dakskh
Newbie | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Цитата:| ip firewall export file=rules и образовавшийся файлик, или его содержимое, выложить сюда. |
Честно говоря не понял, как тут файл выложить, вот содержимое файла:
---------------------------------------------------------------------------------
# apr/25/2025 07:19:23 by RouterOS 6.49.18
# software id = M958-XUDV
#
# model = RB760iGS
# serial number = HGW0A0FY6NN
/ip firewall filter
add action=drop chain=forward connection-state=!established,related \
in-interface=VostokTel
add action=drop chain=input connection-state=!established,related \
in-interface=VostokTel
/ip firewall nat
add action=masquerade chain=srcnat out-interface=VostokTel
---------------------------------------------------------------------------------
У меня всего -то 2 правила в фаерволе и одно в нат и все
Так же, на всякий случай,ниже скину еще логи кинетика при попытке к нему подсоединится. Как сделать логи в микторе, что-то не могу разобраться, я имею ввиду самого процесса, знаю только, если поставить галочку log правилах, можно увидеть, что происходит по этим правилам
Добавлено:
Вот лог кинетика при подключении к нему с рабочего компа через микротик(xx-мой внешний айпишник):
------------------------------------------------------------------------------------------------------------------------------
Апр 25 08:26:52
ipsec
08[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Апр 25 08:26:52
ipsec
08[IKE] received MS-Negotiation Discovery Capable vendor ID
Апр 25 08:26:52
ipsec
08[IKE] received Vid-Initial-Contact vendor ID
Апр 25 08:26:52
ipsec
08[IKE] xx.xx.xx.xx is initiating an IKE_SA
Апр 25 08:26:52
ipsec
08[CFG] received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16=256/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16=256/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16=256/ [...]
Апр 25 08:26:52
ipsec
08[CFG] configured proposals: IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256
Апр 25 08:26:52
ipsec
08[CFG] selected proposal: IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
Апр 25 08:26:52
ipsec
08[IKE] remote host is behind NAT
Апр 25 08:27:22
ipsec
06[JOB] deleting half open IKE_SA with xx.xx.xx.xx after timeout
-----------------------------------------------------------------------------------------------------------------------------
А вот лог при подключении с домашнего компа, дома стоит TP-Link Archer C64 (айпишники замазал, xx-мой внешний дома,zz-внешний кинетика,yy-мой внутренний,ff-выданый кинетиком при подключении к VPN)
-----------------------------------------------------------------------------------------------------------------------------
Апр 25 08:45:38
ipsec
09[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
Апр 25 08:45:38
ipsec
09[IKE] received MS-Negotiation Discovery Capable vendor ID
Апр 25 08:45:38
ipsec
09[IKE] received Vid-Initial-Contact vendor ID
Апр 25 08:45:38
ipsec
09[IKE] xx.xx.xx.xx is initiating an IKE_SA
Апр 25 08:45:38
ipsec
09[CFG] received proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16=128/PRF_HMAC_SHA2_384/MODP_1024, IKE:AES_GCM_16=256/PRF_HMAC_SHA1/MODP_1024, IKE:AES_GCM_16=256/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_GCM_16=256/ [...]
Апр 25 08:45:38
ipsec
09[CFG] configured proposals: IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384, IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384, IKE:AES_CBC=128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_384, IKE:AES_CBC=256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384, IKE:AES_CBC=256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256
Апр 25 08:45:38
ipsec
09[CFG] selected proposal: IKE:AES_CBC=128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024
Апр 25 08:45:38
ipsec
09[IKE] remote host is behind NAT
Апр 25 08:45:38
ipsec
07[IKE] received 84 cert requests for an unknown ca
Апр 25 08:45:38
ipsec
07[CFG] looking for peer configs matching zz.zz.zz.zz[%any]...xx.xx.xx.xx[yy.yy.yy.yyy]
Апр 25 08:45:38
ipsec
07[CFG] selected peer config 'VirtualIPServerIKE2'
Апр 25 08:45:38
ipsec
07[IKE] initiating EAP_IDENTITY method (id 0x00)
Апр 25 08:45:38
ipsec
07[IKE] peer supports MOBIKE, but disabled in config
Апр 25 08:45:38
ipsec
07[IKE] authentication of 'lalala.keenetic.link' (myself) with RSA signature successful
Апр 25 08:45:38
ipsec
07[IKE] sending end entity cert "CN=lalala.keenetic.link"
Апр 25 08:45:38
ipsec
07[IKE] sending issuer cert "C=US, O=Let's Encrypt, CN=R10"
Апр 25 08:45:38
ipsec
06[IKE] received EAP identity 'dak'
Апр 25 08:45:38
ipsec
06[IKE] initiating EAP_MSCHAPV2 method (id 0x60)
Апр 25 08:45:38
ipsec
08[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established
Апр 25 08:45:39
ipsec
09[IKE] authentication of 'yy.yy.yy.yy' with EAP successful
Апр 25 08:45:39
ipsec
09[IKE] authentication of 'lalala.keenetic.link' (myself) with EAP
Апр 25 08:45:39
ipsec
09[IKE] IKE_SA VirtualIPServerIKE2[211] established between zz.zz.zz.zz[lalala.keenetic.link]...xx.xx.xx.xx[yy.yy.yy.yyy]
Апр 25 08:45:39
ipsec
09[IKE] peer requested virtual IP %any
Апр 25 08:45:39
ndm
Core::Server: started Session /var/run/ndm.core.socket.
Апр 25 08:45:39
ndm
IpSec::CryptoMapInfo: "VirtualIPServerIKE2": allocated address "ff.ff.ff.f" for user "dak" @ "yy.yy.yy.yyy" from "xx.xx.xx.xx".
Апр 25 08:45:39
ipsec
09[IKE] assigning virtual IP ff.ff.ff.f to peer 'dak'
Апр 25 08:45:39
ipsec
09[IKE] peer requested virtual IP %any6
Апр 25 08:45:39
ipsec
09[IKE] no virtual IP found for %any6 requested by 'dak'
Апр 25 08:45:39
ipsec
09[CFG] received proposals: ESP:AES_CBC=256/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC=128/HMAC_SHA1_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ, ESP:DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ, ESP:NULL/HMAC_SHA1_96/NO_EXT_SEQ
Апр 25 08:45:39
ipsec
09[CFG] configured proposals: ESP:AES_CBC=128/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC=128/HMAC_SHA2_256_128/NO_EXT_SEQ, ESP:AES_CBC=256/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC=256/HMAC_SHA2_256_128/NO_EXT_SEQ
Апр 25 08:45:39
ipsec
09[CFG] selected proposal: ESP:AES_CBC=128/HMAC_SHA1_96/NO_EXT_SEQ
Апр 25 08:45:39
ndm
Core::Session: client disconnected.
Апр 25 08:45:39
ipsec
09[IKE] CHILD_SA VirtualIPServerIKE2{81} established with SPIs cdeee542_i c31e95ca_o and TS 0.0.0.0/0 === ff.ff.ff.f/32
Апр 25 08:45:39
ndm
IpSec::CryptoMapInfo: "VirtualIPServerIKE2": crypto map is up: remote client "dak" @ "yy.yy.yy.yyy" with IP "ff.ff.ff.f" connected.
Апр 25 08:45:39
ipsec
09[CFG] scheduling RADIUS Interim-Updates every 5s
Апр 25 08:45:39
ndm
IpSec::IpSecNetfilter: start reloading netfilter configuration...
Апр 25 08:45:39
ndm
IpSec::IpSecNetfilter: netfilter configuration reloading is done.
Апр 25 08:45:42
ndhcps
DHCPINFORM received for ff.ff.ff.f from 00:00:00:00:00:00.
Апр 25 08:45:42
ndhcps
sending INFORM to 00:00:00:00:00:00.
---------------------------------------------------------------------------------------------------------------------------
Выложил файл rules.rsc ня яндекс, вот ссылка https://disk.yandex.ru/d/mo10dU4HNU0zFw |
Всего записей: 17 | Зарегистр. 24-11-2021 | Отправлено: 00:34 25-04-2025 | Исправлено: dakskh, 10:12 26-04-2025 |
|
