WereDoku

User Tools

Site Tools

Trace:
mikrotik

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
mikrotik [2019/12/16 00:05]
ww 		mikrotik [2022/03/16 09:52] (current)
ww
Line 85: Line 85:
 /ip route add gateway=ether2-wan2 routing-mark=routing_mark_guests </code> Note: Gateway can also be a PPPoE connection (in case of DSL).  /ip route add gateway=ether2-wan2 routing-mark=routing_mark_guests </code> Note: Gateway can also be a PPPoE connection (in case of DSL). 
   - Set up masquerade for the second wan interface (assuming that masquerade was set up only for the ''ether1-wan1'').   - Set up masquerade for the second wan interface (assuming that masquerade was set up only for the ''ether1-wan1'').
 +
 +----
 +
 +===== IPv4 firewall stub =====
 +  /ip firewall filter
 +    add chain=forward  connection-state=established,related              action=fasttrack-connection  comment="Fasttrack"
 +    add chain=forward  connection-state=established,related,untracked    action=accept                comment="Allow ESTABLISHED, RELATED, UNTRACKED (FORWARD)"
 +    add chain=forward  connection-state=invalid                          action=drop disabled=yes     comment="Drop INVALID (FORWARD)"
 +    add chain=forward  connection-nat-state=!dstnat  \
 +                       connection-state=new \
 +                       in-interface-list=WAN                             action=drop disabled=yes     comment="Drop all from WAN not DST-NATted (FORWARD)" 
 +    add chain=input    connection-state=invalid                          action=drop disabled=yes     comment="Drop INVALID (INPUT)"
 +    add chain=input    connection-state=established,related,untracked    action=accept                comment="Allow ESTABLISHED, RELATED, UNTRACKED (INPUT)"
 +    add chain=input    protocol=icmp                                     action=accept                comment="Allow ICMP (INPUT)"
 +    add chain=input    in-interface-list=!LAN                            action=drop disabled=yes     comment="Drop all not coming from LAN (INPUT)"
  
 ---- ----
Line 90: Line 105:
 ===== IPv6 firewall stub ===== ===== IPv6 firewall stub =====
   /ipv6 firewall filter   /ipv6 firewall filter
-  add action=accept comment="Allow ESTABLISHED (FORWARD)" chain=forward connection-state=established disabled=no  +  add chain=forward connection-state=established                action=accept             comment="Allow ESTABLISHED (FORWARD)" 
-  add action=accept comment="Allow RELATED (FORWARD)" chain=forward connection-state=related disabled=no +  add chain=forward connection-state=related                    action=accept             comment="Allow RELATED (FORWARD)" 
-  add action=accept comment="Allow ICMPv6 (FORWARD)" chain=forward disabled=no in-interface=pppoe-out1 protocol=icmpv6  +  add chain=forward in-interface-list=WAN protocol=icmpv6       action=accept             comment="Allow ICMPv6 (FORWARD)" 
-  add action=drop comment="Drop everything else (FORWARD)" chain=forward disabled=no in-interface=pppoe-out1  +  add chain=forward in-interface-list=WAN                       action=drop disabled=yes  comment="Drop everything else (FORWARD)" 
-  add action=accept comment="Allow ESTABLISHED (INPUT)" chain=input connection-state=established disabled=no  +  add chain=input   connection-state=established                action=accept             comment="Allow ESTABLISHED (INPUT)" 
-  add action=accept comment="Allow RELATED (INPUT)" chain=input connection-state=related disabled=no  +  add chain=input   connection-state=related                    action=accept             comment="Allow RELATED (INPUT)" 
-  add action=accept comment="Allow ICMPv6 (INPUT)" chain=input disabled=no in-interface=pppoe-out1 protocol=icmpv6  +  add chain=input   in-interface-list=WAN protocol=icmpv6       action=accept             comment="Allow ICMPv6 (INPUT)" 
-  add action=accept comment="Allow DHCPv6 (INPUT)" chain=input disabled=no in-interface=pppoe-out1 protocol=udp port=546 +  add chain=input   in-interface-list=WAN protocol=udp port=546 action=accept             comment="Allow DHCPv6 (INPUT)" 
-  add action=drop comment="Drop everything else (INPUT)" chain=input disabled=no in-interface=pppoe-out1+  add chain=input   in-interface-list=WAN                       action=drop disabled=yes  comment="Drop everything else (INPUT)"
  
 ---- ----
Line 137: Line 152:
 6) Zapnout arp-proxy na bridge (aby router odpovídal klientům na ARP dotazy i skrze tunel) 6) Zapnout arp-proxy na bridge (aby router odpovídal klientům na ARP dotazy i skrze tunel)
 <code>/interface bridge1 set arp=proxy-arp</code> <code>/interface bridge1 set arp=proxy-arp</code>
 +
 +==== Router za 1:1 NAT ====
 +
 +''X.X.X.X'' = skutečná veřejná adresa \\
 +''L.L.L.L'' = LAN adresa od ISP, na kterou je veřejná adresa NATována
 +
 +1) Přidat dummy interface s dummy MAC adresou (aby router věděl o své veřejce) \\
 +2) Nastavit prerouting tak, aby příchozí pakety vůči routeru vypadaly, že přišly na veřejnou adresu.
 +
 +  /interface bridge
 +    add admin-mac=02:00:00:00:00:01 auto-mac=no name=bridge-pubip protocol-mode=none
 +  /ip address
 +    add address=L.L.L.L/24 interface=ether1
 +    add address=X.X.X.X/32 interface=bridge-pubip
 +  /ip firewall nat
 +    add action=dst-nat chain=dstnat dst-address=L.L.L.L dst-port=500,4500 protocol=udp to- 
 +    addresses=X.X.X.X
 +    add action=dst-nat chain=dstnat dst-address=L.L.L.L protocol=ipsec-esp to-addresses=X.X.X.X
  
 ---- ----
Line 162: Line 195:
   * Nevýhoda: Google DNS NEbude dostupné přes GW2.   * Nevýhoda: Google DNS NEbude dostupné přes GW2.
   * [[https://www.prinmath.com/ham/mikrotik-failover.htm|Zdroj]]   * [[https://www.prinmath.com/ham/mikrotik-failover.htm|Zdroj]]
 +
 +----
 +
 +===== Ban list =====
 +<code>
 +/ ip firewall filter 
 +add chain=input in-interface=ether1-wan protocol=tcp dst-port=22 \
 +    connection-state=new connection-limit=5/1m;1:packet \
 +    action=add-src-to-address-list address-list=ssh_logins \
 +    address-list-timeout=12h comment="" disabled=no 
 +add chain=input protocol=tcp dst-port=22 src-address-list=!ssh_logins \
 +    action=accept comment="" disabled=no 
 +</code>
mikrotik.1576451113.txt.gz · Last modified: 2022/03/16 09:38 (external edit)

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki