Dotaz: Port forwarding - Mikrotik

[Dark_user]

Zdravim, vim, ze to sem na 100% nepatri, ale tak na 60%urcite ano..jiz nejakou dobu se trapim s problemem, ohledne port forwardingu. Mam sit 10.0.0.0/8, kde mikrotik ma IP 10.0.0.2.1 (/8). Mam nastaveny FW, SNAT, vse bezi, ale ma to jedno ale. Port forwarding mi funguje pouze na adresy z rozsahu 10.0.0.0/24 (tzn. napriklad na 10.0.2.12, 10.0.3.254... atd nefunguje). Rad bych vas pozadal o radu, kde by mohl byt problem. S mikrotikem teprve zacinam, tak je mozne, ze to bude nejaka banalita.

/ip firewall filter
add chain=input comment="Povolen PING" limit=50/5s,2 protocol=icmp
add action=drop chain=input protocol=icmp
add action=drop chain=forward comment="filter NetBios" dst-port=135-139 protocol=udp
add action=drop chain=forward dst-port=135-139 protocol=tcp
add action=drop chain=forward protocol=udp src-port=135-139
add action=drop chain=forward protocol=tcp src-port=135-139
add action=drop chain=forward protocol=tcp src-port=445
add action=drop chain=forward protocol=udp src-port=445
add action=drop chain=forward comment="Omezeni P2P" p2p=all-p2p protocol=tcp
add action=drop chain=input p2p=all-p2p protocol=tcp
add action=drop chain=output p2p=all-p2p protocol=tcp
add chain=input comment=Input connection-state=established
add chain=input connection-state=new in-interface=LAN1
add chain=input connection-state=related
add chain=input disabled=yes dst-port=443 in-interface=WAN protocol=tcp
add chain=input disabled=yes dst-port=80 in-interface=WAN protocol=tcp
add chain=input disabled=yes dst-port=22 in-interface=WAN protocol=tcp
add action=drop chain=input in-interface=WAN protocol=tcp
add action=drop chain=input connection-state=invalid
add chain=forward comment=Forward connection-state=established
add chain=forward connection-state=new
add chain=forward connection-state=related
add action=drop chain=forward connection-state=invalid
add chain=output comment=Output connection-state=established
add chain=output connection-state=new
add chain=output connection-state=related
add action=drop chain=output connection-state=invalid

/ip firewall nat
add action=masquerade chain=srcnat comment="Internet" out-interface=WAN src-address=10.0.0.0/8
add action=masquerade chain=srcnat comment=Maskarada src-address=192.168.1.0/24
add action=dst-nat chain=dstnat comment="Port forwarding" dst-port=22 in-interface=WAN protocol=tcp to-addresses=10.0.0.50 to-ports=22
add action=dst-nat chain=dstnat dst-port=8082 in-interface=WAN protocol=tcp to-addresses=10.0.2.12 to-ports=22
add action=dst-nat chain=dstnat dst-port=8081 in-interface=WAN protocol=tcp to-addresses=10.0.3.254 to-ports=22

Edit, mikrotik se pingne jak na 10.0.2.12 tak 10.0.3.254

---

---

Odpovědi

[MMMMMMMMM]

a třeba http projde? nebo je to jen problém ssh? když si ve winboxu zobrazíš ip / firewall / nat, jde ve statistice paketů vidět, že se aspoň nějaké pakety pokouší k cíli dostat u konkrétního pravidla?

[lertimir]

Někde může být nastaveno 10.0.2.0/24. Co říká ip a, ip route a netstat -r. Jak na tom microtiku, tak na klientech.

[MMMMMMMMM]

Tak problem nakonec nebyl v mikrotiku. Zarizeni mela napevno GW a brali si od DHCP jen IP. GW odkazovala na stary router, tak proto. Ale stejne vam dekuji za vas cas a rady.