#knock door_官方
/ip firewall filter
add action=add-src-to-address-list address-list="port:9000″ \
address-list-timeout=1m chain=input dst-port=9000 protocol=tcp
add action=add-src-to-address-list address-list="secure" address-list-timeout=1m \
chain=input dst-port=6000 protocol=tcp src-address-list="port:9000″
add chain=input src-address-list=secure action=accept
add action=drop chain=input
#knock door
/ ip firewall filter
add chain=input protocol=tcp dst-port=1337 action=add-src-to-address-list address-list=knock \
address-list-timeout=15s comment="Port Knocking1″ disabled=no
add chain=input protocol=tcp dst-port=7331 src-address-list=knock action= add-src-to-address-list \
address-list=safe address-list-timeout=15m comment="Port Knocking2″ disabled=no
當第一次收到 TCP/1337, 就把 source address 加到 knock address-list, 且有效期只有 15s, 表示在 15s 以內必須再送出第二個正確的封包, 如果送出正確的封包就把它加到 safe list. 既加到 safe list, 有效期為 1day, 這些變化都是自己可以再去改變的,
之後的 firewall rule 只要允許 safe list 的來源 IP 能允許對 router 存取就可以了.