dexusden11 Posted October 21, 2024 Posted October 21, 2024 Есть почтовый шлюз (192.168.10.70) он принимает и отправляет почту. После замены роутера d-link dfl-860e на микротик 5009 почта перестала уходить в мир. Висит в очереди (либо тайм-аут или сеть не доступна) шлюз выходит по правилу - src-nat chain=srcnat log=yes out-interface=ether1 src-address=\ 192.168.10.70 to-addresses=82.138.55.138 Для теста запустил другой микротик(rb201) с единственным правилом nat - src-nat chain=srcnat log=yes out-interface=ether1 src-address=\ 192.168.10.70 to-addresses=82.138.55.138 Почта стала уходить. Что не так с настройкой первого микротика( конфиг прилагается) # 2024-10-21 14:07:46 by RouterOS 7.14.3 # software id = 2GFI-CHUU # # model = RB5009UG+S+ # serial number = HFA09AHAZZC /interface vlan add interface=ether3 name="vlan50 telephone" vlan-id=50 add interface=ether3 name="vlan60 video" vlan-id=60 add interface=ether5 name="vlan100 Steklograd" vlan-id=100 add interface=ether7 name="vlan172 vinty" vlan-id=172 add interface=ether6 name=vlan200 vlan-id=200 add interface=ether6 name="vlan201 tishenko" vlan-id=201 add interface=ether6 name="vlan202 salix" vlan-id=202 add interface=ether6 name="vlan205 polik" vlan-id=205 add interface=ether7 name="vlan206 solex" vlan-id=206 add interface=ether7 name="vlan207 auto" vlan-id=207 add interface=ether6 name="vlan208 koemz" vlan-id=208 add interface=ether6 name="vlan209 pavel" vlan-id=209 add interface=ether6 name="vlan210 avtotehnix" vlan-id=210 add interface=ether6 name="vlan211 prosanteh1" vlan-id=211 add interface=ether6 name="vlan212 prosanteh2" vlan-id=212 add interface=ether7 name="vlan213 stg wifi" vlan-id=213 add interface=ether6 name="vlan214 plitka" vlan-id=214 add interface=ether6 name="vlan215 a-service" vlan-id=215 add interface=ether7 name="vlan216 Danilov" vlan-id=216 add interface=ether7 name="vlan217 Shilov" vlan-id=217 add interface=ether7 name="vlan218 Sandra" vlan-id=218 add interface=ether7 name="vlan219 Lebedev server" vlan-id=219 add interface=ether7 name="vlan220 PalletMos" vlan-id=220 /interface list add name=WAN add name=LAN /ip dhcp-server add interface="vlan201 tishenko" name=server201 add interface="vlan202 salix" name=server202 add interface="vlan205 polik" name=server205 add interface="vlan206 solex" name=server206 add interface="vlan207 auto" name=server207 add interface="vlan208 koemz" name=server208 add interface="vlan209 pavel" name=server209 add interface="vlan210 avtotehnix" name=server210 add interface="vlan211 prosanteh1" name=server211 add interface="vlan212 prosanteh2" name=server212 add interface="vlan213 stg wifi" name=server213 add interface="vlan214 plitka" name=server214 add interface="vlan215 a-service" name=server215 add interface="vlan50 telephone" name=server50 add interface="vlan216 Danilov" name=server216 add interface="vlan217 Shilov" name=server217 add interface="vlan220 PalletMos" name=server220 /queue simple add max-limit=90M/30M name=queueinfolink target=ether2 add max-limit=90M/50M name=queue95 queue=\ pcq-download-default/pcq-upload-default target=ether1 /interface list member add interface=ether1 list=WAN add interface=ether3 list=LAN add interface=ether4 list=LAN add interface=ether5 list=LAN add interface=ether6 list=LAN add interface=ether7 list=LAN add interface=ether8 list=LAN add interface=sfp-sfpplus1 list=LAN add interface=ether2 list=WAN /ip address add address=192.168.10.254/24 interface="vlan100 Steklograd" network=\ 192.168.10.0 add address=93.95.161.241/17 interface=ether2 network=93.95.128.0 add address=93.95.161.242/17 interface=ether2 network=93.95.128.0 add address=192.168.20.254 interface=vlan200 network=192.168.20.200 add address=192.168.20.254 interface="vlan201 tishenko" network=\ 192.168.20.201 add address=192.168.20.254 interface="vlan202 salix" network=192.168.20.202 add address=192.168.50.30/27 interface="vlan50 telephone" network=\ 192.168.50.0 add address=192.168.60.62/26 interface="vlan60 video" network=192.168.60.0 add address=192.168.20.254 interface="vlan205 polik" network=192.168.20.205 add address=192.168.20.254 interface="vlan206 solex" network=192.168.20.206 add address=192.168.20.254 interface="vlan207 auto" network=192.168.20.207 add address=192.168.20.254 interface="vlan208 koemz" network=192.168.20.208 add address=192.168.20.254 interface="vlan209 pavel" network=192.168.20.209 add address=192.168.20.254 interface="vlan210 avtotehnix" network=\ 192.168.20.210 add address=192.168.20.254 interface="vlan211 prosanteh1" network=\ 192.168.20.211 add address=192.168.20.254 interface="vlan212 prosanteh2" network=\ 192.168.20.212 add address=192.168.20.254 interface="vlan213 stg wifi" network=\ 192.168.20.213 add address=172.16.1.254/24 interface="vlan172 vinty" network=172.16.1.0 add address=82.138.55.140/29 interface=ether1 network=82.138.55.136 add address=192.168.20.254/24 interface="vlan214 plitka" network=192.168.20.0 add address=192.168.20.254 interface="vlan215 a-service" network=\ 192.168.20.215 add address=192.168.20.254 interface="vlan216 Danilov" network=192.168.20.216 add address=192.168.20.254 interface="vlan217 Shilov" network=192.168.20.217 add address=192.168.20.254 interface="vlan219 Lebedev server" network=\ 192.168.20.219 add address=82.138.55.138/29 interface=ether1 network=82.138.55.136 add address=192.168.20.254 interface="vlan218 Sandra" network=192.168.20.100 add address=192.168.30.254/24 interface="vlan220 PalletMos" network=\ 192.168.30.0 add address=82.138.55.139/29 interface=ether1 network=82.138.55.136 /ip dhcp-server lease add address=192.168.20.201 mac-address=00:23:54:08:F9:D5 add address=192.168.20.202 mac-address=50:FF:20:8C:24:F2 add address=192.168.20.205 mac-address=EC:AD:E0:1F:62:87 add address=192.168.20.206 mac-address=00:14:D1:91:F6:93 add address=192.168.20.207 mac-address=04:D4:C4:30:47:00 add address=192.168.20.208 mac-address=F8:1A:67:42:53:ED add address=192.168.20.209 mac-address=CC:32:E5:33:85:E1 add address=192.168.20.210 mac-address=50:FF:20:02:1A:17 add address=192.168.20.211 mac-address=D8:07:B6:76:51:99 add address=192.168.20.212 mac-address=5C:62:8B:F4:28:09 add address=192.168.20.1 mac-address=4C:ED:FB:16:F3:A4 add address=192.168.20.3 mac-address=78:E3:B5:88:99:1A add address=192.168.20.4 mac-address=9C:5C:8E:D3:1A:91 add address=192.168.20.2 mac-address=C8:D3:A3:4E:26:C6 add address=192.168.20.215 mac-address=D8:50:E6:AF:DC:90 add address=192.168.20.213 mac-address=E4:18:6B:0C:16:20 add address=192.168.50.1 mac-address=00:50:56:B1:C2:E9 add address=192.168.20.5 mac-address=98:28:A6:14:94:93 add address=192.168.20.216 mac-address=2C:F0:5D:E0:CB:FF add address=192.168.20.217 mac-address=F8:0F:41:64:F6:5D add address=192.168.30.1 mac-address=CE:16:F9:3B:A5:BA /ip dhcp-server network add dns-server=77.88.8.1,1.0.0.1 gateway=192.168.20.254 netmask=24 add address=192.168.30.0/24 dns-server=1.0.0.1 gateway=192.168.30.254 add address=192.168.50.1/32 dns-server=77.88.8.1 gateway=192.168.50.30 \ netmask=27 /ip dns set servers=77.88.8.1,1.0.0.1 /ip firewall address-list add address=192.168.10.1 list=Steklograd_allow add address=192.168.10.11 list=Servers-DC add address=192.168.10.9 list=Servers-DC add address=192.168.10.3 list=Server1c add address=192.168.10.5 list=Server-Exchange add address=192.168.10.20 comment=pc-Tergalustova list=Steklograd_allow add address=192.168.10.30 comment=Pushkina list=Steklograd_allow add address=192.168.10.40 comment=Efimtseva list=Steklograd_allow add address=192.168.10.74 comment=PC-Lebedev list=Steklograd_allow add address=192.168.10.77 comment=Moy list=Steklograd_allow add address=192.168.60.1 list=Registrator add address=192.168.60.2 list=Registrator add address=192.168.60.8 list=Registrator add address=192.168.60.56 list=Registrator add address=192.168.60.6 list=Registrator add address=192.168.20.1 list=plitka add address=192.168.20.2 list=plitka add address=192.168.20.3 list=plitka add address=192.168.20.4 list=plitka add address=192.168.20.5 list=plitka add address=192.168.20.235 list=plitka add address=8.8.8.8 list=netwatchDNS add address=8.8.4.4 list=netwatchDNS add address=77.88.8.8 list=netwatchDNS add address=159.54.247.168 list=netwatchDNS add address=146.75.74.62 list=netwatchDNS add address=192.168.10.22 comment=DEX list=Steklograd_allow add address=192.168.20.234 list=plitka add address=176.59.32.0/19 list=AllowToSTG add address=192.168.30.240 list=PalletMOS add address=192.168.30.1 list=PalletMOS add address=192.168.30.246 list=PalletMOS add address=176.59.160.0/19 list=AllowToSTG add address=92.252.240.121 list=BanIP add address=192.168.10.70 list=KMG /ip firewall filter add action=drop chain=input connection-nat-state=!dstnat connection-state=new \ disabled=yes in-interface-list=WAN src-address-list=BanIP add action=passthrough chain=forward disabled=yes add action=accept chain=forward comment=Established connection-state=\ established,related,untracked connection-type="" disabled=yes add action=fasttrack-connection chain=forward connection-state=\ established,related disabled=yes hw-offload=yes add action=accept chain=input comment=Established connection-state=\ established,related,untracked connection-type="" disabled=yes add action=accept chain=input connection-state=new disabled=yes dst-port=8291 \ protocol=tcp src-address-list=AllowToSTG add action=drop chain=forward comment=Invalid connection-state=invalid \ disabled=yes in-interface-list=WAN add action=accept chain=forward connection-state=\ established,related,untracked disabled=yes add action=drop chain=input comment=Invalid connection-state=invalid \ disabled=yes in-interface-list=WAN add action=add-src-to-address-list address-list=PSD address-list-timeout=\ none-dynamic chain=input comment=PSD disabled=yes protocol=tcp psd=\ 21,3s,3,1 add action=drop chain=input connection-state=!established disabled=yes \ in-interface-list=WAN add action=reject chain=forward comment="Block RDP bruteforce" disabled=yes \ log=yes log-prefix="Blocked - " reject-with=icmp-network-unreachable \ src-address=!172.16.1.22 src-address-list="Blocked bruteforcers" add action=add-src-to-address-list address-list="Blocked bruteforcers" \ address-list-timeout=5d chain=forward comment="Reg bruteforce stage4" \ connection-state=new disabled=yes dst-port=8000 in-interface-list=WAN \ log=yes log-prefix="REG BRUTEFORCE - " protocol=tcp src-address-list=\ reg_bruteforce3 add action=add-src-to-address-list address-list=reg_bruteforce3 \ address-list-timeout=15m chain=forward comment="Reg bruteforce stage3" \ connection-state=new disabled=yes dst-port=8000 in-interface-list=WAN \ log=yes log-prefix="REG BRUTEFORCE - STAGE3 - " protocol=tcp \ src-address-list=reg_bruteforce2 add action=add-src-to-address-list address-list=reg_bruteforce2 \ address-list-timeout=15m chain=forward comment="Reg bruteforce stage2" \ connection-state=new disabled=yes dst-port=8000 in-interface-list=WAN \ log=yes log-prefix="REG BRUTEFORCE - STAGE2 - " protocol=tcp \ src-address-list=reg_bruteforce1 add action=add-src-to-address-list address-list=reg_bruteforce1 \ address-list-timeout=15m chain=forward comment="Reg bruteforce stage1" \ connection-state=new disabled=yes dst-port=8000 in-interface-list=WAN \ log=yes log-prefix="REG BRUTEFORCE - STAGE1 -" protocol=tcp add action=jump chain=forward disabled=yes dst-port=3389 in-interface-list=\ WAN jump-target=rdp-bruteforce protocol=tcp add action=tarpit chain=rdp-bruteforce disabled=yes protocol=tcp \ src-address-list=rdp-brutforce-zlodei add action=return chain=rdp-bruteforce connection-state=established,related \ disabled=yes src-address-list=rdp-trusted-ips add action=return chain=rdp-bruteforce connection-state=new disabled=yes \ src-address-list=rdp-trusted-ips add action=add-src-to-address-list address-list=rdp-trusted-ips \ address-list-timeout=1d chain=rdp-bruteforce connection-bytes=80000-0 \ connection-state=established,related disabled=yes add action=return chain=rdp-bruteforce connection-state=new disabled=yes \ dst-limit=10/1h,5,src-address/1h add action=add-src-to-address-list address-list=rdp-brutforce-zlodei \ address-list-timeout=3d chain=rdp-bruteforce connection-state=new \ disabled=yes /ip firewall nat add action=src-nat chain=srcnat log=yes out-interface=ether1 src-address=\ 192.168.10.70 to-addresses=82.138.55.138 add action=dst-nat chain=dstnat dst-port=3365 protocol=tcp src-address-list=\ CountryIPBlocks to-addresses=192.168.30.246 to-ports=3389 add action=dst-nat chain=dstnat dst-port=3591 protocol=tcp src-address-list=\ CountryIPBlocks to-addresses=192.168.10.28 to-ports=3389 add action=dst-nat chain=dstnat dst-port=3362 protocol=tcp src-address-list=\ CountryIPBlocks to-addresses=192.168.10.74 to-ports=3389 add action=dst-nat chain=dstnat dst-port=443 protocol=tcp src-address-list=\ AllowToSTG to-addresses=192.168.10.5 to-ports=443 add action=dst-nat chain=dstnat dst-port=3363 protocol=tcp src-address-list=\ CountryIPBlocks to-addresses=192.168.20.219 to-ports=3389 add action=dst-nat chain=dstnat dst-port=25 protocol=tcp to-addresses=\ 192.168.10.70 to-ports=25 add action=dst-nat chain=dstnat dst-port=8883,8884,8885,8887,8000 protocol=\ tcp src-address-list=CountryIPBlocks to-addresses=192.168.20.100 add action=dst-nat chain=dstnat disabled=yes dst-port=4492 protocol=tcp \ to-addresses=192.168.10.56 to-ports=3389 add action=dst-nat chain=dstnat dst-address=82.138.55.139 dst-port=3365 \ protocol=tcp to-addresses=192.168.30.246 to-ports=3389 add action=src-nat chain=srcnat disabled=yes out-interface=ether1 \ src-address=192.168.10.22 src-address-list="" to-addresses=82.138.55.138 add action=src-nat chain=srcnat out-interface=ether1 src-address-list=\ Registrator to-addresses=82.138.55.138 add action=src-nat chain=srcnat out-interface=ether1 src-address-list=\ Steklograd_allow to-addresses=82.138.55.138 add action=src-nat chain=srcnat out-interface=ether1 src-address-list=\ Servers-DC to-addresses=82.138.55.138 add action=src-nat chain=srcnat out-interface=ether1 src-address=192.168.50.1 \ to-addresses=82.138.55.138 add action=src-nat chain=srcnat comment="Arenda out Akado" out-interface=\ ether1 src-address=192.168.20.201 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.202 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.205 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.206 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.207 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.208 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.209 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.210 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.211 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.212 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.213 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.215 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.216 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.217 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.219 to-addresses=82.138.55.138 add action=src-nat chain=srcnat disabled=yes out-interface=ether1 \ src-address=192.168.20.222 to-addresses=82.138.55.138 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 192.168.20.100 to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address=172.16.1.22 \ to-addresses=82.138.55.140 add action=src-nat chain=srcnat out-interface=ether1 src-address=\ 172.16.1.0/24 to-addresses=82.138.55.140 add action=src-nat chain=srcnat out-interface=ether1 src-address-list=plitka \ to-addresses=82.138.55.139 add action=src-nat chain=srcnat out-interface=ether1 src-address-list=\ PalletMOS to-addresses=82.138.55.139 add action=src-nat chain=srcnat comment="Steklograd out Reagent" \ out-interface=ether2 src-address-list=Steklograd_allow to-addresses=\ 93.95.161.241 add action=src-nat chain=srcnat comment="Steklograd out Reagent" \ out-interface=ether2 src-address-list=Servers-DC to-addresses=\ 93.95.161.241 add action=src-nat chain=srcnat comment="Arenda out Reagent" out-interface=\ ether2 src-address=192.168.20.202 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.201 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.205 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.206 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.207 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.208 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.209 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.210 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.211 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.212 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.213 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.215 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.216 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.217 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.218 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.219 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.220 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 192.168.20.100 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=192.168.50.1 \ to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address=\ 172.16.1.0/24 to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address-list=plitka \ to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address-list=\ PalletMOS to-addresses=93.95.161.242 add action=src-nat chain=srcnat out-interface=ether2 src-address-list=\ Registrator to-addresses=93.95.161.242 add action=dst-nat chain=dstnat disabled=yes dst-port=3363 protocol=tcp \ to-addresses=192.168.10.201 to-ports=3389 add action=dst-nat chain=dstnat disabled=yes dst-port=37961 protocol=tcp \ to-addresses=192.168.10.38 to-ports=37961 add action=src-nat chain=srcnat dst-port=3362 protocol=tcp src-address-list=\ CountryIPBlocks to-addresses=192.168.10.74 to-ports=3389 /ip firewall service-port set ftp disabled=yes set tftp disabled=yes set sip disabled=yes sip-timeout=5m set pptp disabled=yes /ip route add comment=MainGW disabled=no distance=1 dst-address=0.0.0.0/0 gateway=\ 82.138.55.137 pref-src="" routing-table=main scope=30 \ suppress-hw-offload=no target-scope=10 add comment=RsrvGW disabled=no distance=2 dst-address=0.0.0.0/0 gateway=\ 93.95.161.129 pref-src="" routing-table=main scope=30 \ suppress-hw-offload=no target-scope=10 add disabled=no distance=1 dst-address=8.8.8.8/32 gateway=82.138.55.137 \ pref-src="" routing-table=main scope=30 suppress-hw-offload=no \ target-scope=10 add disabled=no distance=1 dst-address=8.8.4.4/32 gateway=82.138.55.137 \ pref-src="" routing-table=main scope=30 suppress-hw-offload=no \ target-scope=10 add disabled=no distance=1 dst-address=77.88.8.8/32 gateway=82.138.55.137 \ pref-src="" routing-table=main scope=30 suppress-hw-offload=no \ target-scope=10 add blackhole disabled=no distance=254 dst-address=8.8.4.4/32 add blackhole disabled=no distance=254 dst-address=8.8.8.8/32 add blackhole disabled=no distance=254 dst-address=77.88.8.8/32 gateway="" \ pref-src="" routing-table=main scope=30 suppress-hw-offload=no \ target-scope=10 /ip service set telnet disabled=yes set ftp disabled=yes set www disabled=yes set ssh disabled=yes set api disabled=yes set api-ssl disabled=yes /system clock set time-zone-name=Europe/Moscow /system note set show-at-login=no /system ntp client set enabled=yes /system ntp server set enabled=yes /system ntp client servers add address=192.168.10.9 /tool e-mail set from=backup@steklograd.ru server=192.168.10.5 user=backup@steklograd.ru Вставить ник Quote
jffulcrum Posted October 22, 2024 Posted October 22, 2024 20 часов назад, dexusden11 сказал: /interface list add name=WAN add name=LAN Если это осталось от дефолтной конфигурации, то проблемы могут быть с этим. В дефолтной конфигурации есть скрытые правила FW, привязанные к этим листам. Как минимум, вам все созданные виртуальные интерфейсы/VLAN надо тоже в список LAN добавить. Цепочка Forward у вас в правилах FW пуста, а значит там тоже скрытые правила дефолтной конфигурации Вставить ник Quote
sirmax Posted October 22, 2024 Posted October 22, 2024 2 часа назад, jffulcrum сказал: скрытые правила дефолтной конфигурации Можно чуть подробнее - что за скрытые правила? Их нет в конфиге? Но при этом они работают? Вставить ник Quote
jffulcrum Posted October 22, 2024 Posted October 22, 2024 2 минуты назад, sirmax сказал: Их нет в конфиге? Но при этом они работают? Они в конфиге есть. Но скрыты. См. ключ /verbose у команды export. В дефолтной конфигурации таких правил много, вот почему важно сбрасывать конфиг при первом включении/переустановке через netinstall, иначе эти скрытые правила обязательно поднасрут. Вставить ник Quote
sirmax Posted October 22, 2024 Posted October 22, 2024 6 минут назад, jffulcrum сказал: Они в конфиге есть. Но скрыты. См. ключ /verbose у команды export. В дефолтной конфигурации таких правил много, вот почему важно сбрасывать конфиг при первом включении/переустановке через netinstall, иначе эти скрытые правила обязательно поднасрут. Я может туплю но пока не понял - это особеность экспорта? в print же все видно? А можно уточнить какие именно правила? Хочу воспроизвести на тестовой железке Вставить ник Quote
jffulcrum Posted October 22, 2024 Posted October 22, 2024 В принте по-умолчанию только изменения с дефолтных значений/правил. Нулевого роутера под рукой сейчас нет, но примерно описано в https://help.mikrotik.com/docs/spaces/ROS/pages/167706788/Default+configurations В частности, интерфейсы расписаны по спискам LAN и WAN, и FW правила по этим спискам, в винбоксе их может быть не видно, если Advanced режим не включить. Вставить ник Quote
dexusden11 Posted October 22, 2024 Author Posted October 22, 2024 Проблема оказалась в правиле - add action=dst-nat chain=dstnat dst-port=25 protocol=tcp to-addresses=\ 192.168.10.70 to-ports=25 Нужно было указать in-интерфейс - chain=dstnat action=dst-nat to-addresses=192.168.10.70 to-ports=25 protocol=tcp in-interface=ether1 dst-port=25 log=no log-prefix="" Вставить ник Quote
Saab95 Posted October 24, 2024 Posted October 24, 2024 Не нужно указывать in-interface, укажите лучше подсеть или адреса, с которыми работать. Это правильнее. Потом порт переключите и снова работать перестанет. Вставить ник Quote
jffulcrum Posted October 25, 2024 Posted October 25, 2024 Тупой совет. Во-первых, это публичный сервис, какие списки? Во-вторых, если понадобится hairpin-nat, будет совсем тяжело. В третьих, ACL по интерфейсам в принципе быстрее работает, чем по адресам. Вставить ник Quote
Saab95 Posted October 25, 2024 Posted October 25, 2024 16 часов назад, jffulcrum сказал: В третьих, ACL по интерфейсам в принципе быстрее работает, чем по адресам. Разницы никакой нет, если это программный файрвол - он все равно разберет весь пакет, перед обработкой. Вставить ник Quote
.png.5d2afa2996cc6a85d0f2c09b92dd0a28.png)
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.