Маршрутизация

[Lipser]

Добрый день!
Помогите разобраться. Настройки делал не я, с микротиками на "вы".
Топология звезда. Все офисы подключаются к центральному маршрутизатору как OVPN клиенты.
У каждого офиса внутри своя подсеть из диапазонов 10.0.y.хxx
Я нахожусь в сети 10.0.4.х
Устройство имеет адрес 10.0.7.88
Каждому OVPN интерфейсу на центральном роутере присваивается адрес, в данном случае 172.16.100.7
Работает ping 10.0.7.88, но не могу подключиться к устройству на порт 80.

tracert 10.0.7.88
1 1 ms <1 мс <1 мс 10.0.4.1
2 36 ms 103 ms 101 ms 172.16.100.7
3 39 ms 82 ms 32 ms 10.0.7.88

Подскажите, плз ГДЕ именно и КАК мне надо правильно прописать маршрут, чтобы была возможность подключаться к любым портам любых устройств в подсети 10.0.7.ххх

[podarok66]

Тема в таком виде кандидат на удаление, читаем правила вверху странички и приводим в требуемому виду (5 и 6 пункты)

[Lipser]

Да, читал пункты. Потому и спросил где именно. export выкладывать с какого маршуртизатора ? или все три: 10.0.4.1 + 10.0.7.1 + 10.0.1.1 ???

[podarok66]

Да все три и выкладывайте, под спойлеры их загоните и норм получится

[Lipser]

 "Центральный маршрутизатор 10.0.1.1"

# aug/09/2016 13:21:48 by RouterOS 6.31
# software id = KQZT-TASF
#
/interface bridge
add name=bridge_lan
add name=bridge_vpn
/interface ethernet
set [ find default-name=ether1 ] comment="[LAN]"
set [ find default-name=ether11 ] comment="[INET]"
set [ find default-name=ether12 ] comment="[RESERVE]" disabled=yes
/ip neighbor discovery
set ether1 comment="[LAN]"
set ether11 comment="[INET]" discover=no
set ether12 comment="[RESERVE]" discover=no
/ip pool
add name=pptp_users_pool ranges=10.0.0.10-10.0.0.150
add name=l2tp_users_pool ranges=10.0.0.151-10.0.0.254
/ppp profile
set *0 local-address=10.0.0.1 only-one=no remote-address=l2tp_users_pool \
use-compression=no use-encryption=no use-mpls=no
add bridge=bridge_vpn change-tcp-mss=yes name=ovpn_all only-one=no \
use-compression=no use-encryption=yes use-mpls=no
add bridge=bridge_vpn change-tcp-mss=yes idle-timeout=12h local-address=\
10.0.0.1 name=pptp_all only-one=no remote-address=pptp_users_pool \
session-timeout=12h use-compression=no use-encryption=yes use-mpls=no
/interface bridge port
add bridge=bridge_lan interface=ether1
add bridge=bridge_lan interface=ether2
add bridge=bridge_lan interface=ether3
add bridge=bridge_lan interface=ether4
add bridge=bridge_lan interface=ether5
add bridge=bridge_lan interface=ether6
add bridge=bridge_lan interface=ether7
add bridge=bridge_lan interface=ether8
add bridge=bridge_lan interface=ether9
add bridge=bridge_lan interface=ether10
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=pptp_all enabled=yes \
ipsec-secret="*************" keepalive-timeout=18000
/interface ovpn-server server
set auth=sha1 certificate=cert_ovpn cipher=aes256 default-profile=ovpn_all \
enabled=yes mode=ethernet port=3389
/interface pptp-server server
set authentication=mschap2 default-profile=pptp_all enabled=yes \
keepalive-timeout=18000
/interface sstp-server server
set authentication=mschap2 certificate=cert_sstp default-profile=pptp_all \
enabled=yes force-aes=yes keepalive-timeout=18000 port=22
/ip address
add address=10.0.1.1/24 comment="[LAN]" interface=bridge_lan network=10.0.1.0
add address=************ comment="[INET]" interface=ether11 network=\
************
/ip dns
set allow-remote-requests=yes servers=77.88.8.88,8.8.8.8
/ip dns static
************
/ip firewall address-list
add address=0.0.0.0/8 list=bogon
add address=10.0.0.0/8 list=bogon
add address=100.64.0.0/10 list=bogon
add address=127.0.0.0/8 list=bogon
add address=169.254.0.0/16 list=bogon
add address=172.16.0.0/12 list=bogon
add address=192.0.0.0/24 list=bogon
add address=192.0.2.0/24 list=bogon
add address=192.168.0.0/16 list=bogon
add address=198.18.0.0/15 list=bogon
add address=198.51.100.0/24 list=bogon
add address=203.0.113.0/24 list=bogon
add address=224.0.0.0/4 list=bogon
add address=240.0.0.0/4 list=bogon
/ip firewall filter
add chain=input comment="[mikrotik]" dst-port=****** protocol=tcp
add chain=input comment="[icmp]" protocol=icmp
add action=add-src-to-address-list address-list=blocked_bogon \
address-list-timeout=12h chain=input comment="[bogon_network_drop]" \
disabled=yes in-interface=ether11 src-address-list=bogon
add action=drop chain=input disabled=yes in-interface=ether11 \
src-address-list=bogon
add action=add-src-to-address-list address-list=blocked_dns_flood \
address-list-timeout=12h chain=input comment="[dns_flood_drop]" dst-port=\
53 in-interface=ether11 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether11 protocol=udp
add chain=input comment="[ssh]" dst-port=40002 protocol=tcp
add chain=input comment="[sstp]" dst-port=22 protocol=tcp
add chain=input comment="[ovpn]" dst-port=3389 protocol=tcp
add chain=input comment="[vpn_pptp]" dst-port=1723 protocol=tcp
add chain=input protocol=gre
add chain=input comment="[vpn_l2tp]" protocol=ipsec-esp
add chain=input protocol=ipsec-ah
add chain=input dst-port=1701,400,500 protocol=tcp
add chain=input dst-port=1701,400,500 protocol=udp
add chain=input comment="[input]" connection-state=established,related \
in-interface=ether11
add action=drop chain=input in-interface=ether11
add action=drop chain=input in-interface=ether11
add chain=forward comment="[forward]" connection-state=established,related \
in-interface=ether11
add action=drop chain=forward connection-state=invalid in-interface=ether11
/ip firewall nat
add action=dst-nat chain=dstnat comment="*********" dst-address=\
*********** dst-port=1000 protocol=tcp to-addresses=10.0.1.104 \
to-ports=3389
add action=dst-nat chain=dstnat comment="RDP SERVER" dst-address=\
*********** dst-port=10245 protocol=tcp to-addresses=10.0.1.105 \
to-ports=3389
add action=dst-nat chain=dstnat comment="EXCHANGE SMTP" dst-address=\
*********** dst-port=25 protocol=tcp to-addresses=10.0.1.10 to-ports=\
25
add action=dst-nat chain=dstnat comment="EXCHANGE HTTPS" dst-address=\
*********** dst-port=443 protocol=tcp to-addresses=10.0.1.10 to-ports=\
443
add action=dst-nat chain=dstnat comment="EXCHANGE IMAP" dst-address=\
*********** dst-port=143 protocol=tcp to-addresses=10.0.1.10 to-ports=\
143
add action=dst-nat chain=dstnat dst-address=*********** dst-port=993 \
protocol=tcp to-addresses=10.0.1.10 to-ports=993
add action=masquerade chain=srcnat comment="[ovpn]" dst-address=10.0.0.0/16 \
out-interface=bridge_vpn src-address=10.0.1.0/24
add action=masquerade chain=srcnat comment="[pptp]" dst-address=10.0.0.0/16 \
out-interface=bridge_vpn src-address=10.0.0.0/24
add action=masquerade chain=srcnat comment="[inet]" dst-address=!10.0.0.0/16 \
out-interface=ether11 src-address=10.0.1.0/24
add action=masquerade chain=srcnat comment="[ovpn]" disabled=yes dst-address=\
10.0.3.0/24 out-interface=bridge_lan src-address=10.0.1.0/24
add action=masquerade chain=srcnat comment="[ovpn]" disabled=yes dst-address=\
10.0.4.0/24 out-interface=bridge_lan src-address=10.0.1.0/24
add action=masquerade chain=srcnat comment="[ovpn]" disabled=yes dst-address=\
10.0.5.0/24 out-interface=bridge_lan src-address=10.0.1.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add check-gateway=arp distance=10 gateway=***********
add comment="[ovpn_vpn_users]" distance=2 dst-address=10.0.0.0/24 gateway=\
172.16.100.1
add comment="[vpn_lans]" distance=2 dst-address=10.0.2.0/24 gateway=\
172.16.100.2
add distance=2 dst-address=10.0.3.0/24 gateway=172.16.100.3
add distance=2 dst-address=10.0.4.0/24 gateway=172.16.100.4
add distance=2 dst-address=10.0.5.0/24 gateway=172.16.100.5
add distance=2 dst-address=10.0.6.0/24 gateway=172.16.100.6
add distance=2 dst-address=10.0.7.0/24 gateway=172.16.100.7
add distance=2 dst-address=10.0.8.0/24 gateway=172.16.100.8
add distance=2 dst-address=10.0.9.0/24 gateway=172.16.100.9
add distance=2 dst-address=10.0.10.0/24 gateway=172.16.100.10
add distance=2 dst-address=10.0.11.0/24 gateway=172.16.100.11
add distance=2 dst-address=10.0.12.0/24 gateway=172.16.100.12
add distance=2 dst-address=10.0.13.0/24 gateway=172.16.100.13
add distance=2 dst-address=10.0.14.0/24 gateway=172.16.100.14
add distance=2 dst-address=10.0.15.0/24 gateway=172.16.100.15
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=40002
set api disabled=yes
set winbox port=40001
set api-ssl disabled=yes
/lcd
set color-scheme=dark default-screen=informative-slideshow read-only-mode=yes \
touch-screen=disabled
/lcd screen
set 0 disabled=yes
set 1 disabled=yes
set 2 disabled=yes
set 3 disabled=yes
set 5 disabled=yes
/ppp aaa
set use-radius=yes
/ppp secret
add local-address=172.16.100.1 name=msk_prom4 password=*********** \
profile=ovpn_all remote-address=172.16.100.3 service=ovpn
add local-address=172.16.100.1 name=msk_kolsk12 password=***********\
profile=ovpn_all remote-address=172.16.100.4 service=ovpn
add local-address=172.16.100.1 name=msk_lespol password=***********\
profile=ovpn_all remote-address=172.16.100.5 service=ovpn
add name=vpnuser password="***********" profile=pptp_all
add local-address=172.16.100.1 name=msk_cherm39 password=***********\
profile=ovpn_all remote-address=172.16.100.6 service=ovpn
add local-address=172.16.100.1 name=f_samara password=***********\
profile=ovpn_all remote-address=172.16.100.9 service=ovpn
add local-address=172.16.100.1 name=f_krasnodar password=***********\
profile=ovpn_all remote-address=172.16.100.7 service=ovpn
add local-address=172.16.100.1 name=f_ekat password=***********\
profile=ovpn_all remote-address=172.16.100.11 service=ovpn
add local-address=172.16.100.1 name=f_maykop password=***********\
profile=ovpn_all remote-address=172.16.100.10 service=ovpn
add local-address=172.16.100.1 name=f_stavropol password=***********\
profile=ovpn_all remote-address=172.16.100.8 service=ovpn
/radius
add address=10.0.1.101 secret=*********** service=ppp
/system clock
set time-zone-autodetect=no
/system clock manual
set dst-delta=+01:00 time-zone=+03:00
/system identity
set name=gate.*********
/system ntp client
set enabled=yes primary-ntp=66.187.233.4 secondary-ntp=86.57.151.18
/system package update
set channel=current
/system routerboard settings
set cpu-frequency=1200MHz memory-frequency=1066DDR
/tool mac-server
set [ find default=yes ] disabled=yes
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
/tool romon port
add

 "Маршрутизатор в сети устройства 10.0.7.1"

# jun/04/2016 22:54:00 by RouterOS 6.33
# software id = 0YQ6-0XUY
#
/interface bridge
add admin-mac=E4:8D:8C:9A:3A:B0 auto-mac=no name=bridge_10.0.7.xx
/interface ethernet
set [ find default-name=ether3 ] master-port=ether2
set [ find default-name=ether4 ] master-port=ether2
set [ find default-name=ether5 ] master-port=ether2
/interface pppoe-client
add add-default-route=yes default-route-distance=1 dial-on-demand=yes \
disabled=no interface=ether1 max-mru=1480 max-mtu=1480 name=\
pppoe-telemaks password=********* use-peer-dns=yes user=*********
/ip neighbor discovery
set ether1 discover=no
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=********* \
supplicant-identity="" wpa-pre-shared-key=********* wpa2-pre-shared-key=\
*********
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \
disabled=no distance=indoors frequency=auto mode=ap-bridge \
security-profile=********* ssid=********* wireless-protocol=802.11
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=pool_10.0.7.xx ranges=10.0.7.50-10.0.7.200
/ip dhcp-server
add address-pool=pool_10.0.7.xx disabled=no interface=bridge_10.0.7.xx \
lease-time=2d name=dhcp_10.0.7.xx
/ppp profile
add change-tcp-mss=yes name=ovpn only-one=no use-compression=no \
use-encryption=yes use-mpls=no
/interface ovpn-client
add cipher=aes256 connect-to=********* mac-address=02:07:7A:69:EB:7D \
mode=ethernet name=f_krasnodar password=********* port=3389 \
profile=ovpn user=f_krasnodar
/system logging action
set 1 disk-file-name=log
/interface bridge port
add bridge=bridge_10.0.7.xx interface=ether2
add bridge=bridge_10.0.7.xx interface=wlan1
/ip address
add address=10.0.7.1/24 interface=bridge_10.0.7.xx network=10.0.7.0
/ip dhcp-client
add default-route-distance=10 dhcp-options=hostname,clientid disabled=no \
use-peer-dns=no use-peer-ntp=no
add default-route-distance=8 dhcp-options=hostname,clientid disabled=no \
interface=ether1 use-peer-dns=no use-peer-ntp=no
/ip dhcp-server lease
add address=10.0.7.194 comment="[tel_2]" mac-address=7C:2F:80:61:D7:AB \
server=dhcp_10.0.7.xx
add address=10.0.7.193 comment="[tel_1]" mac-address=7C:2F:80:61:D8:7A \
server=dhcp_10.0.7.xx
add address=10.0.7.191 comment="[printer hp 1212]" mac-address=\
74:46:A0:4E:71:85 server=dhcp_10.0.7.xx
/ip dhcp-server network
add address=10.0.7.0/24 dns-server=10.0.7.1 gateway=10.0.7.1
/ip dns
set allow-remote-requests=yes servers=77.88.8.2,8.8.4.4
/ip dns static
add address=192.168.88.1 name=router
/ip firewall filter
add chain=input comment="[icmp]" protocol=icmp
add chain=input comment="[mikrotik]" dst-port=********* protocol=tcp
add chain=input disabled=yes dst-port=80 protocol=tcp
add action=drop chain=input comment="[dns_flood]" dst-port=53 in-interface=\
pppoe-telemaks protocol=udp
add chain=input comment="[other]" connection-state=established,related
add action=drop chain=input in-interface=ether1
add action=fasttrack-connection chain=forward connection-state=\
established,related
add chain=forward connection-state=established,related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward connection-nat-state=!dstnat connection-state=\
new in-interface=ether1
/ip firewall nat
add action=masquerade chain=srcnat comment="[ovpn]" dst-address=10.0.0.0/8 \
out-interface=f_krasnodar src-address=10.0.7.0/24
add action=masquerade chain=srcnat comment="[inet_10.0.7.xx *********]" \
out-interface=pppoe-telemaks src-address=10.0.7.0/24
# lte1 not ready
add action=masquerade chain=srcnat comment="[inet_10.0.7.xx]" out-interface=\
*9 src-address=10.0.7.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add distance=2 dst-address=10.0.1.0/24 gateway=172.16.100.1
add distance=2 dst-address=10.0.2.0/24 gateway=172.16.100.2
add distance=2 dst-address=10.0.3.0/24 gateway=172.16.100.3
add distance=2 dst-address=10.0.4.0/24 gateway=172.16.100.4
add distance=2 dst-address=10.0.5.0/24 gateway=172.16.100.5
add distance=2 dst-address=10.0.6.0/24 gateway=172.16.100.6
add distance=2 dst-address=10.0.8.0/24 gateway=172.16.100.8
add distance=2 dst-address=10.0.9.0/24 gateway=172.16.100.9
add distance=2 dst-address=10.0.10.0/24 gateway=172.16.100.10
add distance=2 dst-address=10.0.11.0/24 gateway=172.16.100.11
add distance=2 dst-address=10.0.12.0/24 gateway=172.16.100.12
add distance=2 dst-address=10.0.13.0/24 gateway=172.16.100.13
add distance=2 dst-address=10.0.14.0/24 gateway=172.16.100.14
add distance=2 dst-address=10.0.15.0/24 gateway=172.16.100.15
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox port=*********
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=f_krasnodar
/system leds
set 5 interface=wlan1
/system ntp client
set enabled=yes primary-ntp=66.187.233.4 secondary-ntp=86.57.151.18
/system routerboard settings
set cpu-frequency=750MHz protected-routerboot=disabled
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2
add interface=ether3
add interface=ether4
add interface=ether5
add interface=wlan1
add interface=bridge_10.0.7.xx
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2
add interface=ether3
add interface=ether4
add interface=ether5
add interface=wlan1
add interface=bridge_10.0.7.xx
/tool romon port
set [ find default=yes ] cost=100 forbid=no interface=all secrets=""

 "Маршрутизатор в моей сети 10.0.4.1"

# apr/21/2016 16:37:19 by RouterOS 6.33
# software id = FFKY-SNRQ
#
/interface bridge
add name=bridge_guest
add name=bridge_one
/interface ethernet
set [ find default-name=ether1 ] comment="[INET1]"
set [ find default-name=ether2 ] comment="[INET2]"
set [ find default-name=ether3 ] disabled=yes
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] comment="[LAN]"
set [ find default-name=ether7 ] master-port=ether6
set [ find default-name=ether8 ] master-port=ether6
set [ find default-name=ether9 ] master-port=ether6
set [ find default-name=ether10 ] master-port=ether6
set [ find default-name=sfp1 ] disabled=yes
/ip neighbor discovery
set ether1 comment="[INET1]"
set ether2 comment="[INET2]"
set ether6 comment="[LAN]"
/interface vlan
add interface=ether6 l2mtu=1594 name=vlan77 use-service-tag=yes vlan-id=77
/ip firewall layer7-protocol
add name=******* regexp=*******
add name=******* regexp=*******
add name=******* regexp=*******
add name=******* regexp=*******
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=pool_one ranges=10.0.4.50-10.0.4.253
add name=pool_guest ranges=192.168.77.50-192.168.77.254
/ip dhcp-server
add address-pool=pool_one disabled=no interface=bridge_one lease-time=2d \
name=dhcp_lan
add address-pool=pool_guest disabled=no interface=bridge_guest lease-time=3h \
name=dhcp_guest
/ppp profile
add change-tcp-mss=yes name=ovpn only-one=no use-compression=no \
use-encryption=yes use-mpls=no
/interface ovpn-client
add cipher=aes256 connect-to=******* mac-address=******* \
mode=ethernet name=msk_kolsk12 password=******* port=3389 \
profile=ovpn user=msk_kolsk12
/interface bridge port
add bridge=bridge_one interface=ether6
add bridge=bridge_guest interface=vlan77
/ip address
add address=10.0.4.1/24 interface=ether6 network=10.0.4.0
add address=*******/30 interface=ether1 network=188.65.134.140
add address=*******/30 interface=ether2 network=188.94.210.36
add address=192.168.77.1/24 interface=vlan77 network=192.168.77.0
/ip dhcp-server network
add address=10.0.4.0/24 dns-server=10.0.4.1 gateway=10.0.4.1
add address=192.168.77.0/24 dns-server=192.168.77.1 gateway=192.168.77.1
/ip dns
set allow-remote-requests=yes servers=77.88.8.2,8.8.4.4
/ip firewall address-list
add address=192.168.0.0/16 list=localnet
add address=172.16.0.0/16 list=localnet
add address=0.0.0.0/8 list=bogon
add address=10.0.0.0/8 list=bogon
add address=100.64.0.0/10 list=bogon
add address=127.0.0.0/8 list=bogon
add address=169.254.0.0/16 list=bogon
add address=172.16.0.0/12 list=bogon
add address=192.0.0.0/24 list=bogon
add address=192.0.2.0/24 list=bogon
add address=192.168.0.0/16 list=bogon
add address=198.18.0.0/15 list=bogon
add address=198.51.100.0/24 list=bogon
add address=203.0.113.0/24 list=bogon
add address=224.0.0.0/4 list=bogon
add address=240.0.0.0/4 list=bogon
/ip firewall filter
add action=drop chain=forward comment="KILL *******" disabled=yes \
dst-address=*******
add action=drop chain=forward comment="KILL *******" disabled=yes \
dst-address=*******
add chain=input comment="[mikrotik]" dst-port=******* protocol=tcp
add action=add-src-to-address-list address-list=blocked_bogon \
address-list-timeout=12h chain=input comment="[dns_flood_drop]" \
in-interface=ether1 src-address-list=bogon
add action=add-src-to-address-list address-list=blocked_bogon \
address-list-timeout=12h chain=input in-interface=ether2 \
src-address-list=bogon
add action=drop chain=input in-interface=ether1 src-address-list=bogon
add action=drop chain=input in-interface=ether2 src-address-list=bogon
add action=add-src-to-address-list address-list=blocked_dns_flood \
address-list-timeout=12h chain=input comment="[dns_flood_drop]" dst-port=\
53 in-interface=ether1 protocol=udp
add action=add-src-to-address-list address-list=blocked_dns_flood \
address-list-timeout=12h chain=input dst-port=53 in-interface=ether2 \
protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
add action=drop chain=input dst-port=53 in-interface=ether2 protocol=udp
add chain=input comment="[mikrotik api]" dst-port=8729 protocol=tcp
add chain=input comment="[icmp]" protocol=icmp
add action=drop chain=input comment="[drop_quest_traffik]" dst-address=\
10.0.0.0/8 src-address=192.168.0.0/16
add action=drop chain=forward dst-address=10.0.0.0/8 src-address=\
192.168.0.0/16
add chain=input comment="[input]" connection-state=established,related
add action=drop chain=input in-interface=ether1
add action=drop chain=input in-interface=ether2
add chain=forward comment="[forward]" connection-state=established,related
add action=drop chain=forward connection-state=invalid
/ip firewall mangle
add action=mark-connection chain=prerouting comment="[dns_layer7_*******]" \
dst-address=10.0.4.1 dst-port=53 layer7-protocol=******* \
new-connection-mark=*******-fwd protocol=udp
add action=mark-connection chain=prerouting dst-address=10.0.4.1 dst-port=53 \
layer7-protocol=******* new-connection-mark=kin.su-fwd protocol=udp
add action=mark-connection chain=prerouting dst-address=10.0.4.1 dst-port=53 \
layer7-protocol=******* new-connection-mark=kin.su-fwd protocol=udp
add action=mark-connection chain=prerouting dst-address=10.0.4.1 dst-port=53 \
layer7-protocol=******* new-connection-mark=kin.su-fwd protocol=udp
add action=mark-connection chain=input comment="[INET1_MANGLE]" dst-address=\
188.65.134.142 in-interface=ether1 new-connection-mark="ISP1 -> Input" \
passthrough=no
add action=mark-routing chain=output connection-mark="ISP1 -> Input" \
new-routing-mark=isp1 passthrough=no
add action=mark-connection chain=input comment="[INET2_MANGLE]" dst-address=\
188.94.210.38 in-interface=ether2 new-connection-mark="ISP 2 -> Input" \
passthrough=no
add action=mark-routing chain=output connection-mark="ISP 2 -> Input" \
new-routing-mark=isp2 passthrough=no
/ip firewall nat
add action=dst-nat chain=dstnat comment="[dns_layer7]" connection-mark=\
kin.su-fwd to-addresses=172.16.100.1
add action=masquerade chain=srcnat connection-mark=*******-fwd
add action=masquerade chain=srcnat comment="[ovpn_all]" dst-address=\
10.0.0.0/16 out-interface=msk_kolsk12 src-address=10.0.4.0/24
add action=masquerade chain=srcnat comment="[INET]" dst-address=!10.0.4.0/24 \
out-interface=ether1 src-address=10.0.4.0/24
add action=masquerade chain=srcnat dst-address=!10.0.4.0/24 out-interface=\
ether2 src-address=10.0.4.0/24
add action=masquerade chain=srcnat dst-address=!192.168.77.0/24 \
out-interface=ether1 src-address=192.168.77.0/24
add action=masquerade chain=srcnat dst-address=!192.168.77.0/24 \
out-interface=ether2 src-address=192.168.77.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
/ip route
add check-gateway=arp comment="[INET1]" distance=10 gateway=*******
add check-gateway=arp comment="[INET2]" distance=20 gateway=*******
add comment="[ROUTER PING]" distance=100 dst-address=8.8.8.8/32 gateway=\
*******,*******
add comment="[vpn_lans]" distance=2 dst-address=10.0.0.0/24 gateway=\
172.16.100.1
add distance=2 dst-address=10.0.1.0/24 gateway=172.16.100.1
add distance=2 dst-address=10.0.2.0/24 gateway=172.16.100.2
add distance=2 dst-address=10.0.3.0/24 gateway=172.16.100.3
add distance=2 dst-address=10.0.5.0/24 gateway=172.16.100.5
add distance=2 dst-address=10.0.6.0/24 gateway=172.16.100.6
add distance=2 dst-address=10.0.7.0/24 gateway=172.16.100.7
add distance=2 dst-address=10.0.8.0/24 gateway=172.16.100.8
add distance=2 dst-address=10.0.9.0/24 gateway=172.16.100.9
add distance=2 dst-address=10.0.10.0/24 gateway=172.16.100.10
add distance=2 dst-address=10.0.11.0/24 gateway=172.16.100.11
add distance=2 dst-address=10.0.12.0/24 gateway=172.16.100.12
add distance=2 dst-address=10.0.13.0/24 gateway=172.16.100.13
add distance=2 dst-address=10.0.14.0/24 gateway=172.16.100.14
add distance=2 dst-address=10.0.15.0/24 gateway=172.16.100.15
add comment="[ROUTER PING]" distance=100 dst-address=77.88.8.88/32 gateway=\
*******,*******
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=*******
set api disabled=yes
set winbox port=*******
/system clock
set time-zone-name=Europe/Moscow
/system identity
set name=msk_kolsk12
/system ntp client
set enabled=yes primary-ntp=66.187.233.4 secondary-ntp=86.57.151.18
/system routerboard settings
set cpu-frequency=700MHz
/system scheduler
add interval=15s name=run_inet_check on-event="/system script run inet_check" \
policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
start-time=startup
/system script
*******
/tool romon port
set [ find default=yes ] cost=100 forbid=no interface=all secrets=""
add cost=100 disabled=yes forbid=no interface=all secrets=""

[Lipser]

Готово

Вижу в своем маршрутихаторе записи типа
/ip route
add distance=2 dst-address=10.0.7.0/24 gateway=172.16.100.7
Насколько я понимаю маршрут прописан.
Дальше чего не хватает ? На центральном маршрутизаторе ?
Или на маршрутизаторе в сети устройства надо открыть порт 80 из 172.16.100.7 в 10.0.7.88 ??

[Lipser]

Подниму тему. Вопрос все так же актуален - как открыть доступ в подсеть 10.0.7.0/24 ??

[KARaS'b]

Если под 80м портом вы подразумеваете вебморду микротика, то она у вас вообще выключена и вы туда никак не попадете, пока не включите

Код: Выделить всё

/ip service
set www disabled=yes

[Lipser]

нет, вебморды любых устройств в подсети 10.0.7.0/24. да и не обязательно именно 80ый порт. интересует сам механизм, почему в третью подсеть отовсюду можно, а в другие подсети нельзя. где и как это разрешено?

[Lipser]

подниму вначале недели