не ну так-то да, я не все договариваю
вообще 3 здания в городе завязаные в сеть, правда сеть построена так, что ............. повбывав-бы (С)
извините за эмоции
сейчас добавил DHCP Relay и включил правила с invalid пакетами - вроде нормально работает
Вот полный конфиг устройства (таких 3 штуки, правила везде одинаковые)
по безопасности не понимаю малость, но вроде как не сильно "китайцы" беспокоят
в сетях разбираться начал совсем недавно именно на этой работе, все приходит "методом тыка" и чтением интернетов
Ну и здесь конечно очень приятно помогают
Код: Выделить всё
# oct/30/2018 14:58:59 by RouterOS 6.42.9
# software id = SI9I-V2VB
#
# model = 2011UiAS
# serial number = 608805D9ED39
/interface ethernet
set [ find default-name=ether1 ] name=Eth1-ISP-Rostelekom
set [ find default-name=ether2 ] name=Eth2-LAN_Local
set [ find default-name=ether3 ] name=Eth3-VipNet
set [ find default-name=ether5 ] name=Eth5-LAN_Wan
/interface ethernet switch port
set 6 vlan-mode=fallback
set 7 vlan-mode=fallback
set 8 vlan-mode=fallback
set 9 vlan-mode=fallback
set 10 vlan-mode=fallback
set 12 vlan-mode=fallback
/interface list
add exclude=dynamic name=discover
add name=mac-winbox
add name=mactel
add name=LAN
add name=WAN
/ip firewall layer7-protocol
add comment="Block Bit Torrent" name=layer7-bittorrent-exp regexp="^(\\x13bitt\
orrent protocol|azver\\x01\$|get /scrape\\\?info_hash=get /announce\\\?inf\
o_hash=|get /client/bitcomet/|GET /data\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[\
RP]"
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 0 memory-lines=10000
set 1 disk-lines-per-file=10000
/ip neighbor discovery-settings
set discover-interface-list=discover
/interface detect-internet
set detect-interface-list=all internet-interface-list=discover \
lan-interface-list=discover wan-interface-list=discover
/interface list member
add interface=sfp1 list=discover
add interface=Eth3-VipNet list=LAN
add interface=ether4 list=discover
add interface=ether6 list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface=Eth2-LAN_Local list=LAN
add interface=Eth5-LAN_Wan list=LAN
add interface=Eth1-ISP-Rostelekom list=WAN
/ip address
add address=62.105.28.222/30 interface=Eth1-ISP-Rostelekom network=\
62.105.28.220
add address=172.16.0.2/29 interface=Eth5-LAN_Wan network=172.16.0.0
add address=192.168.95.1/24 interface=Eth2-LAN_Local network=192.168.95.0
add address=192.168.195.1/24 interface=Eth2-LAN_Local network=192.168.195.0
/ip cloud
set update-time=no
/ip dhcp-relay
add dhcp-server=192.168.195.10 disabled=no interface=Eth2-LAN_Local name=\
relay_95_195
/ip dns
set allow-remote-requests=yes servers=192.168.195.10,192.168.98.10
/ip firewall address-list
add address=192.168.95.95 list=allow-bit
/ip firewall filter
add action=jump chain=input comment="jump: port-knocking" dst-address=\
62.105.28.222 jump-target=portKnocking protocol=icmp
add action=accept chain=input comment=\
"defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
in-interface=Eth1-ISP-Rostelekom
add action=add-src-to-address-list address-list=Torrent-Conn \
address-list-timeout=2m chain=forward comment="Torrent's" \
layer7-protocol=layer7-bittorrent-exp out-interface=Eth1-ISP-Rostelekom \
src-address-list=!allow-bit
add action=drop chain=forward dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=tcp \
src-address-list=Torrent-Conn
add action=drop chain=forward dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=udp \
src-address-list=Torrent-Conn
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related
add action=accept chain=forward comment=\
"defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=Eth1-ISP-Rostelekom
add action=add-src-to-address-list address-list=checkLevelOne \
address-list-timeout=5s chain=portKnocking comment=CheckLevelOne \
packet-size=173 protocol=icmp
add action=add-src-to-address-list address-list=checkLevelTwo \
address-list-timeout=5s chain=portKnocking comment=CheckLevelTwo \
packet-size=262 protocol=icmp src-address-list=checkLevelOne
add action=add-src-to-address-list address-list=AllowRDP \
address-list-timeout=30m chain=portKnocking comment=AllowRDP packet-size=\
339 protocol=icmp src-address-list=checkLevelTwo
add action=return chain=portKnocking
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade out ISP-Ugratel" \
ipsec-policy=out,none out-interface=Eth1-ISP-Rostelekom
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add distance=1 gateway=62.105.28.221
add distance=1 dst-address=10.0.0.0/8 gateway=172.16.0.1
add distance=1 dst-address=12.0.0.0/8 gateway=172.16.0.1
add distance=1 dst-address=172.19.1.0/30 gateway=172.16.0.1
add distance=1 dst-address=192.168.38.0/24 gateway=172.16.0.1
add distance=1 dst-address=192.168.56.0/24 gateway=172.16.0.3
add distance=1 dst-address=192.168.90.0/24 gateway=172.16.0.1
add distance=1 dst-address=192.168.98.0/24 gateway=172.16.0.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip smb
set allow-guests=no
/lcd
set time-interval=hour
/system clock
set time-zone-autodetect=no time-zone-name=Asia/Yekaterinburg
/system identity
set name=dp_surgut_gp1
/system ntp client
set enabled=yes primary-ntp=109.195.19.73 secondary-ntp=88.147.254.230
/system ntp server
set enabled=yes
/system routerboard settings
set auto-upgrade=yes silent-boot=no
/tool bandwidth-server
set authenticate=no enabled=no
/tool graphing interface
add
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
