Порт на отделна мрежа

[meneldor]

Искам да изкарам един от портовете на RB760iGS в изолирана мрежа и не съм сигурен по кой път да тръгна. 

В момента има един bridge и всички портове са slave, мисля че към ether2(както си идва борда по подразбиране). ether1 е WAN към интернет. 

Искам да изкарам eth2+eth3 в една мрежа(да си остане в бриджа), eth4 в отделна със собствен dhcp pool, а eth5 остава празен тъй като има PoE и може да потрябва в бъдеще. Всички мрежи трябва да имат достъп до WAN. 

1) Трябва ли да изкарам задължително eth4 от master-a? 

2) Трябва ли да правя bridge на eth4 след като ще е сам? 

3) Нужно ли е да правя VLAN-и за целта или е излишно усложнение? 

4) На eth2 в бриджа ще има NAS и в един момент втората мрежа трябва да може да вижда определени портове от него. Предполагам няма да е проблем? 

 

Благодаря! 

[meneldor]

Искам да помоля да прегледате конфигурацията, която успях да скалъпя след четене от различни места за пропуски или нещо объркано. Най-вече се съмнявам, че някое правило във firewall може да не е където трябва. Изрязал съм скриптовете, че и без това е дълго.

Quote

# oct/10/2018 10:23:00 by RouterOS 6.43.2
# software id = AQME-0EWX
#
# model = RB760iGS
/interface bridge
add admin-mac=B8:B8:B8:B8:B8:B8 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=sfp1 ] disabled=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add comment="2nd floor" name=floor2-dhcp ranges=192.168.100.10-192.168.100.50
add comment="1st floor" name=floor1-dhcp ranges=192.168.50.10-192.168.50.50
/ip dhcp-server
add address-pool=floor2-dhcp disabled=no interface=bridge name="2nd floor"
add address-pool=floor1-dhcp disabled=no interface=ether4 name="1st floor"
/system logging action
set 1 disk-lines-per-file=4096
add disk-file-count=1 disk-file-name=auth.log disk-lines-per-file=5000 name=\
    auth target=disk
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=none
/interface list member
add comment="2nd Floor" interface=bridge list=LAN
add comment=Internet interface=ether1 list=WAN
add comment="1st Floor, ether4" interface=ether4 list=LAN
/interface ovpn-server server
set auth=sha1 certificate=server cipher=aes128 enabled=yes \
    require-client-certificate=yes
/ip address
add address=192.168.100.1/24 comment="2nd floor" interface=bridge network=\
    192.168.100.0
add address=192.168.50.1/24 comment="1st floor" interface=ether4 network=\
    192.168.50.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=\
    ether1
/ip dhcp-server network
add address=192.168.50.0/24 gateway=192.168.50.1
add address=192.168.100.0/24 gateway=192.168.100.1
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall address-list
add address=192.168.50.0/24 comment=1st list=whitelist
add address=192.168.100.0/24 comment=2nd list=whitelist
add address=175.45.176.0/22 comment="KOREA DEMOCRATIC PEOPLE'S REPUBLIC OF" \
    list=CountryIPBlocks
add address=1.11.0.0/16 comment="KOREA REPUBLIC OF" list=CountryIPBlocks
add address=1.16.0.0/14 comment="KOREA REPUBLIC OF" list=CountryIPBlocks
# Alot of CountryIPBlocks skipped

/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="Port scanners to list " \
    protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" \
    protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp \
    tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp \
    tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=\
    tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp \
    tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners \
    address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp \
    tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=drop chain=input comment="dropping port scanners" \
    src-address-list=port_scanners
add action=drop chain=input comment=without-whitelist dst-port=53 protocol=\
    udp src-address-list=!whitelist
add action=reject chain=input comment=without-whitelist dst-port=\
    53,2000,2222,8291 protocol=tcp reject-with=tcp-reset src-address-list=\
    !whitelist
add action=drop chain=input comment=blacklist src-address-list=blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
    address-list-timeout=1d chain=input comment="ssh brute force" \
    connection-state=new dst-port=12211 protocol=tcp src-address-list=\
    ssh_stage
add action=add-src-to-address-list address-list=ssh_stage \
    address-list-timeout=1m chain=input comment="ssh brute force" \
    connection-state=new dst-port=12211 protocol=tcp
add action=drop chain=input comment="ssh brute force" dst-port=12211 \
    protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=winbox_blacklist \
    address-list-timeout=1d chain=input comment="winbox brute force" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    winbox_stage3
add action=add-src-to-address-list address-list=winbox_stage3 \
    address-list-timeout=1m chain=input comment="winbox brute force" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 \
    address-list-timeout=1m chain=input comment="winbox brute force" \
    connection-state=new dst-port=8291 protocol=tcp src-address-list=\
    winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 \
    address-list-timeout=1m chain=input comment="winbox brute force" \
    connection-state=new dst-port=8291 protocol=tcp
add action=drop chain=input comment="winbox brute force" dst-port=8291 \
    protocol=tcp src-address-list=winbox_blacklist
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=fin,syn
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=fin,rst
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=fin,!ack
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=fin,urg
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=syn,rst
add action=drop chain=forward comment="invalid packet flags" protocol=tcp \
    tcp-flags=rst,urg
add action=drop chain=forward comment=drop_port_0 protocol=tcp src-port=0
add action=drop chain=forward comment=drop_port_0 dst-port=0 protocol=tcp
add action=drop chain=forward comment=drop_port_0 protocol=udp src-port=0
add action=drop chain=forward comment=drop_port_0 dst-port=0 protocol=udp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment=telnet dst-port=23 protocol=tcp \
    src-address-list=!telnet-accept
add action=drop chain=forward comment=ssh disabled=yes dst-address-list=\
    ssh-drop dst-port=22 protocol=tcp src-address-list=!ssh-accept
add action=drop chain=forward comment=blacklist src-address-list=blacklist
add action=drop chain=forward comment=blacklist dst-address-list=blacklist
add action=drop chain=forward comment=samba dst-port=111,135,137-139,445 \
    protocol=tcp
add action=drop chain=forward comment=samba dst-port=111,135,137-139,445 \
    protocol=udp
add action=drop chain=forward comment=CountryIPBlocks protocol=icmp \
    src-address-list=CountryIPBlocks
add action=drop chain=forward comment=CountryIPBlocks dst-port=\
    20,21,22,23,25,53,80,1723,3128,8080,12211,34567 protocol=tcp \
    src-address-list=CountryIPBlocks
add action=drop chain=forward comment=CountryIPBlocks dst-port=53,161 \
    protocol=udp src-address-list=CountryIPBlocks
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
    dst-limit=30,30,dst-address/1m40s limit=30,30:packet protocol=icmp
add action=accept chain=forward comment=echo-reply icmp-options=0:0 protocol=\
    icmp
add action=accept chain=forward comment=net-unreachable icmp-options=3:0 \
    protocol=icmp
add action=accept chain=forward comment=host-unreachable icmp-options=3:1 \
    protocol=icmp
add action=accept chain=forward comment=\
    host-unreachable-fragmentation-required icmp-options=3:4 protocol=icmp
add action=accept chain=forward comment=source-quench icmp-options=4:0 \
    protocol=icmp
add action=accept chain=forward comment=echo-request icmp-options=8:0 \
    protocol=icmp
add action=accept chain=forward comment=parameter-bad icmp-options=12:0 \
    protocol=icmp
add action=accept chain=forward comment=time-exceed icmp-options=11:0 \
    protocol=icmp
add action=drop chain=forward comment=other-types protocol=icmp
add action=accept chain=output comment=established-related-connections \
    connection-state=established,related
add action=drop chain=output comment=invalid-connections connection-state=\
    invalid
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=dst-nat chain=dstnat comment="OpenVPN UDP NAT" dst-port=3194 \
    in-interface-list=WAN protocol=udp to-addresses=192.168.100.55 to-ports=\
    1194
add action=dst-nat chain=dstnat comment="OpenVPN TCP NAT" dst-port=3194 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.100.55 to-ports=\
    1194
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip service
set telnet disabled=yes
set ftp disabled=yes
set ssh address=192.168.100.0/24,10.10.1.0/24 port=12211
set www-ssl certificate=mikro_bridge.crt_0
set api disabled=yes
set winbox address=192.168.100.0/24,192.168.50.0/24,10.0.0.44/32
set api-ssl certificate=mikro_bridge.crt_0
/ip ssh
set strong-crypto=yes
/ppp secret
add disabled=yes local-address=192.168.100.66 name=2nd-vpn service=ovpn
add local-address=192.168.50.66 name=1st-vpn service=ovpn
/system clock
set time-zone-name=Europe/Sofia
/system identity
set name=MikroBridge
/system logging
add action=disk topics=critical
add action=disk topics=error
add action=disk topics=info
add action=disk topics=warning
add action=auth topics=account
add action=auth topics=critical
/system routerboard settings
set silent-boot=no
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
 

Рутерът ще стои след бриджнат гпон(или както там се казва) с оптика от А1. Опитал съм се да изолирам двете мрежи тъй като съседа под мен ще е вързан на ether4. Тъй като не искам да пускам uPnP не ми е ясно какво трябва да е правилото за порта на uTorrent? Ако беше само една мрежа ясно, но сега не знам как да го пренасоча към определена мрежа.

Благодаря

[meneldor]

Някой може ли да погледне конфига, моля

[meneldor]

Благодаря! Vpn-на на рутера тръгнах да го правя за бекъп, но не го довърших. 

Единственото, което трябва да се вижда отвън е пренасочения порт на vpn-a. Другите сървиси ще са видими само от !WAN интерфейсите, а SSH е с променен порт. 

Под "2ро -ползвай drop в raw секцията." имаш в предвид да не ползвам reject ли? Не съм сигурен коя е raw секцията. 

Редактирано 13 Октомври, 2018 от meneldor

[meneldor]

43 minutes ago, JohnTRIVOLTA said:

Всичко що е дроп и рижект го премести с дроп в прерутинг веригата на raw секцията в стената

/ip firewall raw

Това не го знаех всички tutorials и блогове, които четох са все с filter. Дори този, който си е набит по дифолт в рутера. Ще ги преместя

[JohnTRIVOLTA]

преди 53 минути, meneldor написа:

Това не го знаех всички tutorials и блогове, които четох са все с filter. Дори този, който си е набит по дифолт в рутера. Ще ги преместя

Говоря основно за дроп и рижект на адреси от динамични или статични блек листи ! По-малко ресурс ползва рутера в случая. Ако искаш да разграничиш само веригите input и forward то си ползвай филтъра, защото в raw се отнася и за двете !

[meneldor]

Преместих почти всичко в prerouting веригата:

/ip firewall address-list
add address=192.168.50.0/24 comment=1st list=whitelist
add address=192.168.100.0/24 comment=2nd list=whitelist

/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="Port scanners to list " protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="NMAP FIN Stealth scan" protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="SYN/FIN scan" protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="SYN/RST scan" protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="FIN/PSH/URG scan" protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="ALL/ALL scan" protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=port_scanners address-list-timeout=2w chain=input comment="NMAP NULL scan" protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1d chain=input comment="ssh brute force" connection-state=new dst-port=12211 protocol=tcp src-address-list=ssh_stage
add action=add-src-to-address-list address-list=ssh_stage address-list-timeout=1m chain=input comment="ssh brute force" connection-state=new dst-port=12211 protocol=tcp
add action=add-src-to-address-list address-list=winbox_blacklist address-list-timeout=1d chain=input comment="winbox brute force" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage3
add action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=1m chain=input comment="winbox brute force" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=1m chain=input comment="winbox brute force" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=1m chain=input comment="winbox brute force" connection-state=new dst-port=8291 protocol=tcp
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=fin,syn
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=fin,rst
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=fin,!ack
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=fin,urg
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=syn,rst
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=rst,urg
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment=ssh disabled=yes dst-address-list=ssh-drop dst-port=22 protocol=tcp src-address-list=!ssh-accept
add action=drop chain=forward comment=samba dst-port=111,135,137-139,445 protocol=tcp
add action=drop chain=forward comment=samba dst-port=111,135,137-139,445 protocol=udp
add action=accept chain=forward comment=echo-reply icmp-options=0:0 protocol=icmp
add action=accept chain=forward comment=net-unreachable icmp-options=3:0 protocol=icmp
add action=accept chain=forward comment=host-unreachable icmp-options=3:1 protocol=icmp
add action=accept chain=forward comment=host-unreachable-fragmentation-required icmp-options=3:4 protocol=icmp
add action=accept chain=forward comment=source-quench icmp-options=4:0 protocol=icmp
add action=accept chain=forward comment=echo-request icmp-options=8:0 protocol=icmp
add action=accept chain=forward comment=parameter-bad icmp-options=12:0 protocol=icmp
add action=accept chain=forward comment=time-exceed icmp-options=11:0 protocol=icmp
add action=drop chain=forward comment=other-types protocol=icmp
add action=accept chain=output comment=established-related-connections connection-state=established,related
add action=drop chain=output comment=invalid-connections connection-state=invalid
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN

/ip firewall nat
add action=dst-nat chain=dstnat comment="OpenVPN UDP NAT" dst-port=3194 in-interface-list=WAN protocol=udp to-addresses=192.168.100.153 to-ports=1194
add action=dst-nat chain=dstnat comment="OpenVPN TCP NAT" dst-port=3194 in-interface-list=WAN protocol=tcp to-addresses=192.168.100.153 to-ports=1194
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN

/ip firewall raw
add action=drop chain=prerouting comment="dropping port scanners" src-address-list=port_scanners
add action=drop chain=prerouting comment=without-whitelist dst-port=53 protocol=udp src-address-list=!whitelist
add action=drop chain=prerouting comment=without-whitelist dst-port=53,2000,2222,8291 protocol=tcp src-address-list=!whitelist
add action=drop chain=prerouting comment="Src blacklist" src-address-list=blacklist
add action=drop chain=prerouting comment="Dest blacklist" dst-address-list=blacklist
add action=drop chain=prerouting comment="ssh brute force" dst-port=12211 protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=prerouting comment="winbox brute force" dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
add action=drop chain=prerouting comment=telnet dst-port=23 protocol=tcp src-address-list=!telnet-accept
add action=drop chain=prerouting comment=CountryIPBlocks src-address-list=CountryIPBlocks
add action=drop chain=prerouting comment=drop_port_0 protocol=tcp src-port=0
add action=drop chain=prerouting comment=drop_port_0 dst-port=0 protocol=tcp
add action=drop chain=prerouting comment=drop_port_0 protocol=udp src-port=0
add action=drop chain=prerouting comment=drop_port_0 dst-port=0 protocol=udp

Може ли още нещо от филтъра да се премести долу и трябва ли да направя някакво разместване?

Благодаря!

[meneldor]

То всичко е copy/paste от различни места и за това се получава така

Значи вместо src-address-list=!whitelist да ползвам src-interface-list=WAN? 

Коментари има навсякъде макар и някои ьа не са много пояснителни

[meneldor]

Чак снощи преместих мрежата на рутера. Нет има, но DNAT-ите не работят. Примерно този за VPN-a както и един за торент клиента:

Quote

add action=dst-nat chain=dstnat comment="OpenVPN UDP NAT" dst-port=3194 in-interface-list=WAN protocol=udp to-addresses=192.168.100.153 to-ports=1194

 

[JohnTRIVOLTA]

Преди 3 часа, meneldor написа:

Чак снощи преместих мрежата на рутера. Нет има, но DNAT-ите не работят. Примерно този за VPN-a както и един за торент клиента:

 

И по-точно как разбра, че не работи ... защо ползваш листа за вход, а не даден интерфейс в првилото за нат?

[meneldor]

Моя грешка, vpn nat-a работи, порта за торентите уж ми го показва отворен като го сканирам отвън, но торент клиента казва, че е затворен. 

Смених от interface list на interface ether1. От copy/paste е останало така :)