23
# IP FIREWALL LAYER7-PROTOCOL
# Adicionando mais formas de identificar os pacotes.
/ip firewall layer7-protocol
add comment="" name=edonkey regexp="^[\C5\D4\E3-\E5].\?.\?.\?.\?([\01\02\05\14\1
5\16\
\18\19\1A\1B\1C !234568@ABCFGHIJKLMNOPQRSTUVWX[`\81\82\90\91\93\96\97\98\99\
9A\9B\
\9C\9E\A0\A1\A2\A3\A4]|Y................\?[ -~]|\96....\$)"
add comment="" name=goboogy regexp="<peerplat>|^get /getfilebyhash\\.cgi\\\?|^ge
t /que\
ue_register\\.cgi\\\?|^get /getupdowninfo\\.cgi\\\?"
add comment="" name=soribada regexp="^GETMP3\r\
\nFilename|^\01.\?.\?.\?(Q:\\+|Q2:)|^\10[\14-\16]\10[\15-\17].\?.\?.\?.\?\$"
add comment="" name=rdp regexp=rdpdr.*cliprdr.*rdpsnd
add comment="" name=gnutella regexp="^(gnd[\01\02]\?.\?.\?\01|gnutella connect/[
012]\\\
.[0-9]\r\
\n|get /uri-res/n2r\\\?urn:sha1:|get /.*user-agent: (gtk-gnutella|bearshare|
mactel\
la|gnucleus|gnotella|limewire|imesh)|get /.*content-type: application/x-gnut
ella-p\
ackets|giv [0-9]*:[0-9a-f]*/|queue [0-9a-f]* [1-9][0-9]\?[0-9]\?\\.[1-9][0-9
]\?[0-\
9]\?\\.[1-9][0-9]\?[0-9]\?\\.[1-9][0-9]\?[0-9]\?:[1-9][0-9]\?[0-9]\?[0-9]\?|
gnutel\
la.*content-type: application/x-gnutella|...................\?lime)"
add comment="" name=cvs regexp="^BEGIN (AUTH|VERIFICATION|GSSAPI) REQUEST\
\n"
add comment="" name=nbns regexp="\01\10\01|\\)\10\01\01|0\10\01"
add comment="" name=shoutcast regexp=\
"icy [1-5][0-9][0-9] [\t-\r -~]*(content-type:audio|icy-)"
add comment="" name=dns regexp="^.\?.\?.\?.\?[\01\02].\?.\?.\?.\?.\?.\?[\01-\?][
a-z0-9\
][\01-\?a-z]*[\02-\06][a-z][a-z][fglmoprstuvz]\?[aeop]\?(um)\?[\01-\10\1C][\
01\03\
\04\FF]"
add comment="" name=quake-halflife regexp="^\FF\FF\FF\FFget(info|challenge)"
add comment="" name=poco regexp="^\80\94\
\n\01....\1F\9E"
add comment="" name=ciscovpn regexp="^\01\F4\01\F4"
add comment="" name=x11 regexp="^[lb].\?\0B"
add comment="" name=xboxlive regexp="^X\80........\F3|^\06XN"
add comment="" name=applejuice regexp="^ajprot\r\
\n"
add comment="" name=zmaap regexp="^\1B\D7;H[\01\02]\01\?\01"
add comment="" name=live365 regexp=membername.*session.*player
add comment="" name=rlogin regexp=\
"^[a-z][a-z0-9][a-z0-9]+/[1-9][0-9]\?[0-9]\?[0-9]\?00"
add comment="" name=http regexp="http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\t-\r
-~]*(\
connection:|content-type:|content-length:|date:)|post [\t-\r -~]* http/[01]\
\.[019\
]"
add comment="" name=sip regexp=\
"^(invite|register|cancel) sip[\t-\r -~]*sip/[0-2]\\.[0-9]"
add comment="" name=pop3 regexp="^(\\+ok |-err )"
add comment="" name=smb regexp="\FFsmb[r%]"
add comment="" name=quake1 regexp="^\80\0C\01quake\03"
add comment="" name=lpd regexp="^(\01[!-~]+|\02[!-~]+\
\n.[\01\02\03][\01-\
\n -~]*|[\03\04][!-~]+[\t-\r]+[a-z][\t-\r -~]*|\05[!-~]+[\t-\r]+([a-z][!-~]*
[\t-\r\
]+[1-9][0-9]\?[0-9]\?|root[\t-\r]+[!-~]+).*)\
\n\$"
add comment="" name=mute regexp="^(Public|AES)Key: [0-9a-f]*\
\nEnd(Public|AES)Key\
\n\$"
add comment="" name=ssh regexp="^ssh-[12]\\.[0-9]"
add comment="" name=jabber regexp=\
"<stream:stream[\t-\r ][ -~]*[\t-\r ]xmlns=['\"]jabber"
add comment="" name=bittorrent regexp="^(\13bittorrent protocol|azver\01\$|get/s
crape\
\\\?info_hash=)|d1:ad2:id20:|\08'7P\\)[RP]"
add comment="" name=ncp regexp="^(dmdt.*\01.*(\"\"|\11\11|uu)|tncp.*33)"
add comment="" name=tls regexp="^(.\?.\?\16\03.*\16\03|.\?.\?\01\03\01\?.*\0B)"
add comment="" name=directconnect regexp="^(\\\$mynick |\\\$lock |\\\$key )"
add comment="" name=netbios regexp="\81.\?.\?.[A-P][A-P][A-P][A-P][A-P][A-P][A-P
][A-P]\
[A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][
A-P][A\
-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][A-P][AP]"
add comment="" name=tftp regexp="^(\01|\02)[ -~]*(netascii|octet|mail)"
add comment="" name=subspace regexp="^\01....\11\10........\01\$"
add comment="" name=hotline regexp="^....................TRTPHOTL\01\02"
add comment="" name=doom3 regexp="^\FF\FFchallenge"
add comment="" name=ftp regexp="^220[\t-\r -~]*ftp"
add comment="" name=kugoo regexp="^1..\8E"
add comment="" name=tsp regexp=\
"^[\01-\13\16-\$]\01.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?[ -~]+"
add comment="" name=battlefield1942 regexp="^\01\11\10\\|\F8\02\10@\06"
add comment="" name=ssdp regexp="^notify[\t-\r ]\\*[\t-\r ]http/1\\.1[\t-\r -~]*
ssdp:(\
alive|byebye)|^m-search[\t-\r ]\\*[\t-\r ]http/1\\.1[\t-\r -~]*ssdp:discover
"
add comment="" name=imap regexp="^(\\* ok|a[0-9]+ noop)"
add comment="" name=ares regexp="^\03[]Z].\?.\?\05\$"
add comment="" name=fasttrack regexp="^get (/.download/[ -~]*|/.supernode[ -~]|/
.statu\
s[ -~]|/.network[ -~]*|/.files|/.hash=[0-9a-f]*/[ -~]*) http/1.1|user-agent:
kazaa\
|x-kazaa(-username|-network|-ip|-supernodeip|-xferid|-xferuid|tag)|^give [09][0-9\
][0-9][0-9][0-9][0-9][0-9][0-9]\?[0-9]\?[0-9]\?"
add comment="" name=qq regexp="^.\?\02.+\03\$"
add comment="" name=100bao regexp="^\01\01\05\
\n"
add comment="" name=aim regexp=\
"^(\\*[\01\02].*\03\0B|\\*\01.\?.\?.\?.\?\01)|flapon|toc_signon.*0x"
add comment="" name=unknown regexp=.
add comment="" name=msn-filetransfer regexp=\
"^(ver [ -~]*msnftp\r\
\nver msnftp\r\
\nusr|method msnmsgr:)"
add comment="" name=yahoo regexp=\
"^(ymsg|ypns|yhoo).\?.\?.\?.\?.\?.\?.\?[lwt].*\C0\80"
add comment="" name=validcertssl regexp="^(.\?.\?\16\03.*\16\03|.\?.\?\01\03\01\
?.*\0B\
).*(thawte|equifax secure|rsa data security, inc|verisign, inc|gte cybertrus
t root\
|entrust\\.net limited)"
add comment="" name=ntp regexp=\
"^([\13\1B#\D3\DB\E3]|[\14\1C\$].......\?.\?.\?.\?.\?.\?.\?.\?.\?[\C6-\FF])"
add comment="" name=gnucleuslan regexp=\
"gnuclear connect/[\t-\r -~]*user-agent: gnucleus [\t-\r -~]*lan:"
add comment="" name=vnc regexp="^rfb 00[1-9]\\.00[0-9]\
\n\$"
add comment="" name=bgp regexp=\
"^\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF\FF..\?\01[\03\04]"
add comment="" name=tesla regexp="\03\9A\89\"111\\.00 Beta |\E2<i\1E\1C\E9"
add comment="" name=openft regexp="x-openftalias: [-)(0-9a-z ~.]"
add comment="" name=h323 regexp=\
"^\03..\?\08...\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?\05"
add comment="" name=finger regexp=\
"^[a-z][a-z0-9\\-_]+|login: [\t-\r -~]* name: [\t-\r -~]* Directory:"
add comment="" name=ident regexp="^[1-9][0-9]\?[0-9]\?[0-9]\?[0-9]\?[\t-\r]*,[\t
-\r]*[\
1-9][0-9]\?[0-9]\?[0-9]\?[0-9]\?(\r\
\n|[\r\
\n])\?\$"
add comment="" name=gkrellm regexp="^gkrellm [23].[0-9].[0-9]\
\n\$"
add comment="" name=hddtemp regexp=\
"^\\|/dev/[a-z][a-z][a-z]\\|[0-9a-z]*\\|[0-9][0-9]\\|[cfk]\\|"
add comment="" name=socks regexp=\
"\05[\01-\08]*\05[\01-\08]\?.*\05[\01-\03][\01\03].*\05[\01-\08]\?[\01\03]"
add comment="" name=biff regexp="^[a-z][a-z0-9]+@[1-9][0-9]+\$"
add comment="" name=dhcp regexp="^[\01\02][\01- ]\06.*c\82sc"
add comment="" name=smtp regexp="^220[\t-\r -~]* (e\?smtp|simple mail)"
add comment="" name=ipp regexp=ipp://
add comment="" name=msnmessenger regexp="ver [0-9]+ msnp[1-9][0-9]\? [\t-\r -~]*
cvr0\r\
\n\$|usr 1 [!-~]+ [0-9. ]+\r\
\n\$|ans 1 [!-~]+ [0-9. ]+\r\
\n\$"
add comment="" name=irc regexp="^(nick[\t-\r -~]*user[\t-\r -~]*:|user[\t-\r -~]
*:[\02\
-\r -~]*nick[\t-\r -~]*\r\
\n)"
add comment="" name=gopher regexp="^[\t-\r]*[1-9,+tgi][\t-\r -~]*\t[\t-\r -~]*\t
[a-z0-\
9.]*\\.[a-z][a-z].\?.\?\t[1-9]"
add comment="" name=telnet regexp="^\FF[\FB-\FE].\FF[\FB-\FE].\FF[\FB-\FE]"
add comment="" name=snmp regexp="^\02\01\04.+([\A0-\A3]\02[\01-\04].\?.\?.\?.\?\
02\01.\
\?\02\01.\?0|\A4\06.+@\04.\?.\?.\?.\?\02\01.\?\02\01.\?C)"
add comment="" name=nntp regexp=\
"^(20[01][\t-\r -~]*AUTHINFO USER|20[01][\t-\r -~]*news)"
add comment="" name=aimwebcontent regexp=user-agent:aim/
add comment="" name=rtsp regexp="rtsp/1.0 200 ok"
add comment="" name=skypeout regexp="^(\01.\?.\?.\?.\?.\?.\?.\?.\?\01|\02.\?.\?.
\?.\?.\
\?.\?.\?.\?\02|\03.\?.\?.\?.\?.\?.\?.\?.\?\03|\04.\?.\?.\?.\?.\?.\?.\?.\?\04
|\05.\
\?.\?.\?.\?.\?.\?.\?.\?\05|\06.\?.\?.\?.\?.\?.\?.\?.\?\06|\07.\?.\?.\?.\?.\?
.\?.\?\
.\?\07|\08.\?.\?.\?.\?.\?.\?.\?.\?\08|\t.\?.\?.\?.\?.\?.\?.\?.\?\t|\
\n.\?.\?.\?.\?.\?.\?.\?.\?\
\n|\0B.\?.\?.\?.\?.\?.\?.\?.\?\0B|\0C.\?.\?.\?.\?.\?.\?.\?.\?\0C|\r.\?.\?.\?
.\?.\?\
.\?.\?.\?\r|\0E.\?.\?.\?.\?.\?.\?.\?.\?\0E|\0F.\?.\?.\?.\?.\?.\?.\?.\?\0F|\1
0.\?.\
\?.\?.\?.\?.\?.\?.\?\10|\11.\?.\?.\?.\?.\?.\?.\?.\?\11|\12.\?.\?.\?.\?.\?.\?
.\?.\?\
\12|\13.\?.\?.\?.\?.\?.\?.\?.\?\13|\14.\?.\?.\?.\?.\?.\?.\?.\?\14|\15.\?.\?.
\?.\?.\
\?.\?.\?.\?\15|\16.\?.\?.\?.\?.\?.\?.\?.\?\16|\17.\?.\?.\?.\?.\?.\?.\?.\?\17
|\18.\
\?.\?.\?.\?.\?.\?.\?.\?\18|\19.\?.\?.\?.\?.\?.\?.\?.\?\19|\1A.\?.\?.\?.\?.\?
.\?.\?\
.\?\1A|\1B.\?.\?.\?.\?.\?.\?.\?.\?\1B|\1C.\?.\?.\?.\?.\?.\?.\?.\?\1C|\1D.\?.
\?.\?.\
\?.\?.\?.\?.\?\1D|\1E.\?.\?.\?.\?.\?.\?.\?.\?\1E|\1F.\?.\?.\?.\?.\?.\?.\?.\?
\1F| .\
\?.\?.\?.\?.\?.\?.\?.\? |!.\?.\?.\?.\?.\?.\?.\?.\?!|\".\?.\?.\?.\?.\?.\?.\?.
\?\"|#\
.\?.\?.\?.\?.\?.\?.\?.\?#|\\\$.\?.\?.\?.\?.\?.\?.\?.\?\\\$|%.\?.\?.\?.\?.\?.
\?.\?.\
\?%|&.\?.\?.\?.\?.\?.\?.\?.\?&|'.\?.\?.\?.\?.\?.\?.\?.\?'|\\(.\?.\?.\?.\?.\?
.\?.\?\
.\?\\(|\\).\?.\?.\?.\?.\?.\?.\?.\?\\)|\\*.\?.\?.\?.\?.\?.\?.\?.\?\\*|\\+.\?.
\?.\?.\
\?.\?.\?.\?.\?\\+|,.\?.\?.\?.\?.\?.\?.\?.\?,|-.\?.\?.\?.\?.\?.\?.\?.\?-|\\..
\?.\?.\
\?.\?.\?.\?.\?.\?\\.|/.\?.\?.\?.\?.\?.\?.\?.\?/|0.\?.\?.\?.\?.\?.\?.\?.\?0|1
.\?.\?\
.\?.\?.\?.\?.\?.\?1|2.\?.\?.\?.\?.\?.\?.\?.\?2|3.\?.\?.\?.\?.\?.\?.\?.\?3|4.
\?.\?.\
\?.\?.\?.\?.\?.\?4|5.\?.\?.\?.\?.\?.\?.\?.\?5|6.\?.\?.\?.\?.\?.\?.\?.\?6|7.\
?.\?.\
\?.\?.\?.\?.\?.\?7|8.\?.\?.\?.\?.\?.\?.\?.\?8|9.\?.\?.\?.\?.\?.\?.\?.\?9|:.\
?.\?.\
\?.\?.\?.\?.\?.\?:|;.\?.\?.\?.\?.\?.\?.\?.\?;|<.\?.\?.\?.\?.\?.\?.\?.\?<|=.\
?.\?.\
\?.\?.\?.\?.\?.\?=|>.\?.\?.\?.\?.\?.\?.\?.\?>|\\\?.\?.\?.\?.\?.\?.\?.\?.\?\\
\?|@.\
\?.\?.\?.\?.\?.\?.\?.\?@|A.\?.\?.\?.\?.\?.\?.\?.\?A|B.\?.\?.\?.\?.\?.\?.\?.\
?B|C.\
\?.\?.\?.\?.\?.\?.\?.\?C|D.\?.\?.\?.\?.\?.\?.\?.\?D|E.\?.\?.\?.\?.\?.\?.\?.\
?E|F.\
\?.\?.\?.\?.\?.\?.\?.\?F|G.\?.\?.\?.\?.\?.\?.\?.\?G|H.\?.\?.\?.\?.\?.\?.\?.\
?H|I.\
\?.\?.\?.\?.\?.\?.\?.\?I|J.\?.\?.\?.\?.\?.\?.\?.\?J|K.\?.\?.\?.\?.\?.\?.\?.\
?K|L.\
\?.\?.\?.\?.\?.\?.\?.\?L|M.\?.\?.\?.\?.\?.\?.\?.\?M|N.\?.\?.\?.\?.\?.\?.\?.\
?N|O.\
\?.\?.\?.\?.\?.\?.\?.\?O|P.\?.\?.\?.\?.\?.\?.\?.\?P|Q.\?.\?.\?.\?.\?.\?.\?.\
?Q|R.\
\?.\?.\?.\?.\?.\?.\?.\?R|S.\?.\?.\?.\?.\?.\?.\?.\?S|T.\?.\?.\?.\?.\?.\?.\?.\
?T|U.\
\?.\?.\?.\?.\?.\?.\?.\?U|V.\?.\?.\?.\?.\?.\?.\?.\?V|W.\?.\?.\?.\?.\?.\?.\?.\
?W|X.\
\?.\?.\?.\?.\?.\?.\?.\?X|Y.\?.\?.\?.\?.\?.\?.\?.\?Y|Z.\?.\?.\?.\?.\?.\?.\?.\
?Z|\\[\
.\?.\?.\?.\?.\?.\?.\?.\?\\[|\\].\?.\?.\?.\?.\?.\?.\?.\?\\]|\\].\?.\?.\?.\?.\
?.\?.\
\?.\?\\]|\\^.\?.\?.\?.\?.\?.\?.\?.\?\\^|_.\?.\?.\?.\?.\?.\?.\?.\?_|`.\?.\?.\
?.\?.\
\?.\?.\?.\?`|a.\?.\?.\?.\?.\?.\?.\?.\?a|b.\?.\?.\?.\?.\?.\?.\?.\?b|c.\?.\?.\
?.\?.\
\?.\?.\?.\?c|d.\?.\?.\?.\?.\?.\?.\?.\?d|e.\?.\?.\?.\?.\?.\?.\?.\?e|f.\?.\?.\
?.\?.\
\?.\?.\?.\?f|g.\?.\?.\?.\?.\?.\?.\?.\?g|h.\?.\?.\?.\?.\?.\?.\?.\?h|i.\?.\?.\
?.\?.\
\?.\?.\?.\?i|j.\?.\?.\?.\?.\?.\?.\?.\?j|k.\?.\?.\?.\?.\?.\?.\?.\?k|l.\?.\?.\
?.\?.\
\?.\?.\?.\?l|m.\?.\?.\?.\?.\?.\?.\?.\?m|n.\?.\?.\?.\?.\?.\?.\?.\?n|o.\?.\?.\
?.\?.\
\?.\?.\?.\?o|p.\?.\?.\?.\?.\?.\?.\?.\?p|q.\?.\?.\?.\?.\?.\?.\?.\?q|r.\?.\?.\
?.\?.\
\?.\?.\?.\?r|s.\?.\?.\?.\?.\?.\?.\?.\?s|t.\?.\?.\?.\?.\?.\?.\?.\?t|u.\?.\?.\
?.\?.\
\?.\?.\?.\?u|v.\?.\?.\?.\?.\?.\?.\?.\?v|w.\?.\?.\?.\?.\?.\?.\?.\?w|x.\?.\?.\
?.\?.\
\?.\?.\?.\?x|y.\?.\?.\?.\?.\?.\?.\?.\?y|z.\?.\?.\?.\?.\?.\?.\?.\?z|\\{.\?.\?
.\?.\?\
.\?.\?.\?.\?\\{|\\|.\?.\?.\?.\?.\?.\?.\?.\?\\||\\}.\?.\?.\?.\?.\?.\?.\?.\?\\
}|~.\?\
.\?.\?.\?.\?.\?.\?.\?~|\7F.\?.\?.\?.\?.\?.\?.\?.\?\7F|\80.\?.\?.\?.\?.\?.\?.
\?.\?\
\80|\81.\?.\?.\?.\?.\?.\?.\?.\?\81|\82.\?.\?.\?.\?.\?.\?.\?.\?\82|\83.\?.\?.
\?.\?.\
\?.\?.\?.\?\83|\84.\?.\?.\?.\?.\?.\?.\?.\?\84|\85.\?.\?.\?.\?.\?.\?.\?.\?\85
|\86.\
\?.\?.\?.\?.\?.\?.\?.\?\86|\87.\?.\?.\?.\?.\?.\?.\?.\?\87|\88.\?.\?.\?.\?.\?
.\?.\?\
.\?\88|\89.\?.\?.\?.\?.\?.\?.\?.\?\89|\8A.\?.\?.\?.\?.\?.\?.\?.\?\8A|\8B.\?.
\?.\?.\
\?.\?.\?.\?.\?\8B|\8C.\?.\?.\?.\?.\?.\?.\?.\?\8C|\8D.\?.\?.\?.\?.\?.\?.\?.\?
\8D|\
\8E.\?.\?.\?.\?.\?.\?.\?.\?\8E|\8F.\?.\?.\?.\?.\?.\?.\?.\?\8F|\90.\?.\?.\?.\
?.\?.\
\?.\?.\?\90|\91.\?.\?.\?.\?.\?.\?.\?.\?\91|\92.\?.\?.\?.\?.\?.\?.\?.\?\92|\9
3.\?.\
\?.\?.\?.\?.\?.\?.\?\93|\94.\?.\?.\?.\?.\?.\?.\?.\?\94|\95.\?.\?.\?.\?.\?.\?
.\?.\?\
\95|\96.\?.\?.\?.\?.\?.\?.\?.\?\96|\97.\?.\?.\?.\?.\?.\?.\?.\?\97|\98.\?.\?.
\?.\?.\
\?.\?.\?.\?\98|\99.\?.\?.\?.\?.\?.\?.\?.\?\99|\9A.\?.\?.\?.\?.\?.\?.\?.\?\9A
|\9B.\
\?.\?.\?.\?.\?.\?.\?.\?\9B|\9C.\?.\?.\?.\?.\?.\?.\?.\?\9C|\9D.\?.\?.\?.\?.\?
.\?.\?\
.\?\9D|\9E.\?.\?.\?.\?.\?.\?.\?.\?\9E|\9F.\?.\?.\?.\?.\?.\?.\?.\?\9F|\A0.\?.
\?.\?.\
\?.\?.\?.\?.\?\A0|\A1.\?.\?.\?.\?.\?.\?.\?.\?\A1|\A2.\?.\?.\?.\?.\?.\?.\?.\?
\A2|\
\A3.\?.\?.\?.\?.\?.\?.\?.\?\A3|\A4.\?.\?.\?.\?.\?.\?.\?.\?\A4|\A5.\?.\?.\?.\
?.\?.\
\?.\?.\?\A5|\A6.\?.\?.\?.\?.\?.\?.\?.\?\A6|\A7.\?.\?.\?.\?.\?.\?.\?.\?\A7|\A
8.\?.\
\?.\?.\?.\?.\?.\?.\?\A8|\A9.\?.\?.\?.\?.\?.\?.\?.\?\A9|\AA.\?.\?.\?.\?.\?.\?
.\?.\?\
\AA|\AB.\?.\?.\?.\?.\?.\?.\?.\?\AB|\AC.\?.\?.\?.\?.\?.\?.\?.\?\AC|\AD.\?.\?.
\?.\?.\
\?.\?.\?.\?\AD|\AE.\?.\?.\?.\?.\?.\?.\?.\?\AE|\AF.\?.\?.\?.\?.\?.\?.\?.\?\AF
|\B0.\
\?.\?.\?.\?.\?.\?.\?.\?\B0|\B1.\?.\?.\?.\?.\?.\?.\?.\?\B1|\B2.\?.\?.\?.\?.\?
.\?.\?\
.\?\B2|\B3.\?.\?.\?.\?.\?.\?.\?.\?\B3|\B4.\?.\?.\?.\?.\?.\?.\?.\?\B4|\B5.\?.
\?.\?.\
\?.\?.\?.\?.\?\B5|\B6.\?.\?.\?.\?.\?.\?.\?.\?\B6|\B7.\?.\?.\?.\?.\?.\?.\?.\?
\B7|\
\B8.\?.\?.\?.\?.\?.\?.\?.\?\B8|\B9.\?.\?.\?.\?.\?.\?.\?.\?\B9|\BA.\?.\?.\?.\
?.\?.\
\?.\?.\?\BA|\BB.\?.\?.\?.\?.\?.\?.\?.\?\BB|\BC.\?.\?.\?.\?.\?.\?.\?.\?\BC|\B
D.\?.\
\?.\?.\?.\?.\?.\?.\?\BD|\BE.\?.\?.\?.\?.\?.\?.\?.\?\BE|\BF.\?.\?.\?.\?.\?.\?
.\?.\?\
\BF|\C0.\?.\?.\?.\?.\?.\?.\?.\?\C0|\C1.\?.\?.\?.\?.\?.\?.\?.\?\C1|\C2.\?.\?.
\?.\?.\
\?.\?.\?.\?\C2|\C3.\?.\?.\?.\?.\?.\?.\?.\?\C3|\C4.\?.\?.\?.\?.\?.\?.\?.\?\C4
|\C5.\
\?.\?.\?.\?.\?.\?.\?.\?\C5|\C6.\?.\?.\?.\?.\?.\?.\?.\?\C6|\C7.\?.\?.\?.\?.\?
.\?.\?\
.\?\C7|\C8.\?.\?.\?.\?.\?.\?.\?.\?\C8|\C9.\?.\?.\?.\?.\?.\?.\?.\?\C9|\CA.\?.
\?.\?.\
\?.\?.\?.\?.\?\CA|\CB.\?.\?.\?.\?.\?.\?.\?.\?\CB|\CC.\?.\?.\?.\?.\?.\?.\?.\?
\CC|\
\CD.\?.\?.\?.\?.\?.\?.\?.\?\CD|\CE.\?.\?.\?.\?.\?.\?.\?.\?\CE|\CF.\?.\?.\?.\
?.\?.\
\?.\?.\?\CF|\D0.\?.\?.\?.\?.\?.\?.\?.\?\D0|\D1.\?.\?.\?.\?.\?.\?.\?.\?\D1|\D
2.\?.\
\?.\?.\?.\?.\?.\?.\?\D2|\D3.\?.\?.\?.\?.\?.\?.\?.\?\D3|\D4.\?.\?.\?.\?.\?.\?
.\?.\?\
\D4|\D5.\?.\?.\?.\?.\?.\?.\?.\?\D5|\D6.\?.\?.\?.\?.\?.\?.\?.\?\D6|\D7.\?.\?.
\?.\?.\
\?.\?.\?.\?\D7|\D8.\?.\?.\?.\?.\?.\?.\?.\?\D8|\D9.\?.\?.\?.\?.\?.\?.\?.\?\D9
|\DA.\
\?.\?.\?.\?.\?.\?.\?.\?\DA|\DB.\?.\?.\?.\?.\?.\?.\?.\?\DB|\DC.\?.\?.\?.\?.\?
.\?.\?\
.\?\DC|\DD.\?.\?.\?.\?.\?.\?.\?.\?\DD|\DE.\?.\?.\?.\?.\?.\?.\?.\?\DE|\DF.\?.
\?.\?.\
\?.\?.\?.\?.\?\DF|\E0.\?.\?.\?.\?.\?.\?.\?.\?\E0|\E1.\?.\?.\?.\?.\?.\?.\?.\?
\E1|\
\E2.\?.\?.\?.\?.\?.\?.\?.\?\E2|\E3.\?.\?.\?.\?.\?.\?.\?.\?\E3|\E4.\?.\?.\?.\
?.\?.\
\?.\?.\?\E4|\E5.\?.\?.\?.\?.\?.\?.\?.\?\E5|\E6.\?.\?.\?.\?.\?.\?.\?.\?\E6|\E
7.\?.\
\?.\?.\?.\?.\?.\?.\?\E7|\E8.\?.\?.\?.\?.\?.\?.\?.\?\E8|\E9.\?.\?.\?.\?.\?.\?
.\?.\?\
\E9|\EA.\?.\?.\?.\?.\?.\?.\?.\?\EA|\EB.\?.\?.\?.\?.\?.\?.\?.\?\EB|\EC.\?.\?.
\?.\?.\
\?.\?.\?.\?\EC|\ED.\?.\?.\?.\?.\?.\?.\?.\?\ED|\EE.\?.\?.\?.\?.\?.\?.\?.\?\EE
|\EF.\
\?.\?.\?.\?.\?.\?.\?.\?\EF|\F0.\?.\?.\?.\?.\?.\?.\?.\?\F0|\F1.\?.\?.\?.\?.\?
.\?.\?\
.\?\F1|\F2.\?.\?.\?.\?.\?.\?.\?.\?\F2|\F3.\?.\?.\?.\?.\?.\?.\?.\?\F3|\F4.\?.
\?.\?.\
\?.\?.\?.\?.\?\F4|\F5.\?.\?.\?.\?.\?.\?.\?.\?\F5|\F6.\?.\?.\?.\?.\?.\?.\?.\?
\F6|\
\F7.\?.\?.\?.\?.\?.\?.\?.\?\F7|\F8.\?.\?.\?.\?.\?.\?.\?.\?\F8|\F9.\?.\?.\?.\
?.\?.\
\?.\?.\?\F9|\FA.\?.\?.\?.\?.\?.\?.\?.\?\FA|\FB.\?.\?.\?.\?.\?.\?.\?.\?\FB|\F
C.\?.\
\?.\?.\?.\?.\?.\?.\?\FC|\FD.\?.\?.\?.\?.\?.\?.\?.\?\FD|\FE.\?.\?.\?.\?.\?.\?
.\?.\?\
\FE|\FF.\?.\?.\?.\?.\?.\?.\?.\?\FF)"
add comment="" name=skypetoskype regexp="^..\02............."
add comment="" name=counterstrike-source regexp=\
"^\FF\FF\FF\FF.*cstrikeCounter-Strike"
add comment="" name=halflife2-deathmatch regexp="^\FF\FF\FF\FF.*hl2mpDeathmatch"
add comment="" name=freenet regexp="^\01[\08\t][\03\04]"
add comment="" name=battlefield2 regexp="^(\11 \01...\?\11|\FE\FD.\?.\?.\?.\?.\?
.\?(\
\14\01\06|\FF\FF\FF))|[]\01].\?battlefield2"
add comment="" name=napster regexp="^(.[\02\06][!-~]+ [!-~]+ [0-9][0-9]\?[0-9]\?
[0-9]\
\?[0-9]\? \"[\t-\r -~]+\" ([0-9]|10)|1(send|get)[!-~]+ \"[\t-\r -~]+\")"
add comment="" name=soulseek regexp=\
"^(\05..\?|.\01.[ -~]+\01F..\?.\?.\?.\?.\?.\?.\?)\$"
add comment="" name=xunlei regexp="^[()]...\?.\?.\?(reg|get|query)"
add comment="" name=ssl regexp="^(.\?.\?\16\03.*\16\03|.\?.\?\01\03\01\?.*\0B)"
add comment="" name=citrix regexp="2&\85\92X"
add comment="" name=whois regexp="^[ !-~]+\r\
\n\$"
add comment="" name=dayofdefeat-source regexp="^\FF\FF\FF\FF.*dodDay of Defeat"
add comment="" name=teamspeak regexp="^\F4\BE\03.*teamspeak"
add comment="" name=worldofwarcraft regexp="^\06\EC\01"
add comment="" name=ventrilo regexp="^..\?v\\\$\CF"
add comment="" name=http-rtsp regexp="^(get[\t-\r -~]* Accept: application/x-rts
p-tunn\
elled|http/(0\\.9|1\\.0|1\\.1) [1-5][0-9][0-9] [\t-\r -~]*a=control:rtsp://)
"
add comment="" name=thecircle regexp=\
"^t\03ni.\?[\01-\06]\?t[\01-\05]s[\
\n\0B](glob|who are you\$|query data)"
add comment="" name=uucp regexp="^\10here="
add comment="" name=pcanywhere regexp="^(nq|st)\$"
add comment="" name=subversion regexp="^\\( success \\( 1 2 \\("
add comment="" name=imesh regexp="^(post[\t-\r -~]*<PasswordHash>...............
......\
...........</PasswordHash><ClientVer>|4\80\?\r\?\FC\FF\04|get[\t-\r -~]*Host
: imsh\
\\.download-prod\\.musicnet\\.com|\02(\01|\02)\83.\?.\?.\?.\?.\?.\?.\?.\?.\?
.\?.\?\
.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?.\?\02(\01|\02)\83)"
add comment="" name=cimd regexp="\02[0-4][0-9]:[0-9]+.*\03\$"
add comment="" name=mohaa regexp="^\FF\FF\FF\FFgetstatus\
\n"
add comment="" name=stun regexp="^[\01\02]................\?\$"
add comment="" name=tor regexp=TOR1.*<identity>
add comment="" name=radmin regexp="^\01\01(\08\08|\1B\1B)\$"
add comment="" name=unset regexp=.
add comment="" name=chikka regexp="^CTPv1.[123] Kamusta.*\r\
\n\$"
add comment="" name=replaytv-ivs regexp="^(get /ivs-IVSGetFileChunk|http/(0\\.9|
1\\.0|\
1\\.1) [1-5][0-9][0-9] [\t-\r -~]*#####REPLAY_CHUNK_START#####)"
add comment="" name=armagetron regexp=YCLC_E|CYEL
# RouterOS 3.23
# IP FIREWALL MANGLE
# Marcacao de Pacotes.
# Lembre-se de mudar a interface CLIENTES para o nome da interface onde seus cli
entes
# do hotspot estao conectados.
layer7-protocol=\
layer7-protocol=\
layer7-protocol=\
layer7-protocol=\
layer7-protocol=\
layer7-protocol=\
layer7-protocol=i
layer7-protocol=m
layer7-protocol=k
layer7-protocol=\
layer7-protocol=\
layer7-protocol=\
new-packet-mark=p
dst-port=8291 \
layer7-protocol=f
layer7-protocol=i
layer7-protocol=r
layer7-protocol=r
layer7-protocol=s
dst-port=1863 \
layer7-protocol=a
layer7-protocol=\
layer7-protocol=i
layer7-protocol=\
layer7-protocol=\
new-packet-mark=http-Infinite passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no layer7-protocol=\
http-rtsp new-packet-mark=http-3Mbyte passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no layer7-protocol=h
323 \
new-packet-mark=voip passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no layer7-protocol=r
tsp \
new-packet-mark=voip passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no layer7-protocol=s
ip \
new-packet-mark=voip passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no new-packet-mark=\
udp-100 packet-size=0-100 passthrough=no protocol=udp
add action=mark-packet chain=prerouting comment="" disabled=no new-packet-mark=\
upd-500 packet-size=100-500 passthrough=no protocol=udp
add action=mark-packet chain=prerouting comment="" disabled=no new-packet-mark=\
upd-other passthrough=no protocol=udp
add action=mark-packet chain=prerouting comment="" connection-bytes=1-512000 \
disabled=no new-packet-mark=0bytes passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=512000-10000
00 \
disabled=no new-packet-mark=1Mbyte passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=1000000-3000
000 \
disabled=no new-packet-mark=3Mbyte passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=3000000-6000
000 \
disabled=no new-packet-mark=6Mbyte passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=6000000-3000
0000 \
disabled=no new-packet-mark=30Mbyte passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=30000000-600
00000 \
disabled=no new-packet-mark=60Mbytes passthrough=no
add action=mark-packet chain=prerouting comment="" connection-bytes=60000000-0 \
disabled=no new-packet-mark=Infinite passthrough=no
add action=mark-packet chain=prerouting comment="" disabled=no new-packet-mark=O
utros \
passthrough=no
# RouterOS 3.23
# QUEUE TREE
# Adicionando as Filas
# Meu link eh de 1M, e algumas filas estao liberadas. (ex. A navegacao)
/queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=10M name=Cache-Full packet-mark=proxyfull parent=\
global-total priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=1M name=ServicosDaRede packet-mark=servicosdarede parent=\
global-total priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Ssl packet-mark=ssl parent=global-total priority=2 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=200k name=P2P packet-mark=p2p parent=global-total priority=\
8 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=1M name=BatePapo packet-mark=batepapo parent=global-total \
priority=2 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Udp packet-mark="" parent=global-total priority=3 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Udp-100 packet-mark=udp-100 parent=Udp priority=1 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Udp-500 packet-mark=upd-500 parent=Udp priority=2 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Udp-Other packet-mark=upd-other parent=Udp priority=\
3 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Email packet-mark="" parent=global-total priority=4 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Pop3 packet-mark=pop3 parent=Email priority=1 queue=\
default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Imap packet-mark=imap parent=Email priority=3 queue=\
default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http packet-mark="" parent=global-total priority=2 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=1M name=Http-Navegacao packet-mark=http-navegacao parent=\
global-total priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http-1Mbyte packet-mark=http-1Mbyte parent=Http \
priority=2 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http-3Mbyte packet-mark=http-3Mbyte parent=Http \
priority=3 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http-6Mbyte packet-mark=http-6Mbyte parent=Http \
priority=4 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http-30Mbyte packet-mark=http-30Mbyte parent=Http \
priority=5 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Http-60Mbytes packet-mark=http-60Mbytes parent=Http \
priority=6 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=600k name=Http-Infinite packet-mark=http-Infinite parent=\
Http priority=7 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Youtube packet-mark=Youtube parent=Http priority=4 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros packet-mark="" parent=global-total priority=7 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-0bytes packet-mark=0bytes parent=Outros \
priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-1Mbyte packet-mark=1Mbyte parent=Outros \
priority=2 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-3Mbyte packet-mark=3Mbyte parent=Outros \
priority=3 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-6Mbyte packet-mark=6Mbyte parent=Outros \
priority=4 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-30Mbyte packet-mark=30Mbyte parent=Outros \
priority=5 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-60Mbytes packet-mark=60Mbytes parent=Outros \
priority=6 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-Infinite packet-mark=Infinite parent=Outros \
priority=7 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Outros-Desconhecidos packet-mark=Outros parent=\
Outros priority=8 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=AcessoRemoto packet-mark=acessoremoto parent=\
global-total priority=3 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Voip packet-mark=voip parent=global-total priority=6 \
queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=5M name=Hotspot packet-mark=hotspot parent=global-total \
priority=1 queue=default
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 \
max-limit=0 name=Smtp packet-mark=smtp parent=Email priority=2 queue=\
default