srv запись [решено]

[Chupaka]

Тогда вам и DNS (53/udp) надо разрешить из VPN, по аналогии с пятым правилом.

[nevolex]

сейчас попробую

[nevolex]

Тогда вам и DNS (53/udp) надо разрешить из VPN, по аналогии с пятым правилом.

Сработало, спасибо еще раз!

Код: Выделить всё

 1    ;;; defconf: accept established,related,untracked
      chain=input action=accept connection-state=established,related,untracked log=no log-prefix="" 

 2    ;;; accept connection to IKEv2 ports
      chain=input action=accept protocol=udp in-interface-list=WAN dst-port=500,4500 log=no log-prefix="" 

 3    ;;; defconf: drop invalid
      chain=input action=drop connection-state=invalid log=no log-prefix="" 

 4    ;;; defconf: accept ICMP
      chain=input action=accept protocol=icmp log=no log-prefix="" 

 5    ;;; management over VPN
      chain=input action=accept protocol=tcp dst-port=22,80,88,8291 log=no log-prefix="" ipsec-policy=in,ipsec 

 6    ;;; DNS over VPN
      chain=input action=accept protocol=udp dst-port=53 log=no log-prefix="" ipsec-policy=in,ipsec 

 7    ;;; allow emby in guest network
      chain=input action=accept protocol=tcp src-address=10.20.0.0/24 dst-address=10.10.0.5 dst-port=8096 log=no log-prefix="" 

 8    ;;; allow proxy redirect in guest network
      chain=input action=accept protocol=tcp src-address=10.20.0.0/24 dst-address=10.10.0.1 dst-port=80 log=no log-prefix="" 

 9    ;;; defconf: drop all not coming from LAN
      chain=input action=drop in-interface-list=!LAN log=no log-prefix="" 

10    ;;; drop all coming from main to guest
      chain=input action=drop src-address=10.10.0.0/24 dst-address=10.20.0.0/24 log=no log-prefix="" 

11    ;;; drop all coming from guest to main
      chain=input action=drop src-address=10.20.0.0/24 dst-address=10.10.0.0/24 log=no log-prefix="" 

12    ;;; defconf: accept in ipsec policy
      chain=forward action=accept in-interface-list=WAN log=no log-prefix="" ipsec-policy=in,ipsec 

13    ;;; defconf: accept out ipsec policy
      chain=forward action=accept log=no log-prefix="" ipsec-policy=out,ipsec 

14    ;;; mark guest network for queueing
      chain=forward action=accept connection-state=established,related src-address=10.20.0.0/24 log=no log-prefix="" 

15    ;;; mark guest network for queueing
      chain=forward action=accept connection-state=established,related dst-address=10.20.0.0/24 log=no log-prefix="" 

16    ;;; defconf: fasttrack
      chain=forward action=fasttrack-connection connection-state=established,related log=no log-prefix="" 

17    ;;; defconf: accept established,related, untracked
      chain=forward action=accept connection-state=established,related,untracked log=no log-prefix="" 

18    ;;; defconf: drop invalid
      chain=forward action=drop connection-state=invalid log=no log-prefix="" 

19    ;;; defconf:  drop all from WAN not DSTNATed
      chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN log=no log-prefix="" 
[admin@MikroTik_RB4011] /ip firewall filter>