Dombay
Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
Помогите пожалуйста c маршрутизацией
Есть Микротик с такой конфигурацией.
ether1 - WAN
Bridge=ether2-master,ether2,ether3,wlan IP 192.168.25.1/24
ether5 IP 192.168.0.165/24
Проблема:
Клиенты 192.168.0.0/24 и 192.168.25.0/24 без проблем ходят в интернет
Но клиенты 192.168.0.0/24 и 192.168.25.0/24 не видят друг друга.
т.е. например ping с 192.168.0.5 на 192.168.25.252 не проходит
и наоборт с 192.168.25.252 не получается подключиться по RDP на 192.168.0.60
Подскажите пожалуйста, в чем я накосячил?
Спасибо.
Конфиг - ниже.
# feb/21/2017 06:05:32 by RouterOS 6.38.1
#
/interface bridge
add admin-mac=E4:8D:8C:AC:03:35 auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="WI-FI 192.168.25.1" name=\
ether2-master
set [ find default-name=ether3 ] master-port=ether2-master
set [ find default-name=ether4 ] master-port=ether2-master
set [ find default-name=ether5 ] comment="LOCAL 192.168.0.165"
/interface ipip
add allow-fast-path=no ipsec-secret=0-Parmezan4ik=20 !keepalive local-address=\
195.24.154.22 name=DN<->KHE remote-address=194.79.21.2
/ip neighbor discovery
set ether1 discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\
dynamic-keys wpa-pre-shared-key=poliwf41 wpa2-pre-shared-key=poliwf41
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=wifi \
supplicant-identity="" wpa-pre-shared-key=poliwf41 wpa2-pre-shared-key=\
poliwf41
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n disabled=no distance=indoors \
frequency=auto mode=ap-bridge security-profile=wifi ssid=IT-MIKROTIK \
wireless-protocol=802.11
/interface wireless nstreme
set wlan1 enable-polling=no
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des
/ip pool
add name=dhcp ranges=192.168.25.10-192.168.25.254
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge lease-time=10h10m name=\
dhcpwifi
/tool user-manager customer
set admin access=\
own-routers,own-users,own-profiles,own-limits,config-payment-gw
/interface bridge port
add bridge=bridge comment=defconf interface=ether2-master
add bridge=bridge comment=defconf interface=wlan1
/ip address
add address=192.168.25.1/24 comment=defconf interface=bridge network=\
192.168.25.0
add address=195.24.154.22/30 interface=ether1 network=195.24.154.20
add address=192.168.0.165/24 interface=ether5 network=192.168.0.0
/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.25.0/24 comment=defconf dns-server=\
195.24.128.65,195.24.128.164,192.168.0.1,192.168.0.40 domain=polyfarb \
gateway=192.168.25.1 netmask=24 ntp-server=192.168.0.1
/ip dns
set allow-remote-requests=yes servers=195.24.128.65,195.24.128.164,8.8.8.8
/ip dns static
add address=192.168.25.1 name=mikrotik
/ip firewall filter
add action=accept chain=forward connection-state=established,related \
dst-address=172.16.0.0/21 src-address=192.168.0.0/16
add action=accept chain=input comment=KHE:IP-Sec dst-port=500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input protocol=ipsec-ah
add action=drop chain=input dst-port=53 in-interface=ether1 protocol=udp
add action=accept chain=input protocol=udp
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" disabled=yes \
in-interface=ether1
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related disabled=yes
add action=accept chain=forward comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1
/ip firewall nat
add action=accept chain=srcnat comment=To_Kherson disabled=yes dst-address=\
172.16.0.0/21 src-address=192.168.0.0/16
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface=ether1
add action=accept chain=srcnat disabled=yes dst-address=192.168.25.0/24 \
src-address=192.168.0.0/24
/ip ipsec peer
add address=194.79.21.2/32 disabled=yes nat-traversal=no secret=0-Parmezan4ik=20
/ip ipsec policy
set 0 disabled=yes
add disabled=yes dst-address=172.16.0.0/21 sa-dst-address=194.79.21.2 \
sa-src-address=195.24.154.22 src-address=192.168.0.0/16 tunnel=yes
/ip route
add check-gateway=ping distance=1 gateway=195.24.154.21
add distance=1 dst-address=172.16.0.0/21 gateway=DN<->KHE
add check-gateway=ping distance=1 dst-address=192.168.0.0/16 gateway=\
192.168.0.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=bridge type=internal
add interface=ether1 type=external
add interface=ether5 type=internal
add interface=ether2-master type=internal
add interface=ether3 type=internal
add interface=ether4 type=internal
/system clock
set time-zone-name=Europe/Kiev
/system ntp client
set enabled=yes primary-ntp=192.168.0.1
/system ntp server
set enabled=yes
/system routerboard settings
set init-delay=0s
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=bridge
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=bridge
/tool user-manager database
set db-path=user-manager
|
Всего записей: 344 | Зарегистр. 26-12-2001 | Отправлено: 08:54 21-02-2017 | Исправлено: Dombay, 08:55 21-02-2017 |
|
