ROS防火墙之简单规则.禁PING,禁止某台机器上网,禁止超过500的ICMP包发向路由

#ROS2927放火墙之简单规则.
#只做了禁PING,和ICMP协议超过500包不接.
/ ip firewall filter
add chain=inputin-interface=telprotocol=icmp icmp-options=8:0 action=drop \
     comment="Tel Disable Ping" disabled=no
add chain=inputin-interface=cncprotocol=icmp icmp-options=8:0 action=drop \
     comment="CNC Disable Ping" disabled=no
add chain=input in-interface=lan src-address=!192.168.0.0/24action=drop \
     comment="Fei 192.168.0.0/24 can`t in ROS" disabled=yes
add chain=forward src-address=192.168.0.215action=accept comment="vip" \
     disabled=yes
add chain=input protocol=icmp icmp-options=8:0 packet-size=!0-600 action=drop \
     comment="Chao Guo 500/pack dis" disabled=no
add chain=forward in-interface=lan src-address=192.168.0.243action=drop \
     comment="Dis on computer top wire" disabled=no