Suggestion for PORT LIST

RouterOS General
1

Is there someone posting this subject, cause i dont see it.

My suggestion is there is a port lists like address lists at firewall so we can filter the good port and the bad port using the port list that we can modify only for the port. I think its more easier than using port filter with mangle.

I hope everyone agree with this feature.

2

what is a good port? some people say that port 135 is bad, some people need it for MS Active Directory. It completely depends on your needs. There is no bad port list.

If you want a really secure network, allow all the basic ports (http, https, mail send, mail receive, ntp, something else … ) and then block other ports. very simple firewall will do that.

3

forgive me for my english, what i need is to filter port based on the port lists not to filter bad or good port.

4

what do you mean by port list :slight_smile: ? can you give an example?

5

ok, in firewall theres address lists that i use to group a list of ip, so i make firewall rule based on address lists.
if i theres port lists, i want to use it to group and make firewall or mangle rules based on the port lists too.
:smiley:

6

sorry, such feature is not yet implemented. we’ll see - maybe in future

7

ic you cool normis :sunglasses:

is there anyone need this feature too?

8

That would make my firewall setup quite a bit simpler!

9

in 3.x cant you use dst-port=10,20,30-35,40 ? Havent tested but I thought they allow that now.

10

Implementation of port lists would be significant improvement.

11

address lists is useful where you need frequently changing list of addresses. where do you need frequently changing list of ports? =)

12

address lists is useful where you need frequently changing list of addresses

I would disagree…

It is for convienience… when you have a list of addresses which you plan to treat with firewall rules (for example) in the same way… It’s a heck of lot easier to just refer to the variable (the address list) than it is to implicitly refer to each one.

Similarly with a port list… when constructing firewalls with Mik (for example) there are a bunch of ports that come to mind that I treat the same… Currently that is done by writing rule after rule after rule after rule - all with the same result.

A port list would simplify this.

Though… someone posted:

in 3.x cant you use dst-port=10,20,30-35,40

Apparently now you can also list a variety of contiguous and non-contiguous ports within a single rule… This kinda gets us to the same place.

But, a port list would be easier.

Though, the only two ‘port lists’ that I can think of using would be:

  1. the lists of ports allowed (only from an address-list of specific ip’s) on an input chain of a mik router before dropping virtually everything else…
  2. the list of destination ports that we typically dis-allow in the forward chain (you know the ones that I am refering to)
13

list of ports would be useful if tehre are several firewall riles that apply different rules on the same list ofports. It would let us update list in one palce

also, list of ports has a human readable name, so you can name list accoring to the purpose, making administering it much easier.