Практически пример на обикновен рутер с MikroTik

Схемата която ще разгледаме е много проста. Имаме рутер управляващ достъпа от/към Интернет и клиент ползващ услугите управлявани от рутера. Клиентите ще са два. Единия ще е сървър, другия локален компютър.

Няколко пояснения: ether1 - получава IP по DHCP клиент Bridge_LAN - bridge включващ в себе си всички останали портове (ether2, ether3, ether4 и ether5). Bridge_LAN - има IP адрес 10.0.0.1/24 VPC - IP: 10.0.0.254/24 Server - IP: 10.0.0.100/24

Базова настройка

/system clock set time-zone-name=Europe/Sofia /ip dhcp-client add disabled=no interface=ether1 /interface list add name=WAN /interface list member add interface=ether1 list=WAN /interface bridge add name=Bridge_LAN /interface bridge port add bridge=Bridge_LAN interface=ether2 add bridge=Bridge_LAN interface=ether3 add bridge=Bridge_LAN interface=ether4 add bridge=Bridge_LAN interface=ether5 /ip address add address=10.0.0.1/24 interface=Bridge_LAN network=10.0.0.0 /ip pool add name=dhcp_pool0 ranges=10.0.0.200-10.0.0.254 /ip dhcp-server add address-pool=dhcp_pool0 disabled=no interface=Bridge_LAN name=dhcp1 /ip dhcp-server network add address=10.0.0.0/24 dns-server=10.0.0.1 gateway=10.0.0.1 /ip dns set allow-remote-requests=yes /ip firewall filter add action=drop chain=input comment="drop ssh & winbox brute forcers" dst-port=\ 22 protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=\ 22 protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1m chain=input connection-state=new dst-port=\ 22 protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1m chain=input connection-state=new dst-port=\ 22 protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1m chain=input connection-state=new dst-port=\ 22 protocol=tcp /ip firewall filter add action=accept chain=input connection-state=established,related,untracked comment=\ "Accept established, related, untracked" add action=drop chain=input connection-state=invalid comment=\ "Drop invalid connections" add action=accept chain=input protocol=icmp comment=\ "Accept ICMP (Ping)" add action=accept chain=input dst-address=127.0.0.1 comment=\ "Accept loopback traffic" add action=drop chain=input in-interface-list=WAN comment=\ "Drop all other traffic from WAN" add action=fasttrack-connection chain=forward connection-state=established,related comment=\ "FastTrack: Accelerate established/related traffic" add action=accept chain=forward connection-state=established,related,untracked comment=\ "Accept established, related, untracked" add action=drop chain=forward connection-state=invalid comment=\ "Drop invalid connections" add action=drop chain=forward connection-nat-state=!dstnat connection-state=new in-interface-list=WAN comment=\ "Drop all traffic from WAN except Port Forwarding" /ip firewall nat add action=masquerade chain=srcnat out-interface-list=WAN src-address=10.0.0.0/24 comment=\ "DefConf: NAT Masquerade" add action=dst-nat chain=dstnat dst-port=80 in-interface-list=WAN protocol=tcp to-addresses=10.0.0.100 to-ports=80\ comment="HTTP Web Server" add action=dst-nat chain=dstnat dst-port=21 in-interface-list=WAN protocol=tcp to-addresses=10.0.0.100 to-ports=21\ comment="FTP FTP Server"

Ако искате да достъпвате рутера отвън то:

/ip firewall address-list add address=11.22.33.44 list=admin add address=10.0.0.0/24 list=admin add address=tlan.net list=admin /ip firewall filter add chain=input src-address-list=admin protocol=tcp dst-port=22,80,8291 in-interface-list=WAN action=accept comment="SSH, WEB & Winbox" /ip firewall filter print Flags: X - DISABLED, I - INVALID; D - DYNAMIC 0 D ;;; special dummy rule to show fasttrack counters chain=forward action=passthrough 1 ;;; drop ssh & winbox brute forcers chain=input action=drop protocol=tcp src-address-list=ssh_blacklist dst-port=22,8291 ............................................................ ............................................................ ............................................................ 15 ;;; SSH & Winbox chain=input action=accept protocol=tcp src-address-list=admin in-interface-list=WAN dst-port=22,8291 /ip firewall filter move 15 destination=6

Firewall блокировки

### Блокировка на IP от Интернет до рутера /ip firewall filter add chain=input src-address=8.8.8.8 action=drop comment="Блокирано IP: 8.8.8.8" ### Блокиране на Интернет достъпа на устройство от локалната мрежа /ip firewall filter add chain=forward src-address=10.0.0.50 action=drop comment="Блокиран локален компютър" ### Блокиране на група адреси # Създаване на адресна листа от IP адреси за блокиране. /ip firewall address-list add address=8.8.8.8 list=Blacklist add address=1.1.1.1 list=Blacklist # Създаване на правило за блокиране на IP адреси от адресната листа. /ip firewall filter add action=drop chain=input src-address-list=Blacklist ### Блокиране на домейн # Създаваме адресна листа от домейни за блокиране /ip firewall address-list add address=tlan.net list=Block_Domain add address=tachko.com list=Block_Domain add address=youtube.com list=Block_Domain # Създаваме правилото за блокиране на клиентите към домейни /ip firewall filter add action=drop chain=input dst-address-list=Block_Domain ### Блокиране по Layer 7 (приложение, сайт) # Layer7 правилото /ip firewall layer7-protocol add name="Block Sites" regexp=\ "Regexp: ^.+(facebook.com|youtube|google|yahoo).*\$" # Блокиращото правило /ip firewall filter add action=drop chain=forward layer7-protocol="Block Sites"