1. Есть белый ІР. На микротик настроена локалка + вай-фай + гостевая точка доступа. К роутеру подключаються двухдиапазонные точки доступа (2,4 и 5 ГГц). Для них создана своя, отдельная конфигурация. На одной точке работает только конфигурация для 5ГГц+вай-фай микротика и гостевой вай-фай. На другой - конфигурация для точки доступа 2,4ГГц. На 5ГГц не работает. В чем дело - не пойму
2. Пробрасываю порты для видеокамер, проверяю на 2ip.ru. Все открыты - один(443) не открывается. Посмотрите, пожалуйста, может что не так
3.И, если это не затруднительно, проверте конфигурацию на безопасность.
Работаю с микротик впервые, поэтому вопросов - куча.
Спасибо за помощь.
# model = 2011UiAS-2HnD
# serial number = 7A6608CCB08D
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2412 name=channel1 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2422 name=channel3 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2437 name=channel6 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2462 name=channel11 tx-power=20
add band=5ghz-a/n/ac control-channel-width=20mhz extension-channel=Ce frequency=5180 name=channel5G tx-power=20
/caps-man datapath
add local-forwarding=yes name=datapath_ceh5
add local-forwarding=yes name=datapath_ceh
/interface bridge
add fast-forward=no name=bridge_free
add name=bridge_main
/interface wireless
# managed by CAPsMAN
# channel: 2412/20-Ce/gn(20dBm), SSID: LM, CAPsMAN forwarding
set [ find default-name=wlan1 ] mode=ap-bridge ssid=LUM wireless-protocol=802.11
/caps-man interface
add disabled=no l2mtu=1600 mac-address=00:00:E0:00:00:00 master-interface=none name=cap7 radio-mac=00:00:00:00:00:00
/caps-man datapath
add bridge=bridge_main client-to-client-forwarding=yes name=datapath_off
add bridge=bridge_free name=datapath_free
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm name=security_off passphrase=123456789
add name=security_free
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm name=security_ceh passphrase=123456789
/caps-man configuration
add channel=channel1 datapath=datapath_off mode=ap name=cfg_off rx-chains=0,1,2 security=security_off ssid=LM tx-chains=0,1,2
add channel=channel3 datapath=datapath_free mode=ap name=cfg_free rx-chains=0,1,2 security=security_free ssid=Free tx-chains=0,1,2
add channel=channel6 datapath=datapath_ceh datapath.local-forwarding=yes mode=ap name=cfg_ceh rx-chains=0,1,2 security=security_ceh ssid=butcher tx-chains=0,1,2
add channel=channel5G datapath=datapath_ceh5 datapath.local-forwarding=yes mode=ap name=cfg_ceh5 rx-chains=0,1,2 security=security_ceh ssid=butcher tx-chains=0,1,2
/caps-man interface
add channel=channel6 configuration=cfg_ceh datapath=datapath_ceh disabled=no l2mtu=1600 mac-address=00:00:00:00:00:00 master-interface=none name=cap5 radio-mac=\
00:00:00:00:00:00 security=security_ceh
add configuration=cfg_ceh configuration.mode=ap configuration.rx-chains=0,1,2 configuration.ssid=butcher configuration.tx-chains=0,1,2 disabled=no l2mtu=1600 mac-address=\
00:00:00:00:00:00 master-interface=none name=cap11 radio-mac=00:00:00:00:00:00
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.123.100-192.168.123.199
add name=dhcp_pool1 ranges=100.100.100.2-100.100.100.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge_main name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=bridge_free name=dhcp2
/queue type
add kind=pcq name=pcq-download-2M pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=2M pcq-src-address6-mask=64
add kind=pcq name=pcq-upload-2M pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=2M pcq-src-address6-mask=64
/queue simple
add max-limit=18M/18M name=queue-free-limit-2M queue=pcq-upload-2M/pcq-download-2M target=192.168.123.0/24
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=b,gn master-configuration=cfg_off slave-configurations=cfg_free
add action=create-dynamic-enabled comment="\D1\C0\D05 WLAN2\C3\C3\F6" hw-supported-modes=gn master-configuration=cfg_ceh
add action=create-dynamic-enabled comment="CAP5 5\C3\C3\F6" hw-supported-modes=an,ac master-configuration=cfg_ceh5
/interface bridge port
add bridge=bridge_main interface=ether2
add bridge=bridge_main interface=ether3
add bridge=bridge_main interface=ether4
add bridge=bridge_main interface=ether5
add bridge=bridge_main interface=ether6
add bridge=bridge_main interface=ether7
add bridge=bridge_main interface=ether8
add bridge=bridge_main interface=ether9
add bridge=bridge_main interface=ether10
/interface list member
add interface=ether1 list=WAN
add interface=bridge_main list=LAN
/interface wireless cap
#
set discovery-interfaces=bridge_main enabled=yes interfaces=wlan1
/ip address
add address=192.000.000.000/24 interface=ether1 network=192.000.000.000
add address=192.000.000.1/24 interface=ether2 network=192.000.000.000
add address=100.100.100.1/24 interface=bridge_free network=100.100.100.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=100.100.100.0/24 dns-server=192.000.000.2,8.8.8.8 gateway=100.100.100.1
add address=192.000.000.0/24 gateway=192.000.000.1 netmask=24
/ip dns
set servers=192.000.000.000
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related src-address=192.000.000.0/24
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=netmap chain=dstnat dst-port=8822 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
add action=dst-nat chain=dstnat dst-port=82 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154 to-ports=8822
add action=dst-nat chain=dstnat dst-port=8381 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175 to-ports=8781
add action=dst-nat chain=dstnat dst-port=8781 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=masquerade chain=srcnat dst-address=192.168.123.0/24 src-address=192.168.123.0/24
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=dst-nat chain=dstnat dst-port=1025 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=netmap chain=dstnat dst-port=554 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
/ip route
add distance=1 gateway=192.000.000.000
/ip route rule
add action=drop dst-address=100.100.100.0/24 src-address=192.000.000.0/24
add action=drop dst-address=192.000.000.0/24 src-address=100.100.100.0/24
/system clock
set time-zone-name=none
/system identity
set name=master
/system routerboard settings
set silent-boot=no
[admin@admin] >
# serial number = 7A6608CCB08D
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2412 name=channel1 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2422 name=channel3 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2437 name=channel6 tx-power=20
add band=2ghz-b/g/n control-channel-width=20mhz extension-channel=Ce frequency=2462 name=channel11 tx-power=20
add band=5ghz-a/n/ac control-channel-width=20mhz extension-channel=Ce frequency=5180 name=channel5G tx-power=20
/caps-man datapath
add local-forwarding=yes name=datapath_ceh5
add local-forwarding=yes name=datapath_ceh
/interface bridge
add fast-forward=no name=bridge_free
add name=bridge_main
/interface wireless
# managed by CAPsMAN
# channel: 2412/20-Ce/gn(20dBm), SSID: LM, CAPsMAN forwarding
set [ find default-name=wlan1 ] mode=ap-bridge ssid=LUM wireless-protocol=802.11
/caps-man interface
add disabled=no l2mtu=1600 mac-address=00:00:E0:00:00:00 master-interface=none name=cap7 radio-mac=00:00:00:00:00:00
/caps-man datapath
add bridge=bridge_main client-to-client-forwarding=yes name=datapath_off
add bridge=bridge_free name=datapath_free
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm name=security_off passphrase=123456789
add name=security_free
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm name=security_ceh passphrase=123456789
/caps-man configuration
add channel=channel1 datapath=datapath_off mode=ap name=cfg_off rx-chains=0,1,2 security=security_off ssid=LM tx-chains=0,1,2
add channel=channel3 datapath=datapath_free mode=ap name=cfg_free rx-chains=0,1,2 security=security_free ssid=Free tx-chains=0,1,2
add channel=channel6 datapath=datapath_ceh datapath.local-forwarding=yes mode=ap name=cfg_ceh rx-chains=0,1,2 security=security_ceh ssid=butcher tx-chains=0,1,2
add channel=channel5G datapath=datapath_ceh5 datapath.local-forwarding=yes mode=ap name=cfg_ceh5 rx-chains=0,1,2 security=security_ceh ssid=butcher tx-chains=0,1,2
/caps-man interface
add channel=channel6 configuration=cfg_ceh datapath=datapath_ceh disabled=no l2mtu=1600 mac-address=00:00:00:00:00:00 master-interface=none name=cap5 radio-mac=\
00:00:00:00:00:00 security=security_ceh
add configuration=cfg_ceh configuration.mode=ap configuration.rx-chains=0,1,2 configuration.ssid=butcher configuration.tx-chains=0,1,2 disabled=no l2mtu=1600 mac-address=\
00:00:00:00:00:00 master-interface=none name=cap11 radio-mac=00:00:00:00:00:00
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.123.100-192.168.123.199
add name=dhcp_pool1 ranges=100.100.100.2-100.100.100.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge_main name=dhcp1
add address-pool=dhcp_pool1 disabled=no interface=bridge_free name=dhcp2
/queue type
add kind=pcq name=pcq-download-2M pcq-classifier=dst-address pcq-dst-address6-mask=64 pcq-rate=2M pcq-src-address6-mask=64
add kind=pcq name=pcq-upload-2M pcq-classifier=src-address pcq-dst-address6-mask=64 pcq-rate=2M pcq-src-address6-mask=64
/queue simple
add max-limit=18M/18M name=queue-free-limit-2M queue=pcq-upload-2M/pcq-download-2M target=192.168.123.0/24
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled hw-supported-modes=b,gn master-configuration=cfg_off slave-configurations=cfg_free
add action=create-dynamic-enabled comment="\D1\C0\D05 WLAN2\C3\C3\F6" hw-supported-modes=gn master-configuration=cfg_ceh
add action=create-dynamic-enabled comment="CAP5 5\C3\C3\F6" hw-supported-modes=an,ac master-configuration=cfg_ceh5
/interface bridge port
add bridge=bridge_main interface=ether2
add bridge=bridge_main interface=ether3
add bridge=bridge_main interface=ether4
add bridge=bridge_main interface=ether5
add bridge=bridge_main interface=ether6
add bridge=bridge_main interface=ether7
add bridge=bridge_main interface=ether8
add bridge=bridge_main interface=ether9
add bridge=bridge_main interface=ether10
/interface list member
add interface=ether1 list=WAN
add interface=bridge_main list=LAN
/interface wireless cap
#
set discovery-interfaces=bridge_main enabled=yes interfaces=wlan1
/ip address
add address=192.000.000.000/24 interface=ether1 network=192.000.000.000
add address=192.000.000.1/24 interface=ether2 network=192.000.000.000
add address=100.100.100.1/24 interface=bridge_free network=100.100.100.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=100.100.100.0/24 dns-server=192.000.000.2,8.8.8.8 gateway=100.100.100.1
add address=192.000.000.0/24 gateway=192.000.000.1 netmask=24
/ip dns
set servers=192.000.000.000
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=established,related src-address=192.000.000.0/24
add action=accept chain=input protocol=icmp
add action=accept chain=input connection-state=established
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
add action=netmap chain=dstnat dst-port=8822 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
add action=dst-nat chain=dstnat dst-port=82 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154 to-ports=8822
add action=dst-nat chain=dstnat dst-port=8381 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175 to-ports=8781
add action=dst-nat chain=dstnat dst-port=8781 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=masquerade chain=srcnat dst-address=192.168.123.0/24 src-address=192.168.123.0/24
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
add action=dst-nat chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=dst-nat chain=dstnat dst-port=1025 in-interface=ether1 protocol=tcp to-addresses=192.168.123.175
add action=netmap chain=dstnat dst-port=554 in-interface=ether1 protocol=tcp to-addresses=192.168.123.154
/ip route
add distance=1 gateway=192.000.000.000
/ip route rule
add action=drop dst-address=100.100.100.0/24 src-address=192.000.000.0/24
add action=drop dst-address=192.000.000.0/24 src-address=100.100.100.0/24
/system clock
set time-zone-name=none
/system identity
set name=master
/system routerboard settings
set silent-boot=no
[admin@admin] >
