queue mangle files vsetko zmizlo

black_angel1

Dobry

Mam v robote MK 493AH ako gateway do netu a mal som nanom nastavene queue pre obmedzenie stahovania ale momentalne to dako zmizlo

horsie je ze aj log je prazdny tak ze neviem co sa vlastne stalo zvlastne je ze v file liste nemam nic ale ukazuje to ze mam 32.9 mb of 61.4 mb neviem ci to je normalne ked tam niesu subory

skusal som reboot ale nepomohlo

otazka je mam este 1 MK co ma rovnake nastavenie queue a mangle ale ako to preniest ked ostatne nastavenia su ine?

stalo sa to uz niekomu ze to takto zmizlo ?

este jedna vec

(10023 messages not shown)

ako to zobrazim ?

a druha :

niekto sa tam pokusal connectnut podla netu je to ip z indie ?! tak ako pozrem tie spravy pred co su ci tam dakto daco porobil alebo nie ?

nov/10/2012 20 system,error,critical login failure for user admin from 109.163.231.233 via winbox

tak ze ako tak sledujem asi sa tam dakto logol a porobil co porobil

logging som mal disabled nepametam sa ze som to vypinal

teraz sa pokusam spojadnit logging na email ale pise to ze "error sending e-mail <...> invalid to address"

popripade ma kontaktujte na ICQ 273850136

losos

Tie queue a mangle viez preniest jednoducho:

Najskor na mikrotiku kde to mas fukncne si ich vyexportuj - pusti terminal, /ip firewall mangle export , /queue simple export alebo /queue tree export , /queue type export

Alebo mozes priamo napisat export a ono ti to takto urobi cely konfig routra a ty len vyberes to co chces importovat na ten kde ti zmizli.

Ak tam mas viacej zaznamov nez ukazuje terminal, pripoj sa na ten mikrotik napriklad cez putty a do vlastnosti session si daj viacej riadkov.

Zkopiruj to co ti vyplul export

Chod na ten mikrotik kam chces importovat a iba to tam prilep.

Co sa tyka toho pripajania z Indie - ak tam nemas jednoduche meno/heslo, a v logu nemas uspesny login, tak ti to asi iba tazko niekto pozmenil.

Co sa tyka logovania - schvalne to chces posielat mailom? Lebo kludne si to mozes logovat iba v ramci toho mikrotiku aby ked sa nan prihlasis a pozries logy, vidis co potrebujes.

neverhappy

odpoved na 1 dotaz https://ispforum.cz/viewtopic.php?f=5&t=2036 co je jine, dopsat, pripadne priradit spravne ethernety, ip atd

odpoved na 2 zabezpecit napr.http://wiki.mikrotik.com/wiki/Bruteforc ... prevention

/ip firewall filter add chain=input protocol=tcp dst-port=21 src-address-list=ftp_blacklist action=drop \ comment="drop ftp brute forcers"

/ip firewall filter add chain=output action=accept protocol=tcp content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m

/ip firewall filter add chain=output action=add-dst-to-address-list protocol=tcp content="530 Login incorrect" \ address-list=ftp_blacklist address-list-timeout=3h

/ip firewall filter add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \

comment="drop ssh brute forcers" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new \

src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist \

address-list-timeout=10d comment="" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new \

src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 \

address-list-timeout=1m comment="" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage1 \

action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m comment="" disabled=no

/ip firewall filter add chain=input protocol=tcp dst-port=22 connection-state=new action=add-src-to-address-list \

address-list=ssh_stage1 address-list-timeout=1m comment="" disabled=no

/ip firewall filter add chain=forward protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop \

comment="drop ssh brute downstream" disabled=no

black_angel1

to losos dakujem pustim sa do toho

to neverhappy

take zhrnutie co zmizlo / zmenilo

loggin rules - vsetko disabled

simply queue - zmizlo

gueue tree - zmizlo

mangle - zmizlo

filter rules - zmizlo

a to brute force som tam prave mal tak ze sa len cudujem co sa vlastne stalo mal som dovolenku

a este som zabudol to s files je to normalne ze to ukazuje 32.9 mb of 61.4 mb used ? 46 % free ?

alebo to tie subory nezobrazuje ?

neverhappy

na 493G mi to zobrazuje 23Mb free z 62Mb. Takze je to normalni, spis nemas nainstalovane vsechny balicky. Ukazuje mi to na vsech (3ks :) ) co mam rb493 v siti

black_angel1

Tak mam to spravene dakujem za pomoc

a este ako na to posielanie logu ?

nasiel som na nete :

http://msmunir.blogspot.sk/2011/05/send-log-mikrotik-via-email.html

ale pise to error :

error sending e-mail < system,info,account user admin logged in from 10.10.11.82 via web> invalid TO address

detail pre posielanie toho mail

13 e-mail,debug recv: 220 smtp.server.sk ESMTP

13 e-mail,debug send EHLO

13 e-mail,debug recv: 250-smtp.server.sk

13 e-mail,debug recv: 250-PIPELINING

13 e-mail,debug recv: 250-SIZE 20971520

13 e-mail,debug recv: 250-ETRN

13 e-mail,debug recv: 250-STARTTLS

13 e-mail,debug recv: 250-AUTH PLAIN LOGIN

13 e-mail,debug recv: 250-AUTH=PLAIN LOGIN

13 e-mail,debug recv: 250-ENHANCEDSTATUSCODES

13 e-mail,debug recv: 250-8BITMIME

13 e-mail,debug recv: 250 DSN

13 e-mail,debug send AUTH PLAIN

13 e-mail,debug recv: 235 2.7.0 Authentication successful

13 e-mail,debug send MAIL FROM: <mk1>

13 e-mail,debug recv: 250 2.1.0 Ok

13 e-mail,debug send RCPT TO: <admin@domena.sk>

13 e-mail,debug recv: 504 5.5.2 <mk1>: Sender address rejec ualified address

13 e-mail,debug send RSET

13 e-mail,debug recv: 250 2.0.0 Ok

13 e-mail,debug send QUIT

13 e-mail,debug recv: 221 2.0.0 Bye

mozno to niekomu povie viac ako mne

ale mam dojem ze je problem v adrese ale to je dake divne ked ten script funguje

okrem toho mam script na posielanie backupu ten funguje tak ze neviem kde je problem

script

/system backup save name=( . "-" . [ . [ . [ )

/tool e-mail send from="mk1@domena.sk" to="admin@domena.sk" subject=( . " Backup " . ) file=( . "-" . [ . [ . [ . ".backup"); 10

/file rem [/file find name=( . "-" . [ . [ . [ ; info ("System Backup emailed at " . . " " . )

losos

jedine co ma napada co v tom vidim chybu je, ze ten backup mas nastaveny ako <--- e -->mk1@domena.sk<--- e --> - a ten funguje, to je dobre.

Ale vo vypisoch kde mas chybu s odoslanim sa uz uvadza ako odosielatel iba mk1. Skus tam na mikrotik v Tools Email nastavit cely mail aj s domenou. To ti asi dropuje tvoj mailovy server taku poziadavku.

black_angel1

no jasne uz to funguje

vdaka za pomoc