Jump to content
  • 0

Странен казус с маскиране на IP адрес

hettrik

Asked by hettrik,

 Share

Question

hettrik Newbie

hettrik

Posted
Posted (edited)

Здравейте,

Имам следния странен казус.

Имам няколко мрежи на един физически интерфейс разделени в отделни VLAN. 

В една от мрежите се намира WEB server. В лога на сървъра не мога да видя реалните IP адреси на клиентите от другите ми мрежи, а виждам IP адреса на default GW на Web server . Нямам сложени правила за маскиране на IP адреси.

Интересното е, че преди този проблем го нямах, но явно след някакви допълнителни настройки имам това маскиране. Не мога да върна backup, защото нямам подходящ такъв.

 Ако има значение модела е на Микротика е RB2011iL.

Някой ако има идея как да го правя, моля да пише.

Благодаря предварително. 

Edited by hettrik
Link to comment
Share on other sites

10 answers to this question

Recommended Posts

  • 0
  • Administrator
111111 Rising Star

111111

Posted
  • Administrator
Posted

ти обнови защото ще имаш казус после с размествания на интерфейсите 
суич мастер-порт изчезва и всичко е в бриджа

 

Цитат 

/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration"

Добави WAN интерфейса и кажи каква е ситуацията

Харесай поста ^^^
acer.gif htc.gifsigpic4024_2.gif

Форумът е за взаимопомощ а не за свършване на чужда работа

ɹɐǝɥ uɐɔ noʎ ǝɹoɯ ǝɥʇ 'ǝɯoɔǝq noʎ ɹǝʇǝınb ǝɥʇ

Link to comment
Share on other sites
  • 0
  • Administrator
111111 Rising Star

111111

Posted
  • Administrator
Posted

И все пак един експорт ще помогне да не гадаеме.

Харесай поста ^^^
acer.gif htc.gifsigpic4024_2.gif

Форумът е за взаимопомощ а не за свършване на чужда работа

ɹɐǝɥ uɐɔ noʎ ǝɹoɯ ǝɥʇ 'ǝɯoɔǝq noʎ ɹǝʇǝınb ǝɥʇ

Link to comment
Share on other sites
  • 0
hettrik
Newbie

hettrik

Posted
  • Author
Posted

От гледна точка на сигурността не мога да експортна цялата конфигурация. Коя информация от експорта ти е необходима, за да помогнеш?

Благодаря отново. 

Link to comment
Share on other sites
  • 0
  • Administrator
111111 Rising Star

111111

Posted
  • Administrator
Posted
Преди 3 часа, hettrik написа:

От гледна точка на сигурността не мога да експортна цялата конфигурация. Коя информация от експорта ти е необходима, за да помогнеш?

Благодаря отново. 

махни чувствителната информация все пак текстов фаел е 
не е сложно да заместиш с xxx yyy zzz.

Харесай поста ^^^
acer.gif htc.gifsigpic4024_2.gif

Форумът е за взаимопомощ а не за свършване на чужда работа

ɹɐǝɥ uɐɔ noʎ ǝɹoɯ ǝɥʇ 'ǝɯoɔǝq noʎ ɹǝʇǝınb ǝɥʇ

Link to comment
Share on other sites
  • 0
hettrik
Newbie

hettrik

Posted
  • Author
Posted

Да се надяваме, че това ще свърши работа 

/interface bridge
add admin-mac=11:22:33:44:55:66 auto-mac=no disabled=yes name=bridge-local
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] arp=proxy-arp
set [ find default-name=ether6 ] name=ether6-master-local
set [ find default-name=ether7 ] master-port=ether6-master-local name=ether7-slave-local
set [ find default-name=ether8 ] master-port=ether6-master-local name=ether8-slave-local
set [ find default-name=ether9 ] master-port=ether6-master-local name=ether9-slave-local
set [ find default-name=ether10 ] master-port=ether6-master-local name=ether10-slave-local
/interface vlan
add arp=proxy-arp  interface=ether2 l2mtu=1594 name=vlan10 vlan-id=10
add arp=proxy-arp  interface=ether2 l2mtu=1594 name=vlan11 vlan-id=11
add arp=proxy-arp interface=ether2 l2mtu=1594 name=vlan12 vlan-id=12
add interface=ether2 l2mtu=1594 name=vlan13 vlan-id=13
add arp=proxy-arp interface=ether2 l2mtu=1594 name=vlan14 vlan-id=14
add interface=ether2 l2mtu=1594 name=vlan50 vlan-id=50
add arp=reply-only  interface=ether2 l2mtu=1594 name=vlan66 vlan-id=66
add disabled=yes interface=ether2 name=vlan99 vlan-id=99
add interface=ether2 l2mtu=1594 name=vlan101 vlan-id=101

/ip dhcp-server
add interface=bridge-local name=default1
/ip firewall layer7-protocol
add name=test regexp="\"^.*(get|GET).+(viber).*\\\$\""
add name=viber regexp="(viber|amazonaws|cloudfront)"
add name=website regexp="^.*(facebook|youtube|vbox7|tube).*\$"
add name=streaming regexp=\
    "(3gp|mov|mpe|mpeg|mpeg2|mpeg3|mpeg4|mkv|avi|flv|f4v|f4p|f4a|f4b|x-flv|msi|wmv|mp2|mp3|mp4|swf|rm|rmvb|vcd|pdf|dat|iso|nrg|bin|cab|vcd|ogg|wma|divx|d2v|qt|0[0-9][0-9])"
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des,aes-128-cbc
add disabled=yes enc-algorithms=3des name=IP
/ip pool
add name=VLAN1 ranges=192.168.11.110-192.168.11.199
add name=VLAN50 ranges=192.168.150.10-192.168.150.50
add name=VLAN66 ranges=192.168.166.10-192.168.166.150
add name=VLAN10 ranges=192.168.110.5-192.168.110.100
add name=VLAN11 ranges=192.168.110.131-192.168.110.250
add name=VLAN12 ranges=192.168.111.5-192.168.111.110
add name=VLAN13 ranges=192.168.111.131-192.168.111.250
add name=VLAN14 ranges=192.168.112.5-192.168.112.120
/ip dhcp-server
add add-arp=yes address-pool=VLAN50 disabled=no interface=vlan50 name=VLAN50
add add-arp=yes address-pool=VLAN66 disabled=no interface=vlan66 name=VLAN66
add address-pool=VLAN1 interface=ether2 name=default
add add-arp=yes address-pool=VLAN1 disabled=no interface=ether2 name=VLAN1
add add-arp=yes address-pool=VLAN10 disabled=no interface=vlan10 name=VLAN10
add add-arp=yes address-pool=VLAN11 disabled=no interface=vlan11 name=VLAN11
add add-arp=yes address-pool=VLAN12 disabled=no interface=vlan12 name=VLAN12
add add-arp=yes address-pool=VLAN13 disabled=no interface=vlan13 name=VLAN13
add add-arp=yes address-pool=VLAN14 disabled=no interface=vlan14 name=VLAN14
/interface bridge port
add bridge=bridge-local interface=ether2
add bridge=bridge-local interface=ether3
add bridge=bridge-local interface=ether4
add bridge=bridge-local interface=ether5
add bridge=bridge-local interface=ether6-master-local
/interface ethernet switch vlan
add disabled=yes ports=ether2 switch=switch1 vlan-id=1
add disabled=yes ports=ether2 switch=switch1 vlan-id=50

/ip address
add address=192.168.150.251/24 interface=vlan50 network=192.168.150.0
add address=192.168.166.251/24 interface=vlan66 network=192.168.166.0
add address=192.168.11.251/24  interface=ether2 network=192.168.11.0
add address=192.168.110.1/25 interface=vlan10 network=192.168.110.0
add address=192.168.110.129/25  interface=vlan11 network=192.168.110.128
add address=192.168.111.1/25  interface=vlan12 network=192.168.111.0
add address=192.168.111.129/25  interface=vlan13 network=192.168.111.128
add address=192.168.112.1/25 interface=vlan14 network=192.168.112.0
add address=192.168.199.1/25 disabled=yes interface=vlan99 network=192.168.199.0
/ip arp
add address=192.168.50.10 interface=vlan50 mac-address=D2:27:E5:a9:1B:58
/ip dhcp-server network
add address=192.168.11.0/24 comment="default configuration" dns-server=192.168.11.251,192.168.11.225 gateway=192.168.11.251 netmask=24
add address=192.168.110.0/25 dns-server=192.168.110.1,192.168.11.225 gateway=192.168.110.1 netmask=25
add address=192.168.110.128/25 dns-server=192.168.110.129,192.168.11.225 gateway=192.168.110.129 netmask=25
add address=192.168.111.0/25 dns-server=192.168.111.1,192.168.11.225 gateway=192.168.111.1 netmask=25
add address=192.168.111.128/25 dns-server=192.168.111.129,192.168.11.225 gateway=192.168.111.129 netmask=25
add address=192.168.112.0/25 dns-server=192.168.112.1,192.168.11.225 gateway=192.168.112.1 netmask=25
add address=192.168.150.0/24 dns-server=192.168.150.251,192.168.11.225 gateway=192.168.150.251
add address=192.168.166.0/24 dns-server=192.168.166.251,192.168.11.225 gateway=192.168.166.251 netmask=24
/ip firewall filter
add chain=input dst-port=500,4500,1701 protocol=udp
add chain=input protocol=ipsec-esp
add action=drop chain=input comment="Drop ICMP requests" in-interface=ether1-gateway protocol=icmp 
add action=add-src-to-address-list address-list=syn-flood address-list-timeout=30m chain=input comment=syn-flood connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input src-address-list=syn-flood
add action=add-src-to-address-list address-list=scanner-detect address-list-timeout=1h chain=input comment=scanner-detect protocol=tcp psd=21,3s,3,1
add action=drop chain=input src-address-list=scanner-detect
add action=drop chain=input comment="web access microtik" dst-port=80,23,22,21,2000,8443,8080 in-interface=ether1-gateway protocol=tcp
add chain=input comment="Accept established and related (DNS and NTP to work)" connection-state=established in-interface=ether1-gateway
add chain=input comment="Accept established and related (DNS and NTP to work)" connection-state=related in-interface=ether1-gateway
add action=add-src-to-address-list address-list=winbox_blacklist address-list-timeout=1d chain=input comment="winbox brute force" connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage3
add action=add-src-to-address-list address-list=winbox_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage2
add action=add-src-to-address-list address-list=winbox_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=8291 protocol=tcp src-address-list=winbox_stage1
add action=add-src-to-address-list address-list=winbox_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=8291 protocol=tcp
add action=drop chain=input dst-port=8291 protocol=tcp src-address-list=winbox_blacklist
add chain=input dst-port=8291 in-interface=ether1-gateway protocol=tcp src-address-list=access
add chain=input dst-port=8291 in-interface=ether3 protocol=tcp src-address-list=access
add action=drop chain=input comment="Drop invalid packets" connection-state=invalid in-interface=ether1-gateway
add action=drop chain=input in-interface=ether1-gateway
add action=drop chain=forward comment="invalid packet flags" protocol=tcp tcp-flags=!fin,!syn,!rst,!ack
add action=drop chain=forward protocol=tcp tcp-flags=fin,syn
add action=drop chain=forward protocol=tcp tcp-flags=fin,rst
add action=drop chain=forward protocol=tcp tcp-flags=fin,!ack
add action=drop chain=forward protocol=tcp tcp-flags=fin,urg
add action=drop chain=forward protocol=tcp tcp-flags=syn,rst
add action=drop chain=forward protocol=tcp tcp-flags=rst,urg
add action=drop chain=forward comment=drop_port_0 protocol=tcp src-port=0
add action=drop chain=forward dst-port=0 protocol=tcp
add action=drop chain=forward protocol=udp src-port=0
add action=drop chain=forward dst-port=0 protocol=udp
add chain=forward  dst-port=5938 protocol=tcp
add action=drop chain=forward out-interface=ether1-gateway src-address-list=traffic
add action=drop chain=forward dst-address-list=raffic in-interface=ether1-gateway
add action=drop chain=forward layer7-protocol=website src-address=192.168.111.130
add action=drop chain=forward layer7-protocol=website src-address=192.168.111.134
add chain=forward dst-address=192.168.111.225 dst-port=53 protocol=udp src-address=10.10.10.0/23
add chain=forward dst-address=192.168.111.202 dst-port=5487 protocol=tcp src-address=10.10.10.0/23
add action=drop chain=forward disabled=yes dst-address=192.168.11.0/24 src-address=10.10.10.0/23
add action=drop chain=forward src-address=10.10.10.0/23
add chain=forward connection-state=established dst-address=192.168.11.252
add chain=forward src-address=192.168.11.253
add chain=forward connection-state=established dst-address=192.168.11.253
add chain=forward comment="Accept established and related for clients to work" connection-state=established
add chain=forward connection-state=related
add chain=forward comment="Allow VLAN to services" dst-address-list=service1 in-interface=vlan10 src-address=192.168.110.0/25
add chain=forward connection-state=established dst-address=192.168.110.0/25 in-interface=vlan10 src-address-list=service1
add chain=forward dst-address-list=printers in-interface=vlan10 src-address=192.168.110.0/25
add chain=forward connection-state=established dst-address=192.168.110.0/25 in-interface=vlan10 src-address-list=printers
add chain=forward dst-address-list=service1 in-interface=vlan11 src-address=192.168.110.128/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.110.128/25 in-interface=vlan11 src-address-list=service1
add chain=forward dst-address-list=printers in-interface=vlan11 src-address=192.168.110.128/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.110.128/25 in-interface=vlan11 src-address-list=printers
add chain=forward dst-address-list=service1 in-interface=vlan12 src-address=192.168.111.0/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.111.0/25 in-interface=vlan12 src-address-list=service1
add chain=forward dst-address-list=printers in-interface=vlan12 src-address=192.168.111.0/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.111.0/25 in-interface=vlan12 src-address-list=printers
add chain=forward dst-address-list=service1 in-interface=vlan13 src-address=192.168.111.128/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.111.128/25 in-interface=vlan13 src-address-list=service1
add chain=forward dst-address-list=printers in-interface=vlan13 src-address=192.168.111.128/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.111.128/25 in-interface=vlan13 src-address-list=printers
add chain=forward dst-address-list=service1 in-interface=vlan14 src-address=192.168.112.0/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.112.0/25 in-interface=vlan14 src-address-list=service1
add chain=forward dst-address-list=printers in-interface=vlan14 src-address=192.168.112.0/25 src-address-list=""
add chain=forward connection-state=established dst-address=192.168.112.0/25 in-interface=vlan14 src-address-list=printers
add chain=forward dst-address=192.168.111.20 dst-port=1234 in-interface=vlan10 protocol=tcp src-address=192.168.110.0/25
add chain=forward connection-state=established dst-address=192.168.110.0/25 in-interface=vlan10 src-address=192.168.111.20
add chain=forward dst-address=192.168.111.20 dst-port=1234 in-interface=vlan11 protocol=tcp src-address=192.168.110.128/25
add chain=forward connection-state=established dst-address=192.168.110.128/25 in-interface=vlan11 src-address=192.168.111.20
add chain=forward dst-address=192.168.111.20 dst-port=1234 in-interface=vlan12 protocol=tcp src-address=192.168.111.0/25
add chain=forward connection-state=established dst-address=192.168.111.0/25 in-interface=vlan12 src-address=192.168.111.20
add chain=forward dst-address=192.168.111.20 dst-port=1234 in-interface=vlan13 protocol=tcp src-address=192.168.111.128/25
add chain=forward connection-state=established dst-address=192.168.111.128/25 in-interface=vlan13 src-address=192.168.111.20
add chain=forward dst-address=192.168.111.20 dst-port=1234 in-interface=vlan14 protocol=tcp src-address=192.168.112.0/25
add chain=forward connection-state=established dst-address=192.168.112.0/25 in-interface=vlan14 src-address=192.168.111.20
add action=drop chain=forward comment="Deny VLAN to VLAN" dst-address-list=!VLAN1 in-interface=ether2 src-address=192.168.111.0/24
add action=drop chain=forward dst-address-list=!VLAN10 in-interface=vlan10 src-address=192.168.110.0/25
add action=drop chain=forward dst-address-list=!VLAN11 in-interface=vlan11 src-address=192.168.110.128/25
add action=drop chain=forward dst-address-list=!VLAN12 in-interface=vlan12 src-address=192.168.111.0/25
add action=drop chain=forward dst-address-list=!VLAN13 in-interface=vlan13 src-address=192.168.111.128/25
add action=drop chain=forward dst-address-list=!VLAN14 in-interface=vlan14 src-address=192.168.112.0/25
add action=drop chain=forward dst-address-list=!VLAN50 in-interface=vlan50 src-address=192.168.150.0/24
add action=drop chain=forward dst-address-list=!VLAN66 in-interface=vlan66 src-address=192.168.166.0/24
add action=drop chain=forward comment="Drop everything else" connection-state=invalid
add chain=output out-interface=ether1-gateway protocol=icmp

/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration"
add action=dst-nat chain=dstnat dst-port=1234 in-interface=ether1-gateway protocol=tcp src-address-list=out to-addresses=192.168.111.20 to-ports=1234

/ip route
add check-gateway=ping distance=1 gateway=xxx.yyy.zzz.aaa
add distance=2 gateway=xxx.yyy.zzz.aaa
add disabled=yes distance=1 dst-address=8.8.8.8/32 gateway=xxx.yyy.zzz.aaa scope=10
add disabled=yes distance=1 dst-address=8.8.8.8/32 gateway=xxx.yyy.zzz.aaa scope=10
add distance=1 dst-address=10.10.10.113/32 gateway=*1A
add distance=1 dst-address=10.110.110.0/23 gateway=10.10.0.1

 

Link to comment
Share on other sites
  • 0
  • Administrator
111111 Rising Star

111111

Posted
  • Administrator
Posted

Да запитам с коя версия на операционната система е борда?

Харесай поста ^^^
acer.gif htc.gifsigpic4024_2.gif

Форумът е за взаимопомощ а не за свършване на чужда работа

ɹɐǝɥ uɐɔ noʎ ǝɹoɯ ǝɥʇ 'ǝɯoɔǝq noʎ ɹǝʇǝınb ǝɥʇ

Link to comment
Share on other sites
  • 0
hettrik
Newbie

hettrik

Posted
  • Author
Posted

6.18. знам че е доста старичка и планирам да правя update, но искам първо да оправя този казус и след това. Едва ли проблем е от версията, защото преди всичко си беше наред.

Link to comment
Share on other sites
  • 0
hettrik
Newbie

hettrik

Posted
  • Author
Posted

Стана, а защо стана. Каква роля игра е интерфейса при тази ситуация?

Благодаря много.  ?

Link to comment
Share on other sites
  • 0
  • Administrator
111111 Rising Star

111111

Posted
  • Administrator
Posted

Условието да маскира когато е глобално е така, когато кажеш само на къде, то вътрешния ти трафик се рутира.

Харесай поста ^^^
acer.gif htc.gifsigpic4024_2.gif

Форумът е за взаимопомощ а не за свършване на чужда работа

ɹɐǝɥ uɐɔ noʎ ǝɹoɯ ǝɥʇ 'ǝɯoɔǝq noʎ ɹǝʇǝınb ǝɥʇ

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to question listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.

  I accept