Ahojte,
Som začiatočník, rozbalil som MikroTik router, spravil základný security setup:
https://wiki.mikrotik.com/wiki/Manual ... our_Router
A potom som sa snažil nastaviť Hairpin NAT, aby som mal prístupný WWW server aj z vnútornej LAN siete:
https://wiki.mikrotik.com/wiki/Hairpin_NAT
Vnútorná LAN sieť je 192.168.88.0/24, WWW server beží na 192.168.88.248, má pridelenú statickú IP.
Je správne nastavený portforwarding, keď idem na public WAN IP 83.X.X.X tak sa ten WWW server dostanem, ale nie z vnútornej LAN siete, čiže mi nefunguje Hairpin NAT.
Konfigurácia Firewall rules
add action=accept chain=input comment="default configuration" connection-state=\
established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input
add action=fasttrack-connection chain=forward comment=FastTrack \
connection-state=established,related
add action=accept chain=forward comment="Established, Related" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid \
log=yes log-prefix=invalid
add action=drop chain=forward comment=\
"Drop tries to reach not public addresses from LAN" dst-address-list=\
not_in_internet in-interface=bridge log=yes log-prefix=!public_from_LAN \
out-interface=!bridge
add action=drop chain=forward comment=\
"Drop incoming packets that are not NATted" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1 log=yes log-prefix=!NAT
add action=drop chain=forward comment=\
"Drop incoming from internet which is not public IP" in-interface=ether1 \
log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment=\
"Drop packets from LAN that do not have LAN IP" in-interface=bridge log=yes \
log-prefix=LAN_!LAN src-address=!192.168.88.0/24
Konfigurácia NAT
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=\
out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment=http dst-port=80 in-interface=ether1 \
protocol=tcp to-addresses=192.168.88.248 to-ports=80
add action=dst-nat chain=dstnat comment=https dst-port=443 in-interface=ether1 \
protocol=tcp to-addresses=192.168.88.248 to-ports=443
add action=dst-nat chain=dstnat comment=torrent dst-port=35469 in-interface=\
ether1 protocol=tcp to-addresses=192.168.88.248 to-ports=35469
add action=dst-nat chain=dstnat comment="RDP - TCP" dst-port=3399 in-interface=\
ether1 protocol=tcp to-addresses=192.168.88.248 to-ports=3389
add action=dst-nat chain=dstnat comment="RDP - UDP" dst-port=3399 in-interface=\
ether1 protocol=udp to-addresses=192.168.88.248 to-ports=3389
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\
192.168.88.248 dst-port=80 out-interface-list=LAN protocol=tcp src-address=\
192.168.88.0/24
Čo robím zle?
Díky.
