Имеется hap ac2 в порт Eth1(WAN) воткнут PON переходник C-DATA ONU FD511G-X.
На ONUшке настроен бридж и DHCP выкл. PPPoE поднят на микроте.
Домашняя сеть 192.168.1.0, адрес в настройках ONU 192.168.101.1
Проблема в том, что не могу зайти на веб морду ONU....пинг с WinBox и с компа до 192.168.101.1 идёт, но доступа почему-то нет....правило маскарада не работает....пакеты не идут...
Мои настройки:
/interface bridge
add admin-mac=B8:***:AB auto-mac=no igmp-snooping=yes name=\
bridge-to-LAN port-cost-mode=short protocol-mode=none
/interface bridge port
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether2-MY \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN ingress-filtering=no interface=LAN-wlan1-2GHz \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN ingress-filtering=no interface=LAN-wlan2-5GHz \
internal-path-cost=10 path-cost=10
/interface ethernet
set [ find default-name=ether2 ] name=LAN-ether2-MY
set [ find default-name=ether3 ] loop-protect=on name=LAN-ether3
set [ find default-name=ether4 ] loop-protect=on name=LAN-ether4
set [ find default-name=ether5 ] name=LAN-ether5
set [ find default-name=ether1 ] name=WAN-ether1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VPN
/interface list member
add interface=bridge-to-LAN list=LAN
add interface=PPPoE-RTK list=WAN
/interface pppoe-client
add add-default-route=yes default-route-distance=2 disabled=no interface=\
WAN-ether1 name=PPPoE-RTK user=7*******2
/ip pool
add name=LAN-pool-dhcp ranges=192.168.1.1-192.168.1.199
/ip dhcp-server
add address-pool=LAN-pool-dhcp bootp-lease-time=lease-time bootp-support=\
dynamic interface=bridge-to-LAN lease-time=3d10m name=LAN-dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1,8.8.8.8,1.1.1.1 gateway=\
192.168.1.1 netmask=24
/ip address
add address=192.168.1.1/24 interface=bridge-to-LAN network=192.168.1.0
add address=192.168.101.1/24 comment="Connect to ONU" interface=WAN-ether1 \
network=192.168.101.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1,10.2.0.1
/ip dns static
add address=192.168.88.1 name=router.lan type=A
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes in-interface=bridge-to-LAN \
out-interface=PPPoE-RTK
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes in-interface=PPPoE-RTK out-interface=\
bridge-to-LAN
add action=accept chain=forward comment="ALLOW established, related" \
connection-state=established,related
add action=accept chain=input connection-state=established,related
add action=drop chain=forward comment="DROP Invalid" connection-state=invalid
add action=drop chain=input connection-state=invalid
add action=jump chain=input comment="DDoS - SYN flood protection" \
connection-limit=100,32 connection-state=new in-interface-list=WAN \
jump-target=SYN-Protect protocol=tcp
add action=return chain=SYN-Protect limit=200,5:packet
add action=add-src-to-address-list address-list=DDoS-blacklist \
address-list-timeout=1w3d chain=SYN-Protect log-prefix=\
"DDoS: SYN-Protect"
add action=jump chain=input comment="DDoS - Main protection" \
connection-state=new in-interface-list=WAN jump-target=DDoS-Protect
add action=return chain=DDoS-Protect dst-limit=15,15,src-address/10s
add action=add-src-to-address-list address-list=DDoS-blacklist \
address-list-timeout=1w3d chain=DDoS-Protect log-prefix=\
"DDoS: -MAIN-Protect"
add action=drop chain=input comment="Protected - WinBox Access" log=yes \
log-prefix=WINBOX-block src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List Winbox" \
address-list-timeout=none-dynamic chain=input connection-state=new \
dst-port=8291 in-interface-list=WAN log=yes log-prefix="BLACK WINBOX" \
protocol=tcp src-address-list="Winbox Stage 3"
add action=add-src-to-address-list address-list="Winbox Stage 3" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp \
src-address-list="Winbox Stage 2"
add action=add-src-to-address-list address-list="Winbox Stage 2" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp \
src-address-list="Winbox Stage 1"
add action=add-src-to-address-list address-list="Winbox Stage 1" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp
add action=drop chain=input comment=\
"DROP - Block all other input/forward connections on the WAN" \
in-interface-list=WAN
add action=drop chain=forward in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=\
WAN
add action=masquerade chain=srcnat comment="Connect to ONU" dst-address-list=\
192.168.101.1 out-interface=WAN-ether1
/ip firewall raw
add action=drop chain=prerouting comment="DDoS - Drop blacklist IP" \
in-interface-list=WAN src-address-list=DDoS-blacklist
add action=drop chain=prerouting comment="NetBIOS Name Service BLOCK" \
dst-port=137,138,139 in-interface-list=WAN protocol=udp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
add admin-mac=B8:***:AB auto-mac=no igmp-snooping=yes name=\
bridge-to-LAN port-cost-mode=short protocol-mode=none
/interface bridge port
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether2-MY \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether3 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether4 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN hw=no ingress-filtering=no interface=LAN-ether5 \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN ingress-filtering=no interface=LAN-wlan1-2GHz \
internal-path-cost=10 path-cost=10
add bridge=bridge-to-LAN ingress-filtering=no interface=LAN-wlan2-5GHz \
internal-path-cost=10 path-cost=10
/interface ethernet
set [ find default-name=ether2 ] name=LAN-ether2-MY
set [ find default-name=ether3 ] loop-protect=on name=LAN-ether3
set [ find default-name=ether4 ] loop-protect=on name=LAN-ether4
set [ find default-name=ether5 ] name=LAN-ether5
set [ find default-name=ether1 ] name=WAN-ether1
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VPN
/interface list member
add interface=bridge-to-LAN list=LAN
add interface=PPPoE-RTK list=WAN
/interface pppoe-client
add add-default-route=yes default-route-distance=2 disabled=no interface=\
WAN-ether1 name=PPPoE-RTK user=7*******2
/ip pool
add name=LAN-pool-dhcp ranges=192.168.1.1-192.168.1.199
/ip dhcp-server
add address-pool=LAN-pool-dhcp bootp-lease-time=lease-time bootp-support=\
dynamic interface=bridge-to-LAN lease-time=3d10m name=LAN-dhcp
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1,8.8.8.8,1.1.1.1 gateway=\
192.168.1.1 netmask=24
/ip address
add address=192.168.1.1/24 interface=bridge-to-LAN network=192.168.1.0
add address=192.168.101.1/24 comment="Connect to ONU" interface=WAN-ether1 \
network=192.168.101.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4,1.1.1.1,10.2.0.1
/ip dns static
add address=192.168.88.1 name=router.lan type=A
/ip firewall filter
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes in-interface=bridge-to-LAN \
out-interface=PPPoE-RTK
add action=fasttrack-connection chain=forward connection-state=\
established,related hw-offload=yes in-interface=PPPoE-RTK out-interface=\
bridge-to-LAN
add action=accept chain=forward comment="ALLOW established, related" \
connection-state=established,related
add action=accept chain=input connection-state=established,related
add action=drop chain=forward comment="DROP Invalid" connection-state=invalid
add action=drop chain=input connection-state=invalid
add action=jump chain=input comment="DDoS - SYN flood protection" \
connection-limit=100,32 connection-state=new in-interface-list=WAN \
jump-target=SYN-Protect protocol=tcp
add action=return chain=SYN-Protect limit=200,5:packet
add action=add-src-to-address-list address-list=DDoS-blacklist \
address-list-timeout=1w3d chain=SYN-Protect log-prefix=\
"DDoS: SYN-Protect"
add action=jump chain=input comment="DDoS - Main protection" \
connection-state=new in-interface-list=WAN jump-target=DDoS-Protect
add action=return chain=DDoS-Protect dst-limit=15,15,src-address/10s
add action=add-src-to-address-list address-list=DDoS-blacklist \
address-list-timeout=1w3d chain=DDoS-Protect log-prefix=\
"DDoS: -MAIN-Protect"
add action=drop chain=input comment="Protected - WinBox Access" log=yes \
log-prefix=WINBOX-block src-address-list="Black List Winbox"
add action=add-src-to-address-list address-list="Black List Winbox" \
address-list-timeout=none-dynamic chain=input connection-state=new \
dst-port=8291 in-interface-list=WAN log=yes log-prefix="BLACK WINBOX" \
protocol=tcp src-address-list="Winbox Stage 3"
add action=add-src-to-address-list address-list="Winbox Stage 3" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp \
src-address-list="Winbox Stage 2"
add action=add-src-to-address-list address-list="Winbox Stage 2" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp \
src-address-list="Winbox Stage 1"
add action=add-src-to-address-list address-list="Winbox Stage 1" \
address-list-timeout=1m chain=input connection-state=new dst-port=8291 \
in-interface-list=WAN log=yes log-prefix=WINBOX protocol=tcp
add action=drop chain=input comment=\
"DROP - Block all other input/forward connections on the WAN" \
in-interface-list=WAN
add action=drop chain=forward in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface-list=\
WAN
add action=masquerade chain=srcnat comment="Connect to ONU" dst-address-list=\
192.168.101.1 out-interface=WAN-ether1
/ip firewall raw
add action=drop chain=prerouting comment="DDoS - Drop blacklist IP" \
in-interface-list=WAN src-address-list=DDoS-blacklist
add action=drop chain=prerouting comment="NetBIOS Name Service BLOCK" \
dst-port=137,138,139 in-interface-list=WAN protocol=udp
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set h323 disabled=yes
set sip disabled=yes
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN