Брандмауэр Windows блокирует MikroTik

Обсуждение ПО и его настройки
Ответить
biGUdee
Сообщения: 2
Зарегистрирован: 09 окт 2019, 17:26

09 окт 2019, 17:38

Добрый день.
Уже довольно продолжительное время мучался с проблемой, пока окончательно не вывел закономерность.

При включении брандмауэра блочится доступ в локальную сеть домена и интернет.
При выключении брандмауэра доступ в интернет и локальную сеть восстанавливается.
Сам я еще зеленый в микроте, достался по наследству, начались проблемы после непланового отключения электричества.

Вот весь конфиг
 
# oct/09/2019 21:29:45 by RouterOS 6.44.5
# software id = WZ0P-MEYU
#
# model = RouterBOARD 962UiGS-5HacT2HnT
# serial number = 8306081DD4A9
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2462 name=\
channel1-2G tx-power=20
add band=5ghz-a/n/ac control-channel-width=20mhz extension-channel=eCee \
frequency=5200 name=channel2-5G
/interface bridge
add arp=proxy-arp fast-forward=no name=bridge1
add arp=proxy-arp comment=OfficeWiFi fast-forward=no name=bridge2
add arp=proxy-arp comment=GuestWiFi fast-forward=no name=bridge3
/interface ethernet
set [ find default-name=ether1 ] comment=WAN1 loop-protect-disable-time=10s \
speed=100Mbps
set [ find default-name=ether2 ] advertise="10M-half,10M-full,100M-half,100M-f\
ull,1000M-half,1000M-full,2500M-full,10000M-full" comment=WAN2
set [ find default-name=ether3 ] advertise=\
100M-half,100M-full,1000M-half,1000M-full speed=100Mbps
set [ find default-name=ether4 ] advertise=\
100M-half,100M-full,1000M-half,1000M-full speed=100Mbps
set [ find default-name=ether5 ] advertise=\
100M-half,100M-full,1000M-half,1000M-full speed=100Mbps
set [ find default-name=sfp1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full
/caps-man datapath
add bridge=bridge2 comment="Office network" local-forwarding=yes name=\
datapath1
add arp=disabled bridge=bridge3 comment="Guest network" name=datapath2
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm,tkip name=\
"office network" passphrase=***
add authentication-types=wpa2-psk encryption=aes-ccm,tkip name=\
"guest network" passphrase=***
/caps-man configuration
add channel=channel1-2G comment=OfficeNetwork-2G country=russia3 datapath=\
datapath1 mode=ap name=cfg1 rx-chains=0,1,2 security="office network" \
ssid=MediaProNet tx-chains=0,1,2
add channel=channel1-2G comment=GuestNetwork-2G country=russia3 datapath=\
datapath2 mode=ap name=cfg2 rx-chains=0,1,2 security="guest network" \
ssid=Mediapronet tx-chains=0,1,2
add channel=channel2-5G comment=OfficeNetwork-5G country=russia3 datapath=\
datapath1 mode=ap name=cfg3 rx-chains=0,1,2 security="office network" \
ssid=MediaProNet tx-chains=0,1,2
add channel=channel2-5G comment=GuestNetwork-5G country=russia3 datapath=\
datapath2 mode=ap name=cfg4 rx-chains=0,1,2 security="guest network" \
ssid=Mediapronet tx-chains=0,1,2
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=mpn supplicant-identity="" \
wpa2-pre-shared-key=***
/interface wireless
# managed by CAPsMAN
# channel: 2462/20-eC/gn(20dBm), SSID: MediaProNet, local forwarding
set [ find default-name=wlan1 ] disabled=no frequency=2432 mode=ap-bridge \
security-profile=mpn ssid=Mediapronet wireless-protocol=802.11 wps-mode=\
disabled
# managed by CAPsMAN
# channel: 5200/20-eCee/ac(20dBm), SSID: MediaProNet, local forwarding
set [ find default-name=wlan2 ] disabled=no mode=ap-bridge security-profile=\
mpn ssid=Mediapronet wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 enc-algorithm=aes-256,aes-128,3des
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-256-ctr,3des
/ip pool
add name="Wi-Fi Guest" ranges=192.168.2.10-192.168.2.100
add name="Wi-Fi Office" ranges=192.168.10.10-192.168.10.100
add name=cams-pool ranges=192.168.100.10-192.168.100.150
add name=vpn ranges=192.168.1.240-192.168.1.250
/ip dhcp-server
add add-arp=yes address-pool="Wi-Fi Office" disabled=no interface=bridge2 \
lease-time=8h name=server1
add add-arp=yes address-pool="Wi-Fi Guest" disabled=no interface=bridge3 \
lease-time=1h name=server2
add address-pool=cams-pool interface=ether4 lease-time=1d name=server3
/ppp profile
set *0 bridge=bridge1 dns-server=192.168.1.100 local-address=192.168.1.1 \
remote-address=vpn use-encryption=yes wins-server=192.168.1.100
/queue simple
add dst=bridge3 max-limit=512k/512k name=queue1 target=ether1
/system logging action
add email-start-tls=yes email-to=*** name=action1 \
target=email
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=b,g,gn \
master-configuration=cfg1 slave-configurations=cfg2
add action=create-dynamic-enabled hw-supported-modes=a,ac,an \
master-configuration=cfg3 slave-configurations=cfg4
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=wlan2
add bridge=bridge1 interface=ether3
/ip firewall connection tracking
set tcp-established-timeout=15m
/ip neighbor discovery-settings
set discover-interface-list=none
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=default enabled=yes \
ipsec-secret=*** use-ipsec=yes
/interface pptp-server server
set default-profile=default
/interface wireless cap
#
set caps-man-addresses=192.168.1.1 enabled=yes interfaces=wlan1,wlan2
/ip address
add address=192.168.1.1/24 interface=bridge1 network=192.168.1.0
add address=192.168.2.1/24 interface=bridge3 network=192.168.2.0
add address=192.168.10.1/24 interface=bridge2 network=192.168.10.0
add address=192.168.1.2/24 interface=bridge1 network=192.168.1.0
add address=195.91.197.2/28 comment=Rinet interface=ether1 network=\
195.91.197.0
add address=192.168.100.1/24 comment=cams interface=ether4 network=\
192.168.100.0
add address=62.141.86.186/29 comment=Beeline interface=ether2 network=\
62.141.86.184
/ip dhcp-client
add add-default-route=no dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.100,8.8.8.8,8.8.4.4 gateway=\
192.168.1.1 netmask=24
add address=192.168.2.0/24 comment="Guest network" dns-server=77.88.8.8 \
gateway=192.168.2.1
add address=192.168.10.0/24 comment="Office Network" dns-server=192.168.1.100 \
domain=Mediapronet.ru gateway=192.168.10.1
/ip dns
set servers=192.168.1.100,8.8.8.8,8.8.4.4
/ip firewall address-list
add address=178.237.192.0/24 list=Telediscount
add address=46.146.167.223 list=blocked-ip
add address=176.106.244.2 list=blocked-ip
add address=42.117.205.0/24 list=blocked-ip
add address=179.110.154.0/24 list=blocked-ip
add address=62.141.73.0/24 list=blocked-ip
/ip firewall filter
add action=accept chain=forward in-interface=ether1 out-interface=ether4
add action=accept chain=forward in-interface=ether4 out-interface=ether1
add action=drop chain=input disabled=yes in-interface=ether1 \
src-address-list=blocked-ip
add action=drop chain=input disabled=yes in-interface=ether2 \
src-address-list=blocked-ip
add action=log chain=forward dst-address=195.54.207.74 dst-port=22 log=yes \
log-prefix=!!!MAKE-CONNECT!!! protocol=tcp
add action=add-src-to-address-list address-list=blocked-ip \
address-list-timeout=none-dynamic chain=forward disabled=yes dst-port=\
3389 in-interface=ether1 log=yes protocol=tcp
add action=add-src-to-address-list address-list=blocked-ip \
address-list-timeout=none-dynamic chain=input dst-port=22 in-interface=\
ether1 protocol=tcp
add action=add-src-to-address-list address-list=blocked-ip \
address-list-timeout=none-dynamic chain=input connection-state=new \
dst-port=8291 in-interface=ether1 protocol=tcp
add action=accept chain=input disabled=yes in-interface=ether1 port=\
1701,500,4500 protocol=udp
add action=accept chain=input disabled=yes in-interface=ether1 protocol=\
ipsec-esp
add action=accept chain=input comment=SSH dst-port=2233 protocol=tcp
add action=accept chain=input log-prefix=ICMP protocol=icmp
add action=accept chain=forward in-interface=bridge2 log=yes out-interface=\
bridge1
add action=accept chain=forward in-interface=bridge1 out-interface=bridge2
add action=fasttrack-connection chain=forward connection-state=\
established,related disabled=yes
add action=accept chain=forward connection-state=established,related \
disabled=yes
add action=drop chain=input connection-state=new disabled=yes in-interface=\
ether1
add action=drop chain=input connection-state=new disabled=yes in-interface=\
ether2
add action=accept chain=input dst-port=8000 protocol=tcp
add action=accept chain=input dst-port=8585 protocol=tcp
add action=accept chain=forward disabled=yes in-interface=ether2 \
out-interface=ether4
add action=accept chain=forward disabled=yes in-interface=ether4 \
out-interface=ether2
add action=drop chain=output dst-address=8.8.8.8 out-interface=ether2
add action=drop chain=input src-address-list=blocked-ip
/ip firewall mangle
add action=mark-routing chain=prerouting comment=Telediscount disabled=yes \
dst-address-list=Telediscount new-routing-mark=telediscount-route \
passthrough=no src-address=192.168.1.0/24
add action=mark-connection chain=prerouting comment=ISP1 in-interface=ether1 \
new-connection-mark=from-ISP1 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=from-ISP1 \
new-routing-mark=to-ISP1 passthrough=yes
add action=mark-routing chain=output connection-mark=from-ISP1 \
new-routing-mark=to-ISP1 passthrough=yes
add action=mark-routing chain=output new-routing-mark=to-ISP1 passthrough=yes \
src-address=195.91.197.2
add action=mark-connection chain=prerouting comment=ISP2 in-interface=ether2 \
new-connection-mark=from-ISP2 passthrough=yes
add action=mark-routing chain=prerouting connection-mark=from-ISP2 \
new-routing-mark=to-ISP2 passthrough=yes
add action=mark-routing chain=output connection-mark=from-ISP2 \
new-routing-mark=to-ISP2 passthrough=yes
add action=mark-routing chain=output new-routing-mark=to-ISP2 passthrough=yes \
src-address=62.141.86.186
add action=mark-connection chain=prerouting disabled=yes dst-address-list=\
Telediscount new-connection-mark=traf-2ip passthrough=no src-address=\
192.168.1.99
add action=mark-routing chain=prerouting disabled=yes dst-address=\
87.250.250.93 new-routing-mark=adfox passthrough=no src-address=\
192.168.1.0/24
add action=mark-routing chain=prerouting disabled=yes dst-address=\
87.250.250.92 new-routing-mark=adfox passthrough=no src-address=\
192.168.1.0/24
/ip firewall nat
add action=dst-nat chain=dstnat dst-port=33950 protocol=tcp to-addresses=\
192.168.1.99 to-ports=3389
add action=dst-nat chain=dstnat dst-port=33950 protocol=udp to-addresses=\
192.168.1.99 to-ports=3389
add action=dst-nat chain=dstnat comment=Cam dst-port=8000 in-interface=ether1 \
protocol=tcp to-addresses=192.168.100.150 to-ports=8000
add action=dst-nat chain=dstnat comment=Cam dst-port=8080 protocol=tcp \
to-addresses=192.168.100.150 to-ports=80
add action=dst-nat chain=dstnat comment=Cam dst-port=8000 protocol=udp \
to-addresses=192.168.100.150 to-ports=8000
add action=src-nat chain=srcnat out-interface=ether1 to-addresses=\
195.91.197.2
add action=src-nat chain=srcnat disabled=yes out-interface=ether2 \
to-addresses=212.119.215.234
add action=dst-nat chain=dstnat disabled=yes dst-port=33951 protocol=tcp \
to-addresses=192.168.1.154 to-ports=3389
add action=dst-nat chain=dstnat disabled=yes dst-port=33951 protocol=udp \
to-addresses=192.168.1.154 to-ports=3389
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
192.168.100.0/24
add action=masquerade chain=srcnat src-address=192.168.10.0/24
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat out-interface=ether2
add action=netmap chain=dstnat dst-address=195.91.197.2 dst-port=23452 \
in-interface=ether1 protocol=tcp to-addresses=192.168.100.99 to-ports=\
8000
add action=netmap chain=dstnat dst-address=195.91.197.2 dst-port=23453 \
in-interface=ether1 protocol=tcp to-addresses=192.168.100.100 to-ports=\
8000
add action=netmap chain=dstnat dst-address=195.91.197.2 dst-port=1974 \
in-interface=ether1 protocol=tcp src-port="" to-addresses=192.168.1.14 \
to-ports=1974
add action=netmap chain=dstnat dst-address=195.91.197.2 dst-port=88 \
in-interface=ether1 protocol=tcp src-port="" to-addresses=192.168.1.14 \
to-ports=443
/ip firewall service-port
set sip sip-direct-media=no
/ip route
add distance=1 gateway=195.91.197.1 routing-mark=telediscount-route
add check-gateway=ping disabled=yes distance=10 gateway=62.141.86.185 \
routing-mark=telediscount-route
add distance=1 gateway=195.91.197.1 routing-mark=ISP1
add check-gateway=ping distance=10 gateway=62.141.86.185 routing-mark=ISP2
add comment=WAN1 distance=1 gateway=195.91.197.1
add check-gateway=ping comment=WAN2 disabled=yes distance=10 gateway=\
62.141.86.185
add check-gateway=ping distance=1 dst-address=8.8.8.8/32 gateway=195.91.197.1
add disabled=yes distance=1 dst-address=172.16.30.0/24 gateway=bridge1
/ip route rule
add src-address=195.91.197.2/32 table=ISP1
add src-address=62.141.86.186/32 table=ISP2
add dst-address=192.168.1.0/24 table=main
add dst-address=192.168.2.0/24 table=main
add dst-address=192.168.10.0/24 table=main
add dst-address=192.168.100.0/24 table=main
add routing-mark=to-ISP1 table=ISP1
add routing-mark=to-ISP2 table=ISP2
/ip service
set telnet address=192.168.1.0/24
set ftp address=192.168.1.0/24
set ssh disabled=yes port=2233
set www-ssl disabled=no
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp interfaces
add interface=ether1 type=external
add interface=bridge1 type=internal
/ppp secret
add name=mpnvpnuser password=*** service=l2tp
/system clock
set time-zone-name=Asia/Krasnoyarsk
/system identity
set name=hAP
/system logging
add disabled=yes topics=debug
add action=action1 topics=critical
add action=action1 topics=firewall
/system package update
set channel=long-term
/system scheduler
add interval=30s name=schedule1 on-event="/system script run chkInet" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=aug/01/2018 start-time=13:36:13
/system script
add dont-require-permissions=no name=script1 owner=mpn policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="d\
o {\r\
\n:put [:resolve www.ya.ruz]\r\
\n} on-error={:put \"resolver failed\"};\r\
\n:put \"lalalala\""
add dont-require-permissions=no name=change_reserve owner=mpn policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
""
/tool e-mail
set address=smtp.yandex.ru from=*** password=*** \
port=587 start-tls=yes user=***
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
/tool netwatch
add comment="Change to reserve/main channel" down-script="/ip route set [find \
comment=\"WAN1\"] disabled=yes\r\
\n/ip route set [find comment=\"WAN2\"] disabled=no" host=8.8.8.8 \
interval=10s up-script="/ip route set [find comment=\"WAN1\"] disabled=no\
\r\
\n/ip route set [find comment=\"WAN2\"] disabled=yes"
add comment="Mailing ***" disabled=yes down-script="tool e-mail send to\
=*** subject=\"test\" body=\"test\"" host=8.8.8.8 \
up-script="tool e-mail send to=*** subject=\"test\" \
body=\"test\""
add comment="Mailing *** disabled=yes down-script="tool e-mail send \
to=*** subject=\"test\" body=\"test\"" host=8.8.8.8 \
up-script="tool e-mail send to=*** subject=\"test\" bod\
y=\"test\""


Аватара пользователя
MaxoDroid
Сообщения: 140
Зарегистрирован: 14 май 2019, 22:55
Откуда: Краснодар

09 окт 2019, 20:09

biGUdee писал(а):
09 окт 2019, 17:38
достался по наследству,
Здравствуйте!
Ну раз достался по наследству, то значит, был настроен не для Вас.
Рекомендую его перенастроить именно под Ваши потребности с нуля.
Вот пара статей по Вашей железяке.
1. https://gregory-gost.ru/sozdanie-domash ... ka-hap-ac/
2. https://eboyko.ru/blog/posts/mikrotik-h ... tial-setup
3. Фаерволл можете сочинить под себя. Вот ссылка на умную статью, охватывающую все аспекты возможных случаев для дома и не только https://gregory-gost.ru/sozdanie-domash ... a-dostupa/
При этом можете подумать о фасттраке. Если у Вас нет никаких очередей и тоннелей с IPSec шифрованием, то фасттрак ускорит работу Вашего устройства. https://gregory-gost.ru/mikrotik-fast-t ... obodu-cpu/

И вообще вот перечень очень всего полезного, что Вам может пригодиться, и где все разжевано до уровня слюны - https://gregory-gost.ru/istoriya-statey/
Если Вам только ходить по новостям и по Ютубу, то вролне сгодится фаервол "Из Коробки":
 
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
P.S. И поверьте, что написанный с нуля конфиг именно под Вас будет работать гораздо лучше, нежели чужой переделанный костыль
И в конфиге лучше использовать интерфейс листы:
 
/interface list
add name=LAN
add name=WAN
/interface list member
add comment="Local Stuff" interface=bridge1 list=LAN
add comment="MTS-Internet Incomer" interface=pppoe-out1 list=WAN


Дома: MikroTik RB4011iGS+5HacQ2HnD-IN + DS218Play + hAP ac lite (RB952Ui-5ac2nD)
на работе: hAP, RB951Ui-2HnD.
Инженер - наладчик систем управления ГТУ. Максим.
biGUdee
Сообщения: 2
Зарегистрирован: 09 окт 2019, 17:26

10 окт 2019, 11:41

Я правильно понимаю, что в случае, если у меня что-то не получится, я смогу в полном объеме восстановить настройки из бэкапа, и роутер будет работать как ранее?


Ca6ko
Сообщения: 500
Зарегистрирован: 23 ноя 2018, 11:08
Откуда: Харкiв

10 окт 2019, 11:45

Да правильно. Бэкап в микротике это полный образ устройства можно использовать только на родном устройстве.
Там у Вас такой конфиг что фиг разберешься без пол литры. Для нормальной работы нужно сносить.
Брандмауэр винды блокирует соединения если комп в одной сети, а роутер в другой. В Вашем конфиге на каждом порту своя сеть, скорее всего проблемы начались после перетыкания кабеля в другой порт :ne_vi_del:


RB3011UiAS, RB2011, CRS328, CSS326, cAP ac, wAP ac, hex PoE, RB260GSP, hAP ac lite и hAP lite
SXT 2, SXTsq Lite2, SXT Lite2, LHG 5
Устройство, которое пользователь не носит с собой должно подключаться кабелем!!
Ответить