Пишу свой первый пост на данном форуме. Обычно ответы на все возникающие вопросы нахожу, но с одним затыком не могу справиться. Подробности ниже.
Исходные данные.
Организация - частное образовательное учреждение.
Оборудование - Mikrotik RB3011UiAS
Есть 2 подсети: 192.168.1.0/24 - офисная сеть (office); 192.168.2.0/24 - студенческая сеть (students)
Два провайдера: ISP1 - дом.ру; ISP2 - смарт.
Балансировка отсутствует. Для офисной сети дан доступ к интернету через ISP2, для студентов через ISP1
На данный момент все работает.
Проблема.
В текущей конфигурации я могу подключиться к Mikrotik только по mac-адресу. При попытке подключиться по IP-адресу внутри локальной сети, Winbox выдает следующее:
Connecting to <Шлюз Mikrotik>...
could not connect to <Шлюз Mikrotik>. Reason: connection timed out
Полагаю, что проблема кроется в Firewall'е, но не могу найти где именно. Планирую настроить удаленный доступ к оборудованию и я допускаю, что из-за невозможности подключиться по IP-адресу возникнут проблемы и с удаленным подключением (но пока не пробовал настроить).
Буду рад, если поможете.
# sep/06/2022 11:13:51 by RouterOS 6.49.6
# software id = XXXX-XXXX
#
# model = RouterBOARD 3011UiAS
# serial number = XXXXXXXXX
/interface bridge
add admin-mac=C4:AD:34:2F:28:05 auto-mac=no name=Office_bridge
add admin-mac=C4:AD:34:2F:28:01 auto-mac=no name=Students_bridge
/interface ethernet
set [ find default-name=ether1 ] comment="ISP1 (DOMRU)" mac-address=\
MAC_ISP1
set [ find default-name=ether2 ] comment="ISP2 (SMART)" mac-address=\
MAC_ISP2
set [ find default-name=ether3 ] comment="SRV"
/interface list
add comment="Contains all internet ports" name=ISPs
add comment="All students local hosts" name=Students_local
add comment="All office local hosts" name=Office_local
add name=All_local
add comment="For winbox" name=Console
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip firewall layer7-protocol
add name=Torrents regexp="^(\\x13bittorrent protocol|azver\\x01\$|get /scrape\
\\\?info_hash=get /announce\\\?info_hash=|get /client/bitcomet/|GET /data\
\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[RP]"
/ip pool
add name=office_pool ranges=192.168.1.100-192.168.1.254
add name=student_pool ranges=192.168.2.11-192.168.2.254
/ip dhcp-server
add address-pool=office_pool disabled=no interface=Office_bridge lease-time=\
12h name=office_dhcp
add address-pool=student_pool disabled=no interface=Students_bridge \
lease-time=12h name=students_dhcp
/interface bridge port
add bridge=Students_bridge interface=ether4
add bridge=Students_bridge interface=ether5
add bridge=Students_bridge interface=ether6
add bridge=Office_bridge interface=ether8
add bridge=Office_bridge interface=ether9
add bridge=Office_bridge interface=ether3
add bridge=Students_bridge interface=ether10
add bridge=Office_bridge interface=ether7
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether1 list=ISPs
add interface=ether2 list=ISPs
add interface=ether7 list=Office_local
add interface=ether8 list=Office_local
add interface=ether9 list=Office_local
add interface=ether4 list=Students_local
add interface=ether5 list=Students_local
add interface=ether6 list=Students_local
add interface=ether4 list=All_local
add interface=ether5 list=All_local
add interface=ether6 list=All_local
add interface=ether7 list=All_local
add interface=ether8 list=All_local
add interface=ether9 list=All_local
add interface=ether10 list=All_local
/ip address
add address=IP_ISP1/24 interface=ether1 network=NETWORK_ISP1
add address=IP_ISP2/30 interface=ether2 network=NETWORK_ISP2
add address=192.168.1.1/24 interface=Office_bridge network=192.168.1.0
add address=192.168.2.1/24 interface=Students_bridge network=192.168.2.0
add address=192.168.1.2/24 disabled=yes interface=ether3 network=192.168.1.0
/ip dhcp-server lease
add address=192.168.2.13 client-id=1:4:bf:6d:3:80:80 mac-address=\
04:BF:6D:03:80:80 server=students_dhcp
add address=192.168.2.11 client-id=1:MAC_ISP1 mac-address=\
MAC_ISP1 server=students_dhcp
add address=192.168.2.12 client-id=1:50:ff:20:58:f:a5 mac-address=\
50:FF:20:58:0F:A5 server=students_dhcp
add address=192.168.1.115 client-id=1:0:25:36:86:f6:c8 mac-address=\
00:25:36:86:F6:C8 server=office_dhcp
add address=192.168.1.116 client-id=1:0:80:87:62:ff:d3 mac-address=\
00:80:87:62:FF:D3 server=office_dhcp
add address=192.168.1.117 client-id=1:0:25:36:ee:27:11 mac-address=\
00:25:36:EE:27:11 server=office_dhcp
add address=192.168.1.119 client-id=1:0:25:36:fe:13:11 mac-address=\
00:25:36:FE:13:11 server=office_dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=ISP1_DNS1,ISP1_DNS2 gateway=\
192.168.1.1
add address=192.168.2.0/24 dns-server=ISP2_DNS1,ISP2_DNS2 gateway=\
192.168.2.1
/ip dns
set allow-remote-requests=yes servers=\
ISP1_DNS1,ISP1_DNS2,ISP2_DNS1,ISP2_DNS2
/ip firewall address-list
add address=192.168.2.11-192.168.2.254 list=LIST1_students
add address=192.168.1.100-192.168.1.254 list=LIST2_office
add address=192.168.1.6 list=LIST_SRV
/ip firewall filter
add action=accept chain=input comment="accept establish and related" \
connection-state=established,related
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=add-src-to-address-list address-list=winbox_remote \
address-list-timeout=<some_number> chain=input comment="icmp port knocking" \
in-interface-list=ISPs packet-size=<some_number> protocol=icmp
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=drop chain=input comment="drop all not from LAN" \
in-interface-list=!All_local
add action=accept chain=forward comment="accept established, related" \
connection-state=established,related
add action=accept chain=input comment="accept winbox fro white-list" \
dst-port=<some_number> in-interface-list=ISPs protocol=tcp src-address-list=\
winbox_remote
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN to LAN" \
connection-nat-state=!dstnat connection-state=new in-interface-list=ISPs
add action=add-src-to-address-list address-list=torrent-con \
address-list-timeout=2m chain=forward comment="Add to bit list" \
layer7-protocol=Torrents src-address=192.168.2.0/24 src-address-list=\
!allow-bit
add action=drop chain=forward comment="drop torrents tcp" dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=tcp \
src-address-list=torrent-con
add action=drop chain=forward comment="drop torrents udp" dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=udp \
src-address-list=torrent-con
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address=IP_ISP1 dst-port=\
80,443 new-connection-mark=<mark_name> passthrough=no protocol=tcp \
src-address=192.168.0.0/22
add action=mark-routing chain=prerouting dst-address=192.168.0.0/22 \
new-routing-mark=main passthrough=no
add action=mark-routing chain=prerouting new-routing-mark=domru passthrough=\
no src-address-list=LIST1_students
add action=mark-routing chain=prerouting new-routing-mark=smart passthrough=\
no src-address-list=LIST2_office
add action=mark-routing chain=prerouting new-routing-mark=domru passthrough=\
no src-address-list=LIST_SRV
/ip firewall nat
add action=dst-nat chain=dstnat comment="WAN => LAN (web server)" dst-port=\
10000 in-interface-list=ISPs protocol=tcp to-addresses=192.168.1.6 \
to-ports=10000
add action=dst-nat chain=dstnat dst-port=10000 in-interface-list=ISPs \
protocol=udp to-addresses=192.168.1.6 to-ports=10000
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=ISPs protocol=\
tcp to-addresses=192.168.1.6 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=ISPs protocol=\
udp to-addresses=192.168.1.6 to-ports=53
add action=dst-nat chain=dstnat dst-port=20,21 in-interface-list=ISPs \
protocol=tcp to-addresses=192.168.1.6
add action=dst-nat chain=dstnat comment="Hairpin NAT" dst-address=IP_ISP1 \
dst-port=80,443 protocol=tcp to-addresses=192.168.1.6 to-ports=443
add action=masquerade chain=srcnat out-interface-list=ISPs
add action=masquerade chain=srcnat connection-mark=<mark_name>
add action=dst-nat chain=dstnat comment="HTTP & HTTPS" dst-port=80,443 \
in-interface-list=ISPs protocol=tcp to-addresses=192.168.1.6
add action=dst-nat chain=dstnat dst-port=80,443 in-interface-list=ISPs \
protocol=udp to-addresses=192.168.1.6
add action=src-nat chain=srcnat comment="Internet for students" \
out-interface=ether1 to-addresses=IP_ISP1
add action=src-nat chain=srcnat comment="Internet for office" log=yes \
out-interface=ether2 to-addresses=IP_ISP2
/ip route
add distance=1 gateway=GATEWAY_ISP1 routing-mark=domru
add distance=1 gateway=GATEWAY_ISP2 routing-mark=smart
add distance=10 gateway=GATEWAY_ISP2
add distance=20 gateway=GATEWAY_ISP1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=<some_number>
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=192.33.214.47 secondary-ntp=193.227.197.2
/system package update
set channel=upgrade
# software id = XXXX-XXXX
#
# model = RouterBOARD 3011UiAS
# serial number = XXXXXXXXX
/interface bridge
add admin-mac=C4:AD:34:2F:28:05 auto-mac=no name=Office_bridge
add admin-mac=C4:AD:34:2F:28:01 auto-mac=no name=Students_bridge
/interface ethernet
set [ find default-name=ether1 ] comment="ISP1 (DOMRU)" mac-address=\
MAC_ISP1
set [ find default-name=ether2 ] comment="ISP2 (SMART)" mac-address=\
MAC_ISP2
set [ find default-name=ether3 ] comment="SRV"
/interface list
add comment="Contains all internet ports" name=ISPs
add comment="All students local hosts" name=Students_local
add comment="All office local hosts" name=Office_local
add name=All_local
add comment="For winbox" name=Console
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip firewall layer7-protocol
add name=Torrents regexp="^(\\x13bittorrent protocol|azver\\x01\$|get /scrape\
\\\?info_hash=get /announce\\\?info_hash=|get /client/bitcomet/|GET /data\
\\\?fid=)|d1:ad2:id20:|\\x08'7P\\)[RP]"
/ip pool
add name=office_pool ranges=192.168.1.100-192.168.1.254
add name=student_pool ranges=192.168.2.11-192.168.2.254
/ip dhcp-server
add address-pool=office_pool disabled=no interface=Office_bridge lease-time=\
12h name=office_dhcp
add address-pool=student_pool disabled=no interface=Students_bridge \
lease-time=12h name=students_dhcp
/interface bridge port
add bridge=Students_bridge interface=ether4
add bridge=Students_bridge interface=ether5
add bridge=Students_bridge interface=ether6
add bridge=Office_bridge interface=ether8
add bridge=Office_bridge interface=ether9
add bridge=Office_bridge interface=ether3
add bridge=Students_bridge interface=ether10
add bridge=Office_bridge interface=ether7
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether1 list=ISPs
add interface=ether2 list=ISPs
add interface=ether7 list=Office_local
add interface=ether8 list=Office_local
add interface=ether9 list=Office_local
add interface=ether4 list=Students_local
add interface=ether5 list=Students_local
add interface=ether6 list=Students_local
add interface=ether4 list=All_local
add interface=ether5 list=All_local
add interface=ether6 list=All_local
add interface=ether7 list=All_local
add interface=ether8 list=All_local
add interface=ether9 list=All_local
add interface=ether10 list=All_local
/ip address
add address=IP_ISP1/24 interface=ether1 network=NETWORK_ISP1
add address=IP_ISP2/30 interface=ether2 network=NETWORK_ISP2
add address=192.168.1.1/24 interface=Office_bridge network=192.168.1.0
add address=192.168.2.1/24 interface=Students_bridge network=192.168.2.0
add address=192.168.1.2/24 disabled=yes interface=ether3 network=192.168.1.0
/ip dhcp-server lease
add address=192.168.2.13 client-id=1:4:bf:6d:3:80:80 mac-address=\
04:BF:6D:03:80:80 server=students_dhcp
add address=192.168.2.11 client-id=1:MAC_ISP1 mac-address=\
MAC_ISP1 server=students_dhcp
add address=192.168.2.12 client-id=1:50:ff:20:58:f:a5 mac-address=\
50:FF:20:58:0F:A5 server=students_dhcp
add address=192.168.1.115 client-id=1:0:25:36:86:f6:c8 mac-address=\
00:25:36:86:F6:C8 server=office_dhcp
add address=192.168.1.116 client-id=1:0:80:87:62:ff:d3 mac-address=\
00:80:87:62:FF:D3 server=office_dhcp
add address=192.168.1.117 client-id=1:0:25:36:ee:27:11 mac-address=\
00:25:36:EE:27:11 server=office_dhcp
add address=192.168.1.119 client-id=1:0:25:36:fe:13:11 mac-address=\
00:25:36:FE:13:11 server=office_dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=ISP1_DNS1,ISP1_DNS2 gateway=\
192.168.1.1
add address=192.168.2.0/24 dns-server=ISP2_DNS1,ISP2_DNS2 gateway=\
192.168.2.1
/ip dns
set allow-remote-requests=yes servers=\
ISP1_DNS1,ISP1_DNS2,ISP2_DNS1,ISP2_DNS2
/ip firewall address-list
add address=192.168.2.11-192.168.2.254 list=LIST1_students
add address=192.168.1.100-192.168.1.254 list=LIST2_office
add address=192.168.1.6 list=LIST_SRV
/ip firewall filter
add action=accept chain=input comment="accept establish and related" \
connection-state=established,related
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=add-src-to-address-list address-list=winbox_remote \
address-list-timeout=<some_number> chain=input comment="icmp port knocking" \
in-interface-list=ISPs packet-size=<some_number> protocol=icmp
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=drop chain=input comment="drop all not from LAN" \
in-interface-list=!All_local
add action=accept chain=forward comment="accept established, related" \
connection-state=established,related
add action=accept chain=input comment="accept winbox fro white-list" \
dst-port=<some_number> in-interface-list=ISPs protocol=tcp src-address-list=\
winbox_remote
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=drop chain=forward comment="drop all from WAN to LAN" \
connection-nat-state=!dstnat connection-state=new in-interface-list=ISPs
add action=add-src-to-address-list address-list=torrent-con \
address-list-timeout=2m chain=forward comment="Add to bit list" \
layer7-protocol=Torrents src-address=192.168.2.0/24 src-address-list=\
!allow-bit
add action=drop chain=forward comment="drop torrents tcp" dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=tcp \
src-address-list=torrent-con
add action=drop chain=forward comment="drop torrents udp" dst-port=\
!0-1024,8291,5900,5800,3389,14147,5222,59905 protocol=udp \
src-address-list=torrent-con
/ip firewall mangle
add action=mark-connection chain=prerouting dst-address=IP_ISP1 dst-port=\
80,443 new-connection-mark=<mark_name> passthrough=no protocol=tcp \
src-address=192.168.0.0/22
add action=mark-routing chain=prerouting dst-address=192.168.0.0/22 \
new-routing-mark=main passthrough=no
add action=mark-routing chain=prerouting new-routing-mark=domru passthrough=\
no src-address-list=LIST1_students
add action=mark-routing chain=prerouting new-routing-mark=smart passthrough=\
no src-address-list=LIST2_office
add action=mark-routing chain=prerouting new-routing-mark=domru passthrough=\
no src-address-list=LIST_SRV
/ip firewall nat
add action=dst-nat chain=dstnat comment="WAN => LAN (web server)" dst-port=\
10000 in-interface-list=ISPs protocol=tcp to-addresses=192.168.1.6 \
to-ports=10000
add action=dst-nat chain=dstnat dst-port=10000 in-interface-list=ISPs \
protocol=udp to-addresses=192.168.1.6 to-ports=10000
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=ISPs protocol=\
tcp to-addresses=192.168.1.6 to-ports=53
add action=dst-nat chain=dstnat dst-port=53 in-interface-list=ISPs protocol=\
udp to-addresses=192.168.1.6 to-ports=53
add action=dst-nat chain=dstnat dst-port=20,21 in-interface-list=ISPs \
protocol=tcp to-addresses=192.168.1.6
add action=dst-nat chain=dstnat comment="Hairpin NAT" dst-address=IP_ISP1 \
dst-port=80,443 protocol=tcp to-addresses=192.168.1.6 to-ports=443
add action=masquerade chain=srcnat out-interface-list=ISPs
add action=masquerade chain=srcnat connection-mark=<mark_name>
add action=dst-nat chain=dstnat comment="HTTP & HTTPS" dst-port=80,443 \
in-interface-list=ISPs protocol=tcp to-addresses=192.168.1.6
add action=dst-nat chain=dstnat dst-port=80,443 in-interface-list=ISPs \
protocol=udp to-addresses=192.168.1.6
add action=src-nat chain=srcnat comment="Internet for students" \
out-interface=ether1 to-addresses=IP_ISP1
add action=src-nat chain=srcnat comment="Internet for office" log=yes \
out-interface=ether2 to-addresses=IP_ISP2
/ip route
add distance=1 gateway=GATEWAY_ISP1 routing-mark=domru
add distance=1 gateway=GATEWAY_ISP2 routing-mark=smart
add distance=10 gateway=GATEWAY_ISP2
add distance=20 gateway=GATEWAY_ISP1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh port=<some_number>
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=192.33.214.47 secondary-ntp=193.227.197.2
/system package update
set channel=upgrade
... то ли мало исходных данных я приложил (хотя куда еще больше, ведь полный конфиг выложил), либо вопрос совсем глупый, но даже если так, хотелось бы услышать хоть что-то.
