTING QUEUE TRACKING “GLOBAL”

HOTSPOT RAW SIMPLE

IN OUTPUT QUEUE

TO IN LOCAL ROUTING
QUEUE TREE
PROCESS TO OUT DECISION INTERFACE HTB

INPUT OUTPUT
INTERFACE INTERFACE
 /ip firewall raw set action=drop
DICA

Objetivos

• Bloquear Spoofing (falsificação) dos IPs Rede Local

• Estar em conformidade com a RFC 2827 ou BCP 38 criadas 2000)
• Diminuir em quase 100% o número de Ataques para a Internet

Comandos

/interface list add name=LAN

/interface list member add interface=ether3_LAN list=LAN
/ip firewall address-list add address=192.168.1.0/24 list=REDE_LOCAL
/ip firewall raw
add action=drop chain=prerouting comment="Anti Spoofing - BCP 38" \
in-interface-list=LAN src-address-list=!REDE_LOCAL
/ip firewall raw set action=accept e drop
DICA

Objetivos

• Aceitar 50 Pings por segundo e dropar o resto

• Consumir menos processamento em um ataque de Ping Flood

Comandos

/ip firewall raw

add action=accept chain=prerouting comment="50 Pings por segundo" limit=\

50,5:packet protocol=icmp
add action=drop chain=prerouting comment=“Ping" protocol=icmp
 /ip firewall raw set action=drop
DICA

Objetivos

• Bloquear acessos vindos da WAN para servicos privados

• Prevenir ataques de Amplificação, DoS e Flooding, ao Router e para a
Rede Local

Comandos
/ip firewall raw

add chain=prerouting in-interface=WAN action=drop protocol=udp dst-

port=“53,123,161,1900” comment=“Previne Amplificação de DNS, NTP, SNMP e SSDP”

add chain=prerouting in-interface=WAN action=drop protocol=tcp dst-

port=“22,23,53,80,2000,8080” comment=“Portas Mais Visadas”
 /ip firewall raw set action=drop DICA

Objetivo
• Bloquear Prefixos BOGONS
/ip firewall address-list
add address=0.0.0.0/8 comment="Auto Identificacao" list=BOGONS
add address=10.0.0.0/8 comment="Privada - Verifique se voce necessita" \
disabled=yes list=BOGONS
add address=127.0.0.0/8 comment=Loopback list=BOGONS
add address=169.254.0.0/16 comment="Link Local - APIPA" list=BOGONS
add address=172.16.0.0/12 comment="Privada - Verifique se voce necessita" \
disabled=yes list=BOGONS
add address=192.168.0.0/16 comment="Privada - Verifique se voce necessita" \
disabled=yes list=BOGONS
add address=192.0.2.0/24 comment="Reservada - TestNet1" list=BOGONS
add address=192.88.99.0/24 comment="6to4 Relay Anycast" list=BOGONS
add address=198.18.0.0/15 comment="Teste NIDB" list=BOGONS
add address=198.51.100.0/24 comment="Reservada - TestNet2" list=BOGONS
add address=203.0.113.0/24 comment="Reservada - TestNet3" list=BOGONS
add address=224.0.0.0/4 comment="Multicast - Verifique se voce necessita" \
disabled=yes list=BOGONS
/ip firewall raw
add action=drop chain=prerouting comment="dst BOGONS" dst-address-list=BOGONS

*
 Crédito

https://www.mikrotik-trainings.com/docs#form
Conteúdo Abordado

1. Modelos OSI e Híbrido (Revisão)

2. Diagrama do Fluxo dos Pacotes
3. Firewall
1. Filter / NAT / Mangle / Raw / Connections

4. Dicas pro Dia a Dia

 Obrigado!

João Krieger
48 9-9982-8707
[email protected]
 Treinamentos

Curso
Introdutório
Roteamento
Avançado
OSPF e Túneis

Controle de Firewall IPv6 Controle de Wireless do

Tráfego, QoS Ataques Usuários, Radius RouterOS
Proxy e Firewall IPsec HotSpot e IPsec

Redes BGP, MPLS

http://www.mikrotik.com/training/ Engenharia Tráfego