есть два vlan есть AD

[kirillwolf]

вопрос. есть два vlan есть AD. Нужно сделать так чтобы с обеих vlan был доступ к AD и настроить детский DNS например яндекс , а вот на другом был полный доступ. Как это сделать ? Я капал в сторону NAT. Кстати vlan в разных подсетях и доступ к ад был у всех т.е чтобы можно было тачку в ад загнать. пробовал настроить DNS через DHCP не работает V.mikrotik 6.42.10

[Chupaka]

Вообще непонятно. А почему доступа нет? ping к серверу проходит? Архитектура сети где? DNS (детский) через DHCP должен отлично настраиваться - приводите конфиг и что в результате получает клиент вместо нужного ДНС

[kirillwolf]

pingi к серверу проходят. доступа к AD нет. в DHCP прописал DNS яндекса. все рубит. а машину в домен загнать не могу.

Код: Выделить всё

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 6.49.10 (c) 1999-2023       http://www.mikrotik.com/

[?]             Gives the list of available commands
command [?]     Gives help on the command and list of arguments

[Tab]           Completes the command/word. If the input is ambiguous,
                a second [Tab] gives possible options

/               Move up to base level
..              Move up one level
/command        Use command at the base level
[kirillwolf@MT-Core] > /export compact
# sep/13/2023 06:01:19 by RouterOS 6.49.10
# software id = 3PRW-6KKM
#
# model = RB3011UiAS
# serial number = E14B0E5676EE
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2412,2437,2462 name=2G
add band=5ghz-a/n/ac control-channel-width=20mhz extension-channel=Ce frequency=5280 name=5G
/caps-man datapath
add client-to-client-forwarding=no local-forwarding=yes name=Datapath vlan-id=20 vlan-mode=use-tag
/interface ethernet
set [ find default-name=ether1 ] comment=WAN name=ether1-internet
set [ find default-name=ether2 ] comment=server-AD name=ether2-servers
set [ find default-name=ether7 ] comment=to-CSR326
/interface vlan
add interface=ether7 name=VLAN-10-Prod vlan-id=10
add arp=reply-only interface=ether7 name=VLAN-20-Guest vlan-id=20
add interface=ether7 name="VLAN-30-no porno" vlan-id=30
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm group-key-update=20m name=Security passphrase=\
    kirillwolf982
/caps-man configuration
add channel=2G country=russia4 datapath=Datapath installation=any mode=ap name=2G rx-chains=0,1,2,3 security=Security ssid=\
    Lirica-n_2.4 tx-chains=0,1,2,3
add channel=5G country=russia4 datapath=Datapath installation=any mode=ap name=5G rx-chains=0,1,2,3 security=Security ssid=\
    Lirica-n_5.0 tx-chains=0,1,2,3
/interface list
add name=LAN
add name=ISP
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.4.10-192.168.4.254
add name=dhcp_pool1 ranges=192.168.3.10-192.168.3.254
add name=dhcp_pool2 ranges=192.168.5.2-192.168.5.254
add name=L2TP ranges=192.168.6.10-192.168.6.254
/ip dhcp-server
add add-arp=yes address-pool=dhcp_pool0 disabled=no interface=VLAN-20-Guest lease-time=1d name=Guest-DHCP
add address-pool=dhcp_pool1 interface=VLAN-10-Prod lease-time=1d name=Prod-DHCP
add address-pool=dhcp_pool2 disabled=no interface="VLAN-30-no porno" lease-time=1d name=noPorno-DHCP
/ppp profile
add change-tcp-mss=no dns-server=192.168.6.1 local-address=192.168.6.1 name=profile1 only-one=no remote-address=L2TP \
    use-compression=yes use-encryption=yes use-mpls=no use-upnp=no
/queue type
add kind=pcq name=queue1_down pcq-classifier=dst-address pcq-rate=10M
add kind=pcq name=queue_upl pcq-classifier=src-address pcq-rate=10M
/queue simple
add max-limit=20M/20M name=queue1 queue=queue_upl/queue1_down target=VLAN-20-Guest
/snmp community
set [ find default=yes ] addresses=192.168.1.6/32
/system logging action
add email-start-tls=yes [email protected] name=email target=email
/caps-man access-list
add action=accept allow-signal-out-of-range=10s disabled=no signal-range=-75..-30
add action=reject allow-signal-out-of-range=10s disabled=no signal-range=-120..120
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=ac master-configuration=5G name-format=prefix-identity name-prefix=5G
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=2G name-format=prefix-identity name-prefix=2G
/ip firewall connection tracking
set tcp-established-timeout=2h
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface l2tp-server server
set authentication=mschap2 default-profile=profile1 enabled=yes ipsec-secret=Kirill982 use-ipsec=required
/interface list member
add interface=ether2-servers list=LAN
add interface=VLAN-10-Prod list=LAN
add interface=ether1-internet list=LAN
add interface="VLAN-30-no porno" list=LAN
add interface=ether1-internet list=ISP
/ip address
add address=192.168.3.1/24 interface=VLAN-10-Prod network=192.168.3.0
add address=192.168.4.1/24 interface=VLAN-20-Guest network=192.168.4.0
add address=192.168.5.1/24 interface="VLAN-30-no porno" network=192.168.5.0
add address=109.95.217.120 interface=ether1-internet network=109.95.217.97
add address=192.168.1.3/24 interface=ether2-servers network=192.168.1.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add disabled=no interface="VLAN-30-no porno"
/ip dhcp-relay
add dhcp-server=192.168.1.2 disabled=no interface=VLAN-10-Prod local-address=192.168.3.1 name=VLAN10
/ip dhcp-server network
add address=192.168.3.0/24 dns-server=192.168.1.2 domain=lirica-n.local gateway=192.168.3.1 wins-server=192.168.1.2
add address=192.168.4.0/24 dns-server=8.8.8.8 gateway=192.168.4.1
add address=192.168.5.0/24 dns-server=77.88.8.7,77.88.8.3 domain=lirica-n.local gateway=192.168.5.1 wins-server=192.168.1.2
/ip dns
set allow-remote-requests=yes cache-max-ttl=5h
/ip firewall address-list
add address=192.168.1.0/24 disabled=yes list=LAN
add address=192.168.3.0/24 list=LAN
add address=192.168.5.0/24 list=LAN
add address=46.28.91.101 comment=IP_Job list=WL
/ip firewall filter
add action=drop chain=input comment="Block l2tp brute forcer" connection-state="" dst-port=1701,500,4500,63668 log=yes \
    log-prefix="--==DROP L2TP brute forcer==--" protocol=udp src-address-list=l2tp_stage1 tcp-flags=""
add action=accept chain=input connection-state="" dst-port=500,1701,4500,63668 protocol=udp src-address-list=WL src-port="" \
    tcp-flags=""
add action=add-src-to-address-list address-list=l2tp_stage1 address-list-timeout=1d chain=input connection-state="" dst-port=\
    500,1701,4500,63668 protocol=udp src-port="" tcp-flags=""
add action=add-src-to-address-list address-list=PSD address-list-timeout=1d chain=input comment=No_skan_port psd=21,3s,3,1
add action=accept chain=input comment=L2TP dst-port=500,1701,4500 protocol=udp
add action=accept chain=input comment=WEB connection-nat-state="" connection-state=related,new dst-address=109.95.217.120 \
    dst-port=80,8080 protocol=tcp
add action=accept chain=input comment=in-DHCP-Relay-Allow dst-port=67,68 protocol=udp
add action=accept chain=input comment=Zabbix_ping protocol=icmp
add action=accept chain=input dst-port=161 protocol=udp
add action=accept chain=input comment=in_CAPSMAN-Allow dst-port=5246,5247 protocol=udp
add action=accept chain=input comment=in_SSH&Winbox-Allow connection-state=new dst-port=2204,56465 protocol=tcp
add action=accept chain=input comment=in_E&R-Allow connection-state=established,related
add action=accept chain=forward dst-port=53 protocol=udp src-address=192.168.5.0/24
add action=drop chain=input comment=in_ALL-DROP
add action=drop chain=forward comment=frw_DROP-from-Guest connection-state=new dst-address-list=LAN src-address=\
    192.168.4.0/24
add action=drop chain=forward connection-state=new dst-address-list=LAN src-address=192.168.5.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1-internet src-address=192.168.6.0/24
add action=masquerade chain=srcnat comment=msq_internet-for-guest out-interface=ether1-internet src-address=192.168.4.0/24
add action=masquerade chain=srcnat comment=msq_internet-for-VLAN10 out-interface=ether1-internet src-address=192.168.1.0/24
add action=masquerade chain=srcnat comment=msq_internet-for-prod out-interface=ether1-internet src-address=192.168.3.0/24
add action=masquerade chain=srcnat comment=no-porno out-interface=ether1-internet src-address=192.168.5.0/24
add action=dst-nat chain=dstnat comment=OWA dst-port=443 in-interface=ether1-internet protocol=tcp to-addresses=192.168.1.5 \
    to-ports=443
add action=dst-nat chain=dstnat dst-port=25 in-interface=ether1-internet protocol=tcp to-addresses=192.168.1.5 to-ports=25
add action=dst-nat chain=dstnat comment=WEB dst-port=80,8080 in-interface=ether1-internet protocol=tcp to-addresses=\
    192.168.1.4 to-ports=80
add action=src-nat chain=srcnat dst-port=53 protocol=udp src-address=192.168.5.0/24 to-addresses=192.168.1.2 to-ports=53
/ip firewall raw
add action=drop chain=prerouting comment=No_skan_port src-address-list=PSD
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add distance=1 gateway=109.95.217.97
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=2204
set api disabled=yes
set winbox port=56465
set api-ssl disabled=yes
/lcd
set default-screen=interfaces time-interval=daily
/ppp aaa
set use-radius=yes
/radius
add address=192.168.1.2 secret=Kirill982 service=ppp,ipsec src-address=192.168.3.1
/snmp
set enabled=yes trap-generators="" trap-version=2
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=MT-Core
/system logging
add action=email topics=error,critical
/system ntp client
set enabled=yes primary-ntp=193.67.79.202
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool romon
set enabled=yes secrets=123456789
[kirillwolf@MT-Core] >

[Chupaka]

pingi к серверу проходят. доступа к AD нет.

Тут я бы проверил настройки брандмауэра. Выглядит так, что сервер разрешает доступ к AD только из своей подсети, а из других подсетей - блокирует.

[kirillwolf]

брандмауэр в AD отключен

[Chupaka]

Так, в /ip firewall filter в цепочке forward у вас три правила: разрешить DNS (53/UDP) из VLAN-30 и запретить исходящие из VLAN-20 и VLAN-30 в локалку. Вы уверены, что подключение от компа к AD не попадает под запрет?