Обращаюсь к вам за помощью.
Есть у меня NAS Synology, Smart TV Sony и TV – приставка на андроид Ugoos AM3. Настраивал я свой NAS Synology DS218Play и приставку Ugoos AM3 не дома и использовал корпоративный роутер MikroTik hAP (RB951). Вот его конфигурация:
Код: Выделить всё
# dec/02/2016 19:58:31 by RouterOS 6.37.3
# software id = XI1F-23B6
#
/interface bridge
add name=bridge protocol-mode=none
/interface ethernet
set [ find default-name=ether2 ] master-port=ether1
set [ find default-name=ether3 ] master-port=ether1
set [ find default-name=ether4 ] master-port=ether1
set [ find default-name=ether5 ] master-port=ether1
/ip neighbor discovery
set ether2 discover=no
set ether3 discover=no
set ether4 discover=no
set ether5 discover=no
set bridge discover=no
/interface wireless security-profiles
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=SWSPG02 \
supplicant-identity="" wpa-pre-shared-key=5a94e608ec wpa2-pre-shared-key=\
5a94e608ec
/interface wireless
set [ find default-name=wlan1 ] disabled=no mode=ap-bridge name=SWSPG02 \
security-profile=SWSPG02 ssid=SWSPG02
/ip neighbor discovery
set SWSPG02 discover=no
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/ip pool
add name=portovaya ranges=10.10.146.10-10.10.146.30
/ip dhcp-server
add address-pool=portovaya disabled=no interface=bridge name=portovaya
/port
set 0 name=usb1
/interface ppp-client
add apn=internet.mts.ru dial-on-demand=no disabled=no info-channel=1 name=\
usb-mts password=mts phone=*99# port=usb1 user=mts
/ip neighbor discovery
set usb-mts discover=no
/snmp community
add addresses=0.0.0.0/0 name=mordor
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge interface=SWSPG02
/ip address
add address=10.10.146.62/26 interface=ether1 network=10.10.146.0
/ip dhcp-server network
add address=10.10.146.0/26 dns-server=8.8.8.8 gateway=10.10.146.62 netmask=26
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input comment="Port scanners to list " \
in-interface=usb-mts protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="dropping port scanners" \
src-address-list="port scanners"
add action=accept chain=input comment="accept ICMP" protocol=icmp
add chain=input comment="Allow DNS from brigde" dst-port=53 in-interface=\
!usb-mts protocol=udp
add chain=input comment="Allow DNS answers" in-interface=usb-mts protocol=udp \
src-port=53
add action=accept chain=forward comment="accept established,related" \
connection-state=established,related
add action=accept chain=forward comment="Accept from local to internet" \
in-interface=!usb-mts out-interface=usb-mts
add action=drop chain=input comment="Drop invalid connections" \
connection-state=invalid
add action=drop chain=forward connection-state=invalid
add action=drop chain=input in-interface=usb-mts
add action=accept chain=forward comment="Accept from local to internet" \
in-interface=!usb-mts out-interface=usb-mts
add action=drop chain=forward comment="Drop all other forward" log-prefix=\
dropall
/ip firewall nat
add action=masquerade chain=srcnat out-interface=usb-mts src-address=\
10.10.146.0/26
/ip route
add check-gateway=ping distance=1 gateway=usb-mts
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh address=10.10.146.0/26
set api disabled=yes
set winbox address=10.10.146.0/26
set api-ssl disabled=yes
/snmp
set trap-community=mordor
/system clock
set time-zone-name=Europe/Moscow
/system ntp client
set enabled=yes primary-ntp=85.114.26.194 secondary-ntp=85.21.78.8
/system routerboard settings
set cpu-frequency=650MHz init-delay=0s protected-routerboot=disabledКод: Выделить всё
# jun/04/2019 12:49:30 by RouterOS 6.44.3
# software id = 6RX7-Q1EM
#
# model = RB4011iGS+5HacQ2HnD
# serial number = XXXXXXXXXXX
/interface bridge
add admin-mac=XXXXXXXXXXXX auto-mac=no comment=defconf name=bridge
/interface wireless
set [ find default-name=wlan1 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX disabled=no mode=ap-bridge ssid=MikroTik-39-5GHz \
wireless-protocol=802.11
set [ find default-name=wlan2 ] band=2ghz-g/n basic-rates-b="" channel-width=\
20/40mhz-XX disabled=no distance=indoors frequency=auto mode=ap-bridge \
rate-set=configured ssid=MikroTik-39-2GHz supported-rates-b="" \
wireless-protocol=802.11
/interface ethernet
set [ find default-name=ether1 ] name=ether1-WAN
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes comment="MTC - Connection" disabled=no interface=\
ether1-WAN name=pppoe-out1 password=XXXXXXX use-peer-dns=yes user=\
XXXXXXXXXXXX
/interface ethernet switch port
set 0 default-vlan-id=0
set 1 default-vlan-id=0
set 2 default-vlan-id=0
set 3 default-vlan-id=0
set 4 default-vlan-id=0
set 5 default-vlan-id=0
set 6 default-vlan-id=0
set 7 default-vlan-id=0
set 8 default-vlan-id=0
set 9 default-vlan-id=0
set 10 default-vlan-id=0
set 11 default-vlan-id=0
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
group-ciphers=tkip,aes-ccm mode=dynamic-keys supplicant-identity=MikroTik \
unicast-ciphers=tkip,aes-ccm wpa-pre-shared-key=Val20Nik23 \
wpa2-pre-shared-key=XXXXXXXX
/ip pool
add name=dhcp ranges=192.168.88.2-192.168.88.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=wlan1
add bridge=bridge comment=defconf interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment="MTS-Internet Incomer" interface=ether1-WAN list=WAN
add interface=pppoe-out1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=ether2 network=\
192.168.88.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1-WAN
/ip dhcp-server lease
add address=192.168.88.8 client-id=1:78:24:af:c9:92:d8 comment=\
"Maxim's LapTop" mac-address=78:24:AF:C9:92:D8 server=defconf
add address=192.168.88.2 client-id=1:0:11:32:8e:22:42 comment="NAS DS218Play" \
mac-address=00:11:32:8E:22:42 server=defconf
add address=192.168.88.5 client-id=1:cc:98:8b:5:1:e comment="SONY TV" \
mac-address=CC:98:8B:05:01:0E server=defconf
add address=192.168.88.4 client-id=1:20:18:e:e7:63:51 comment=\
"UGOOS AM3 TV Box" mac-address=20:18:0E:E7:63:51 server=defconf
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes servers=\
8.8.8.8,8.8.4.4,77.88.8.8,77.88.8.1,82.200.69.80,84.200.70.40
/ip dns static
add address=192.168.88.1 name=router.lan
/ip firewall filter
add action=fasttrack-connection chain=forward comment=\
"0,1 fasttrack --------------------------------------- (defconf)" \
connection-state=established,related
add action=accept chain=forward comment=\
"1.1 Forward and Input Established and Related connections" \
connection-state=established,related
add action=accept chain=forward comment=\
"1.1.1 Accept established,related, untracked ---(defconf)" \
connection-state=established,related,untracked
add action=drop chain=forward comment=\
"1.2 --------- drop invalid ------------------ (defconf)" \
connection-state=invalid
add action=accept chain=input comment=\
"1.3 --------- accept established,related" connection-state=\
established,related
add action=accept chain=input comment=\
"1.4 --------- accept established,related,untracked --- (defconf)" \
connection-state=established,related,untracked
add action=drop chain=input comment=\
"1.5 --------- drop invalid ------------------ (defconf)" \
connection-state=invalid
add action=drop chain=forward comment=\
"2.1 drop all from WAN not DSTNATed ----- (defconf)" \
connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
add action=add-src-to-address-list address-list=ddos-blacklist \
address-list-timeout=1d chain=input comment="3.1 DDoS attack filter" \
connection-limit=100,32 in-interface-list=WAN protocol=tcp
add action=tarpit chain=input comment="3.2 --------- end of DDoS" \
connection-limit=3,32 protocol=tcp src-address-list=ddos-blacklist
add action=jump chain=forward comment="4.1 DDoS Protect - SYN Flood" \
connection-state=new jump-target=SYN-Protect protocol=tcp tcp-flags=syn
add action=jump chain=input comment="4.2 --------- --------- SYN Flood" \
connection-state=new in-interface-list=WAN jump-target=SYN-Protect \
protocol=tcp tcp-flags=syn
add action=return chain=SYN-Protect comment=\
"4.3 --------- --------- SYN Flood" connection-state=new limit=\
200,5:packet protocol=tcp tcp-flags=syn
add action=drop chain=SYN-Protect comment=\
"4.4 --------- end of SYN Flood" connection-state=new protocol=tcp \
tcp-flags=syn
add action=drop chain=input comment="5.1 PSD \96 Port Scan Detection" \
src-address-list="Port Scanners"
add action=add-src-to-address-list address-list="Port Scanners" \
address-list-timeout=none-dynamic chain=input comment=\
"5.2 --------- PSD" in-interface-list=WAN protocol=tcp psd=21,3s,3,1
add action=drop chain=input comment="6.1 WinBox Port LockOut protection" \
src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List WinBox" \
address-list-timeout=none-dynamic chain=input comment=\
"6.2 --------- --------- WinBox Protection" connection-state=new \
dst-port=8291 in-interface-list=WAN log=yes log-prefix="BLACK WINBOX" \
protocol=tcp src-address-list="WinBox Stage 3"
add action=add-src-to-address-list address-list="WinBox Stage 3" \
address-list-timeout=1m chain=input comment=\
"6.3 --------- --------- WinBox Protection" connection-state=new \
dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 2"
add action=add-src-to-address-list address-list="WinBox Stage 2" \
address-list-timeout=1m chain=input comment=\
"6.4 --------- --------- WinBox Protection" connection-state=new \
dst-port=8291 in-interface-list=WAN protocol=tcp src-address-list=\
"WinBox Stage 1"
add action=add-src-to-address-list address-list="WinBox Stage 1" \
address-list-timeout=1m chain=input comment=\
"6.5 --------- --------- WinBox Protection" connection-state=new \
dst-port=8291 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"6.6 --------- end of WinBox Protection" dst-port=8291 \
in-interface-list=WAN protocol=tcp
add action=drop chain=input comment="7.1 OpenVPN Port Connections protection" \
src-address-list="Black List OpenVPN"
add action=add-src-to-address-list address-list="Black List OpenVPN" \
address-list-timeout=none-dynamic chain=input comment=\
"7.2 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN log=yes log-prefix="BLACK OVPN" \
protocol=tcp src-address-list="OpenVPN Stage 3"
add action=add-src-to-address-list address-list="OpenVPN Stage 3" \
address-list-timeout=1m chain=input comment=\
"7.3 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 2"
add action=add-src-to-address-list address-list="OpenVPN Stage 2" \
address-list-timeout=1m chain=input comment=\
"7.4 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp src-address-list=\
"OpenVPN Stage 1"
add action=add-src-to-address-list address-list="OpenVPN Stage 1" \
address-list-timeout=1m chain=input comment=\
"7.5 --------- --------- OpenVPN Protection" connection-state=new \
dst-port=1194 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"7.6 --------- end of OpenVPN Protection" dst-port=1194 \
in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
"Accept ICMP ------------------------------ (defconf)" protocol=icmp
add action=accept chain=input comment="Accept ICMP --- With correct ping" \
in-interface-list=WAN limit=50/5s,2:packet protocol=icmp
add action=drop chain=input comment=\
"Drop all not coming from LAN ---- (defconf)" in-interface-list=!LAN
add action=accept chain=forward comment=\
"Accept in ipsec policy -------------- (defconf)" ipsec-policy=in,ipsec
add action=accept chain=forward comment=\
"Accept out ipsec policy ------------ (defconf)" ipsec-policy=out,ipsec
/ip firewall nat
add action=masquerade chain=srcnat comment="masquerade ------- (defconf)" \
disabled=yes ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment=Masquerade ipsec-policy=out,none \
out-interface-list=WAN src-address=192.168.88.0/24
add action=netmap chain=dstnat comment="FTP, FTP SSL, FTP" dst-port=20 in-interface=\
ether1-WAN protocol=tcp to-addresses=192.168.88.2 to-ports=20
add action=netmap chain=dstnat comment="FTP, FTP SSL, FTP TLS" dst-port=21 in-interface=\
ether1-WAN protocol=tcp to-addresses=192.168.88.2 to-ports=21
add action=netmap chain=dstnat comment="Photo Station, Web Station, DS photo, Mail Station (HTTP)" dst-port=80 in-interface=\
ether1-WAN protocol=tcp to-addresses=192.168.88.2 to-ports=80
add action=netmap chain=dstnat comment=\
"Photo Station, Web Station, DS photo, Mail Station, (HTTPS)" dst-port=\
443 in-interface=ether1-WAN protocol=tcp to-addresses=192.168.88.2 \
to-ports=443
add action=netmap chain=dstnat comment="rsync" \
dst-port=873 in-interface=ether1-WAN protocol=tcp to-addresses=\
192.168.88.2 to-ports=873
add action=netmap chain=dstnat comment="Audio Station, (UDP), Video Station" \
dst-port=1900 in-interface=ether1-WAN protocol=udp to-addresses=\
192.168.88.2 to-ports=1900
add action=netmap chain=dstnat comment="DSM (HTTP), File Station, Audio Statio (CMS), Download Station, Drive, Video Station, DS audio, DS cam, DS down\
load, DS file, DS finder, DS note, DS video, Moments" dst-port=5000 \
in-interface=ether1-WAN protocol=tcp to-addresses=192.168.88.2 to-ports=\
5000
add action=netmap chain=dstnat comment="DSM (HTTPS), File Station, Audio Stati (CMS), Drive, Video Station, DS audio, DS cam, DS download, DS file, DS \
finder, DS note, DS video, Moments" dst-port=5001 in-interface=ether1-WAN \
protocol=tcp to-addresses=192.168.88.2 to-ports=5001
add action=netmap chain=dstnat comment=\
"Audio Station, (Bonjour)" dst-port=5353 in-interface=ether1-WAN protocol=tcp \
to-addresses=192.168.88.2 to-ports=5353
add action=netmap chain=dstnat comment="Cloud Station, Drive, DS cloud" \
dst-port=6690 in-interface=ether1-WAN protocol=tcp to-addresses=\
192.168.88.2 to-ports=6690
add action=netmap chain=dstnat comment="Synology Assistant" dst-port=\
9997-9999 in-interface=ether1-WAN protocol=udp to-addresses=192.168.88.2 \
to-ports=9997-9999
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=pppoe-out1 type=external
add interface=ether2 type=internal
add interface=ether4 type=internal
add interface=ether3 type=internal
add interface=ether5 type=internal
add interface=ether6 type=internal
/system clock
set time-zone-name=Europe/Volgograd
/system clock manual
set time-zone=+03:00
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
Может быть, причина в настройке /ip neighbor discovery?
Помогите, пожалуйста!
