halfsky писал(а): ↑19 апр 2020, 12:04
Что то не получается у меня ...
вот , на всякий случай мой конфиг, посмотрите , может быть упускаю что то очевидное )
RouterOS 6.46.5
/interface bridge
add arp=proxy-arp fast-forward=no igmp-snooping=yes mtu=1500 name=LAN-Bridge \
protocol-mode=none
/interface ethernet
set [ find default-name=ether2 ] name=LAN1-Ethernet
set [ find default-name=ether3 ] name=LAN2-Ethernet
set [ find default-name=ether4 ] name=LAN3-Ethernet
set [ find default-name=ether5 ] name=LAN4-Ethernet
set [ find default-name=ether6 ] name=LAN5-Ethernet
set [ find default-name=ether7 ] name=LAN6-Ethernet
set [ find default-name=ether8 ] name=LAN7-Ethernet
set [ find default-name=ether9 ] name=LAN8-Ethernet
set [ find default-name=ether10 ] name=LAN9-Ethernet
set [ find default-name=ether1 ] mac-address=14:DD:A9:F2:E5:A4 name=WAN
set [ find default-name=sfp1 ] disabled=yes
/interface wireless
set [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \
antenna-gain=0 band=2ghz-onlyn channel-width=20/40mhz-XX country=russia \
disabled=no disconnect-timeout=15s distance=indoors frequency=auto \
hw-protection-mode=rts-cts hw-retries=10 mode=ap-bridge name=\
LAN-wifi24ghz on-fail-retry-time=1s radio-name=POINT24_1 ssid=point2 \
wireless-protocol=802.11 wmm-support=enabled
/interface wireless nstreme
set LAN-wifi24ghz enable-polling=no
/interface list
add name=Internet
add name=Local
add name=VPN
add name=VPN_L2TP_Users
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" \
group-key-update=1h mode=dynamic-keys supplicant-identity=MikroTik \
wpa-pre-shared-key=******** wpa2-pre-shared-key=*******
/ip pool
add name=dhcp ranges=192.168.88.5-192.168.88.255
add comment="\"Real_DefConf\"" name=VPN_Users ranges=10.255.255.0/24
/ip dhcp-server
add add-arp=yes address-pool=dhcp bootp-lease-time=lease-time bootp-support=\
dynamic disabled=no interface=LAN-Bridge lease-time=12h name=DHCP-Server
/ppp profile
set *0 interface-list=VPN
add address-list=VPN_L2TP_Users change-tcp-mss=yes interface-list=\
VPN_L2TP_Users local-address=10.255.255.1 name=L2TP_Profiles only-one=yes \
remote-address=VPN_Users use-compression=no use-encryption=no
/user group
set full policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,winbox,pas\
sword,web,sniff,sensitive,api,romon,dude,tikapp"
/interface bridge port
add bridge=LAN-Bridge interface=LAN1-Ethernet
add bridge=LAN-Bridge interface=LAN2-Ethernet
add bridge=LAN-Bridge interface=LAN3-Ethernet
add bridge=LAN-Bridge interface=LAN4-Ethernet
add bridge=LAN-Bridge interface=LAN5-Ethernet
add bridge=LAN-Bridge interface=LAN6-Ethernet
add bridge=LAN-Bridge interface=LAN7-Ethernet
add bridge=LAN-Bridge interface=LAN8-Ethernet
add bridge=LAN-Bridge interface=LAN9-Ethernet
add bridge=LAN-Bridge interface=LAN-wifi24ghz
/ip neighbor discovery-settings
set discover-interface-list=Local
/interface l2tp-server server
set authentication=mschap2 caller-id-type=number default-profile=\
L2TP_Profiles enabled=yes ipsec-secret=******** use-ipsec=required
/interface list member
add interface=WAN list=Internet
add interface=LAN-Bridge list=Local
add disabled=yes interface=LAN-Bridge list=VPN
add interface=LAN-Bridge list=VPN_L2TP_Users
/ip address
add address=192.168.88.1/24 interface=LAN1-Ethernet network=192.168.88.0
/ip dhcp-client
add disabled=no interface=WAN
/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.88.1 gateway=192.168.88.1 \
netmask=24
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add list="Access IP"
add list="Access IP Gate 1"
add list=ddos-blacklist
add list=SIP
add list="Access IP Gate 2"
add address=192.168.88.0/24 comment="White list for Trap for TCP traffic" \
list=NotTrapsIP
add comment="Trap for TCP traffic" list=TrapAddress
add list=VPN_L2TP_Users
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
established,related protocol=tcp
add action=fasttrack-connection chain=forward connection-state=\
established,related protocol=udp
add action=accept chain=forward comment=\
"ALLOW - Established, Related and Untracked connections" \
connection-state=established,related
add action=accept chain=input connection-state=established,related \
in-interface-list=Internet
add action=accept chain=input comment="ALLOW - All after ICMP knocking" \
in-interface-list=Internet src-address-list="Access IP"
add action=accept chain=forward in-interface-list=Internet src-address-list=\
"Access IP"
add action=accept chain=input comment="\"Allow port\r\
\nfor L2TP server\"" dst-port=1701,500,4500 protocol=udp
add action=accept chain=input comment=\
"\"Allow esp protocol for\r\
\nL2TP/Ipsec server\"" protocol=ipsec-esp
add action=drop chain=forward comment="DROP - Invalid connections" \
connection-state=invalid
add action=jump chain=forward comment="DDoS - SYN flood protection" \
connection-state=new in-interface-list=Internet jump-target=SYN-Protect \
protocol=tcp tcp-flags=syn
add action=jump chain=input connection-state=new in-interface-list=Internet \
jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect limit=200,5:packet tcp-flags=""
add action=add-src-to-address-list address-list=ddos-blacklist \
address-list-timeout=1d chain=SYN-Protect log=yes log-prefix=\
"DDoS: SYN-Protect" tcp-flags=""
add action=jump chain=forward comment="DDoS - Main protection" \
connection-state=new in-interface-list=Internet jump-target=DDoS-Protect
add action=jump chain=input connection-state=new in-interface-list=Internet \
jump-target=DDoS-Protect
add action=return chain=DDoS-Protect dst-limit=15,15,src-address/10s
add action=add-src-to-address-list address-list=ddos-blacklist \
address-list-timeout=1d chain=DDoS-Protect log=yes log-prefix=\
"DDoS: MAIN-Protect"
add action=jump chain=input comment=\
"Port Knocking - Permission to access the router" in-interface-list=\
Internet jump-target=port-knocking log-prefix=PING protocol=icmp
add action=add-src-to-address-list address-list="Access IP Gate 1" \
address-list-timeout=30s chain=port-knocking in-interface-list=Internet \
log-prefix="Access IP Gate 1" packet-size=342 protocol=icmp
add action=add-src-to-address-list address-list="Access IP Gate 2" \
address-list-timeout=30s chain=port-knocking in-interface-list=Internet \
log-prefix="Access IP Gate 2" packet-size=372 protocol=icmp \
src-address-list="Access IP Gate 1"
add action=add-src-to-address-list address-list="Access IP" \
address-list-timeout=12h chain=port-knocking in-interface-list=Internet \
log-prefix="Access IP" packet-size=571 protocol=icmp src-address-list=\
"Access IP Gate 2"
add action=add-src-to-address-list address-list="Access IP" \
address-list-timeout=12h chain=port-knocking in-interface-list=Internet \
log-prefix="Access IP" packet-size=530 protocol=icmp src-address-list=\
"Access IP Gate 2"
add action=return chain=port-knocking
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d3s chain=input comment="Trap for TCP traffic" \
connection-nat-state=!dstnat dst-port=\
5060,5061,4569,3389,8291,22,23,389,445,53 in-interface-list=Internet \
protocol=tcp src-address-list=!NotTrapsIP
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=3d3s chain=input comment="Trap for UDP traffic" \
connection-nat-state=!dstnat dst-port=5060,4569,389,53,161 \
in-interface-list=Internet protocol=udp src-address-list=!NotTrapsIP
add action=add-src-to-address-list address-list=TrapAddress \
address-list-timeout=1w7s chain=input comment="Trap for port scanning" \
in-interface-list=Internet protocol=tcp psd=10,10s,3,1 src-address-list=\
!NotTrapsIP
add action=drop chain=input comment=\
"DROP - Block all other input/forward connections on the WAN" \
in-interface-list=Internet
add action=drop chain=forward in-interface-list=Internet
/ip firewall nat
add action=masquerade chain=srcnat comment="MASQ - Internet out masquerade" \
out-interface-list=Internet src-address=192.168.88.0/24
add action=dst-nat chain=dstnat comment=\
"NTP - Sending all requests to the 88.1" dst-port=123 in-interface-list=\
Local protocol=udp to-addresses=192.168.88.1 to-ports=123
/ip firewall raw
add action=drop chain=prerouting comment="DDoS - Drop blacklist IP" \
in-interface-list=Internet src-address-list=ddos-blacklist
add action=accept chain=prerouting comment="ALLOW - Resolved SIP provider" \
in-interface-list=Internet protocol=udp src-address-list=SIP
add action=drop chain=prerouting comment="DROP - Not allow SIP" dst-port=\
5060,5061 in-interface-list=Internet protocol=udp
add action=drop chain=prerouting dst-port=5060,5061 in-interface-list=\
Internet protocol=tcp
add action=drop chain=prerouting comment="Drop Address from Trap" \
src-address-list=TrapAddress
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set udplite disabled=yes
set dccp disabled=yes
/lcd interface pages
set 0 interfaces=LAN-wifi24ghz
/ppp secret
add name=user1 password=******** profile=L2TP_Profiles service=l2tp
/system clock
set time-zone-name=Europe/Moscow
/tool mac-server
set allowed-interface-list=Local
/tool mac-server mac-winbox
set allowed-interface-list=Local
