Микротик rb1100AH проблем!!!

[Fibernet]

Здравеите имам строхотен проблем со Микротик 1000ах при вклучување на линк на една од wan интерфејсите веднага имам 100%load кога ке направам disable на истата cpu load е нормален 30-40 % помагајте колеги.Поздрав!

исклучив allow remote request во ip-dns  и сега е ок 

[JohnTRIVOLTA]

Това означава ли , че вместо да слагаме правила в Fi Fi за input веригата, то в RAW e по-добре -  пример за портсканери правила за адване в блек лист и да дропим листнатите в RAW ?

[111111]

Точно така

[wowefect]

може ли пример за порт скенери в RAW > ?? това правилно ли е ? :

add action=drop chain=prerouting dst-port=53,123 in-interface=ether8 protocol=\
    tcp
add action=drop chain=prerouting dst-port=53,123 in-interface=ether8 protocol=\
    udp
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="Port scanners to list " \
    protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="NMAP FIN Stealth scan" \
    protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="SYN/FIN scan" protocol=\
    tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="SYN/RST scan" protocol=\
    tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="FIN/PSH/URG scan" \
    protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="ALL/ALL scan" protocol=\
    tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners_list \
    address-list-timeout=4w2d chain=prerouting comment="NMAP NULL scan" \
    protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=prerouting comment="dropping port scanners" \
    src-address-list=port_scanners_list

 

[111111]

безцелно упражнение сложи генерален дроп на всичко което не си разрешил

[wowefect]

преди 18 минути, 111111 написа:

безцелно упражнение сложи генерален дроп на всичко което не си разрешил

да сложа генерален дроп>?

[111111]

разрешаваш 
input :9981 tcp WAN allow
input WAN drop

разгледай стартиращия скрипт

>system default-configuration print
  script: :global ssid;
          #| RouterMode:
          #|  * WAN port is protected by firewall and enabled DHCP client
          #|  * Wireless interfaces are part of LAN bridge
          #|  * IP address 192.168.88.1/24 is set on LAN port
          #| wlan1 Configuration:
          #|     mode:          ap-bridge;
          #|     band:          2ghz-b/g/n;
          #|     ht-chains:     0,1;
          #|     ht-extension:  20/40mhz-Ce;
          #| LAN Configuration:
          #|     switch group: ether2 (master), ether3, ether4, ether5
          #|     DHCP Server: enabled;
          #|     DNS: enabled;
          #| WAN (gateway) Configuration:
          #|     gateway:  ether1 ;
          #|     firewall:  enabled;
          #|     NAT:   enabled;
          
          :log info Starting_defconf_script_;
          :global action;
          #-------------------------------------------------------------------------------
          # Apply configuration.
          # these commands are executed after installation or configuration reset
          #-------------------------------------------------------------------------------
          :if ($action = "apply") do={
          # wait for interfaces
          :local count 0; 
          :while ([/interface ethernet find] = "") do={ 
          :if ($count = 30) do={
          :log warning "DefConf: Unable to find ethernet interfaces";
          /quit;
          }
          :delay 1s; :set count ($count +1); 
          };
          
            :local count 0;
            :while ([/interface wireless print count-only] < 1) do={ 
              :set count ($count +1);
              :if ($count = 30) do={
                :log warning "DefConf: Unable to find wireless interface(s)"; 
                /ip address add address=192.168.88.1/24 interface=ether1 comment="defconf";
                /quit
              }
              :delay 1s;
            };
            /interface wireless {
              set wlan1 mode=ap-bridge band=2ghz-b/g/n tx-chains=0,1 rx-chains=0,1 \
                disabled=no wireless-protocol=802.11 distance=indoors
              :local wlanMac  [/interface wireless get wlan1 mac-address];
              :set ssid "MikroTik-$[:pick $wlanMac 9 11]$[:pick $wlanMac 12 14]$[:pick $wlanMac 15 17]"
              set wlan1 ssid=$ssid
              set wlan1 frequency=auto
              set wlan1 channel-width=20/40mhz-Ce ;
            }
           /interface ethernet {
             set ether2 name=ether2-master;
             set ether3 master-port=ether2-master;
             set ether4 master-port=ether2-master;
             set ether5 master-port=ether2-master;
           }
           /interface bridge
             add name=bridge disabled=no auto-mac=yes protocol-mode=rstp comment=defconf;
           :local bMACIsSet 0;
           :foreach k in=[/interface find where !(slave=yes  || name~"ether1" || name~"bridge")] do={
             :log info "k: $k"
             :local tmpPortName [/interface get $k name];
             :log info "port: $tmpPortName"
             :if ($bMACIsSet = 0) do={
               :if ([/interface get $k type] = "ether") do={
                 /interface bridge set "bridge" auto-mac=no admin-mac=[/interface ethernet get $tmpPortName mac-address];
                 :set bMACIsSet 1;
               }
             }
             /interface bridge port
               add bridge=bridge interface=$tmpPortName comment=defconf;
           }
            /ip address add address=192.168.88.1/24 interface=bridge comment="defconf";
             /ip pool add name="default-dhcp" ranges=192.168.88.10-192.168.88.254;
             /ip dhcp-server
               add name=defconf address-pool="default-dhcp" interface=bridge lease-time=10m disabled=no;
             /ip dhcp-server network
               add address=192.168.88.0/24 gateway=192.168.88.1 comment="defconf";
           /ip dns {
               set allow-remote-requests=yes
               static add name=router address=192.168.88.1
           }
          
             /ip dhcp-client add interface=ether1 disabled=no comment="defconf";
           /ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="defconf: masquerade"
           /ip firewall {
             filter add chain=input action=accept protocol=icmp comment="defconf: accept ICMP"
             filter add chain=input action=accept connection-state=established,related comment="defconf: accept established,related"
             filter add chain=input action=drop in-interface=ether1 comment="defconf: drop all from WAN"
             filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
             filter add chain=forward action=accept connection-state=established,related comment="defconf: accept established,related"
             filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
             filter add chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface=ether1 comment="defconf:  drop all from WAN n>
           }
           /ip neighbor discovery set [find name="ether1"] discover=no
           /tool mac-server disable [find];
           /tool mac-server mac-winbox disable [find];
           :foreach k in=[/interface find where !(slave=yes  || name~"ether1")] do={
             :local tmpName [/interface get $k name];
             /tool mac-server add interface=$tmpName disabled=no;
             /tool mac-server mac-winbox add interface=$tmpName disabled=no;
           }
          }
          #-------------------------------------------------------------------------------
          # Revert configuration.
          # these commands are executed if user requests to remove default configuration
          #-------------------------------------------------------------------------------
          :if ($action = "revert") do={
          # remove wan port protection
           /ip firewall filter remove [find comment~"defconf"]
           /ip firewall nat remove [find comment~"defconf"]
           /tool mac-server remove [find interface!=all]
           /tool mac-server set [find] disabled=no
           /tool mac-server mac-winbox remove [find interface!=all]
           /tool mac-server mac-winbox set [find] disabled=no
           /ip neighbor discovery set [find ] discover=yes
             :local o [/ip dhcp-server network find comment="defconf"]
             :if ([:len $o] != 0) do={ /ip dhcp-server network remove $o }
             :local o [/ip dhcp-server find name="defconf" !disabled]
             :if ([:len $o] != 0) do={ /ip dhcp-server remove $o }
             /ip pool {
               :local o [find name="default-dhcp" ranges=192.168.88.10-192.168.88.254]
               :if ([:len $o] != 0) do={ remove $o }
             }
             :local o [/ip dhcp-client find comment="defconf"]
             :if ([:len $o] != 0) do={ /ip dhcp-client remove $o }
           /ip dns {
             set allow-remote-requests=no
             :local o [static find name=router address=192.168.88.1]
             :if ([:len $o] != 0) do={ static remove $o }
           }
           /ip address {
             :local o [find comment="defconf"]
             :if ([:len $o] != 0) do={ remove $o }
           }
           :foreach iface in=[/interface ethernet find] do={
             /interface ethernet set $iface name=[get $iface default-name]
             /interface ethernet set $iface master-port=none
           }
           /interface bridge port remove [find comment="defconf"]
           /interface bridge remove [find comment="defconf"]
           /interface wireless reset-configuration wlan1
          }
          :log info Defconf_script_finished;
          

Input чеина е свързан само с комуникация до рутера

малко по сложна става работата при нат когато отвън на вътре искаш да иницираш връзка