Prístup do MikroTik HeX PoE cez VLAN

ZeIRO

Dobry den. Mam nakonfigurovanu mikrotik na vlan nasledovne

eth0 VLAN20
eth0 VLAN30
eth0 VLAN 40

a mam vytvorene brigde vlans na ostatne porty, to aj funguje.
(bridge-vlan20 ma porty vlan20, eth1, eth2)
(bridge-vlan92 ma porty vlan92, eth3)
(bridge-vlan40 ma porty vlan40, eth4, eth5, sfp)
Hlavne sa mi jedna o to ze sa neviem pristupit z ostatnych sieti na ten mikrotik
na vlan 20 man pridelenu ip adresu 192.168.88.3 a chcem sa na to pristupit z inej sieti, ostatne tp link switche funguju na to mam bez problemov pristup.

Ako mam nastavit adresu aby som aj ineho vlanu vedel prihlasit na ten mikrotik (jedna sa cez http 80 port)

Dakujem za pomoc.

mladas

posli export?

ZeIRO

nemam tam teraz pristup inak ako sa to robi (akým prikazom vyziadam config?), doteraz som riesil ubnt a ostatne znacky mikrotik riesim len par tyzdnov dakujem.

ZeIRO

Nastavenie UBNT routra do ktoreho je zapojeny mikrotik cez eth1 (vlany) a chcem sa na to dostat zo switch0

admin@EdgeRouterX-SFP:_$ show configuration | no-more

firewall {

all-ping enable

broadcast-ping disable

group {

network-group PRIVATE_NETS {

network 192.168.0.0/16

network 172.16.0.0/12

network 10.0.0.0/8

}

network-group PROTECT_NETWORKS {

description ""

network 192.168.0.0/16

network 172.16.0.0/12

network 10.0.0.0/8

}

}

ipv6-receive-redirects disable

ipv6-src-route disable

ip-src-route disable

log-martians disable

modify balance {

rule 10 {

action modify

description "do NOT load balance lan to lan"

destination {

group {

network-group PRIVATE_NETS

}

}

modify {

table main

}

}

rule 20 {

action modify

description "do NOT load balance destination public address"

destination {

group {

address-group ADDRv4_eth0

}

}

modify {

table main

}

}

rule 30 {

action modify

description "do NOT load balance destination public address"

destination {

group {

address-group ADDRv4_eth1

}

}

modify {

table main

}

}

rule 40 {

action modify

description "do NOT load balance destination public address"

destination {

group {

address-group ADDRv4_eth2

}

}

modify {

table main

}

}

rule 80 {

action modify

modify {

lb-group G

}

}

}

name BLOCK_IN {

default-action accept

description ""

rule 1 {

action accept

description "Accept Established/Related"

log disable

protocol all

state {

established enable

invalid disable

new disable

related enable

}

}

rule 2 {

action drop

description "Drop PROTECT_NETWORKS"

destination {

group {

network-group PROTECT_NETWORKS

}

}

log disable

protocol all

}

}

name BLOCK_LOCAL {

default-action drop

description ""

rule 1 {

action accept

description "Accept DNS"

destination {

port 53

}

log disable

protocol udp

}

rule 2 {

action accept

description "Accept DHCP"

destination {

port 67

}

log disable

protocol udp

}

rule 3 {

action accept

description "Accept Default gateway"

destination {

address 192.168.77.1

}

log disable

protocol all

}

}

name WAN_IN {

default-action drop

description "WAN to internal"

rule 10 {

action accept

description "Allow established/related"

state {

established enable

related enable

}

}

rule 20 {

action accept

description "LAN2 DMZ"

destination {

address 192.168.88.0/24

}

log disable

protocol all

}

rule 30 {

action accept

description "LAN3 DMZ"

destination {

address 192.168.99.0/24

}

log disable

protocol all

}

rule 40 {

action drop

description "Drop invalid state"

state {

invalid enable

}

}

}

name WAN_LOCAL {

default-action drop

description "WAN to router"

rule 10 {

action accept

description "Allow established/related"

state {

established enable

related enable

}

}

rule 20 {

action accept

description "Remote Access to GUI"

destination {

group {

address-group NETv4_eth1.92

}

port 80,443

}

log disable

protocol tcp

}

rule 30 {

action accept

description "Remote Access to GUI"

destination {

group {

address-group NETv4_eth0

}

port 80,443

}

log disable

protocol tcp

}

rule 40 {

action drop

description "Drop invalid state"

state {

invalid enable

}

}

}

receive-redirects disable

send-redirects enable

source-validation disable

syn-cookies enable

}

interfaces {

ethernet eth0 {

address dhcp

description WAN

duplex auto

firewall {

in {

name WAN_IN

}

local {

name WAN_LOCAL

}

}

poe {

output off

}

speed auto

}

ethernet eth1 {

description eth1

duplex auto

poe {

output off

}

speed auto

vif 20 {

address 192.168.88.1/24

description "LAN 2"

firewall {

in {

modify balance

}

local {

}

}

mtu 1500

}

vif 30 {

address 192.168.99.1/24

description "LAN 3"

firewall {

in {

modify balance

}

local {

}

}

mtu 1500

}

vif 40 {

address 192.168.100.1/24

description LAN4

firewall {

in {

modify balance

}

}

mtu 1500

}

vif 92 {

address 10.1.1.2/24

description "WAN 2"

firewall {

in {

name WAN_IN

}

local {

name WAN_LOCAL

}

}

}

}

ethernet eth2 {

address dhcp

description "WAN 3"

duplex auto

firewall {

in {

name WAN_IN

}

local {

name WAN_LOCAL

}

}

poe {

output off

}

speed auto

}

ethernet eth3 {

duplex auto

poe {

output off

}

speed auto

}

ethernet eth4 {

duplex auto

poe {

output off

}

speed auto

}

ethernet eth5 {

duplex full

speed 1000

}

loopback lo {

}

switch switch0 {

address 192.168.77.1/24

description Local

firewall {

in {

modify balance

}

}

mtu 1500

switch-port {

interface eth3 {

}

interface eth4 {

}

interface eth5 {

}

vlan-aware disable

}

}

}

load-balance {

group G {

exclude-local-dns disable

flush-on-active enable

gateway-update-interval 20

interface eth0 {

}

interface eth1 {

}

interface eth2 {

}

lb-local enable

lb-local-metric-change disable

}

}

protocols {

static {

route 0.0.0.0/0 {

next-hop 10.1.1.1 {

}

}

}

}

service {

dhcp-server {

disabled false

hostfile-update disable

shared-network-name LAN {

authoritative enable

subnet 192.168.77.0/24 {

default-router 192.168.77.1

dns-server 192.168.77.1

lease 86400

start 192.168.77.61 {

stop 192.168.77.99

}

}

}

shared-network-name LAN2 {

authoritative disable

subnet 192.168.88.0/24 {

default-router 192.168.88.1

dns-server 192.168.88.1

lease 86400

start 192.168.88.61 {

stop 192.168.88.99

}

}

}

shared-network-name LAN3 {

authoritative disable

subnet 192.168.99.0/24 {

default-router 192.168.99.1

dns-server 192.168.99.1

lease 86400

start 192.168.99.61 {

stop 192.168.99.99

}

}

}

static-arp disable

use-dnsmasq disable

}

dns {

forwarding {

cache-size 150

listen-on switch0

listen-on eth1.20

listen-on eth1.30

}

}

gui {

http-port 80

https-port 443

older-ciphers enable

}

nat {

rule 5000 {

description "masquerade for WAN"

outbound-interface eth0

type masquerade

}

rule 5002 {

description "masquerade for WAN 2"

log disable

outbound-interface eth1.92

protocol all

type masquerade

}

rule 5004 {

description "masquerade for WAN 3"

outbound-interface eth2

type masquerade

}

}

ssh {

port 22

protocol-version v2

}

unms {

disable

}

}

system {

conntrack {

expect-table-size 4096

hash-size 4096

modules {

sip {

disable

}

}

table-size 32768

tcp {

half-open-connections 512

loose enable

max-retrans 3

}

}

host-name EdgeRouterX-SFP

ipv6 {

disable

}

login {

user admin {

authentication {

encrypted-password ****************

plaintext-password ****************

}

level admin

}

}

name-server 217.23.xxx.xxx

name-server 217.23.xxx.xxx

ntp {

server 0.ubnt.pool.ntp.org {

}

server 1.ubnt.pool.ntp.org {

}

server 2.ubnt.pool.ntp.org {

}

server 3.ubnt.pool.ntp.org {

}

}

syslog {

global {

facility all {

level notice

}

facility protocols {

level debug

}

}

}

time-zone Europe/Bratislava

traffic-analysis {

dpi enable

export enable

}

}

mladas

v terminale das prikaz export file=jmeno jinak mas tam nastavenou vychozi branu? a adresu mas ve formatu 192.168.88.3/24 (nebo jinou masku?) neb bez ni to je /32

ZeIRO

mladas

zajtra to poslem len teraz sa tam neviem dostat, inak tam mam len vlany nakonfigurovane nemam to v rezime router len ako switch, nat a firewall vobec neni konfigurovane.

ip tam je 192.168.88.3/24 na bride-vlan20

mladas

ja ti rozumim, ale pokud se do toho mas dostat z jineho rozsahu tak to musi vedet kde je GW

ZeIRO

mladas
To je pravda, to nemam nakonfigurovane, to potrebujem nastavit v routes alebo?

mladas

v terminalu prikaz ip route add gateway=192.168.88.1 (pokud je na routeru tato adresa rozjeta na vlanu 20)
piripadne i ted pokud se dostanes do routeru by sis mel adresu 192.168.88.3 pingnout (z routeru)

ZeIRO

mladas
Z daneho vlanu pingnut da neni problem len z ostatnych sa neda pristupit na ten mikrotik, ani pingnut, ale asi teg gateway pomoze

mladas

v routes a nwbo tim prikatem pres terminal ip route add gateway=192.168.88.1

mladas

Ono pokud umi to ubnt nejaky telnet nebo ssh tak se umiš z toho ubnt pripojit na ten mikrotik terminalem a pridat tam tu routu textem ip route add gateway=192.168.88.1
(ale UBNT neznam)

ZeIRO

mladas

Uz ked sme tu mam este jednu prosbu mam hAPac2 konfig dole, problem je podobny z inej sieti nemam pristup len z vlastneho nahodil som tam default gateway 192.168.255.1 ale potom som nemal pristup zo siete 192.168.255.0, neviem co by som tam este mal nastavit, Vopred vdaka.

Este doplnim ze pri skontrolovani update-u stale pise ERROR: could not resolve dns name

oct/05/2020 22:44:25 by RouterOS 6.47.4

software id = 4N55-D8G9

model = RBD52G-5HacD2HnD

serial number = D7160CC3F1C0

/interface bridge
add name=bridge-lan
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk management-protection=allowed mode=\
dynamic-keys name=AlarmCOMnet supplicant-identity=MikroTik \
wpa2-pre-shared-key=allmusicstudio
add authentication-types=wpa2-psk management-protection=allowed mode=\
dynamic-keys name=AlarmCOMnet_free supplicant-identity=MikroTik \
wpa2-pre-shared-key=freewifi
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
country="united states" disabled=no frequency=2437 installation=indoor \
mode=ap-bridge security-profile=AlarmCOMnet ssid=AlarmCOMnet \
wireless-protocol=802.11 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=4A:8F:5A:7E:11:12 \
master-interface=wlan1 multicast-buffering=disabled name=\
"wlan1(virtual1)" security-profile=AlarmCOMnet_free ssid=AlarmCOMnet_free \
vlan-id=1003 vlan-mode=use-tag wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
20/40/80mhz-XXXX country="united states" disabled=no frequency=5240 \
installation=indoor mode=ap-bridge security-profile=AlarmCOMnet ssid=\
AlarmCOMnet-5G wireless-protocol=802.11 wps-mode=disabled
add disabled=no mac-address=4A:8F:5A:7E:11:13 master-interface=wlan2 name=\
"wlan2(virtual2)" security-profile=AlarmCOMnet_free ssid=\
AlarmCOMnet_free-5G vlan-id=1003 vlan-mode=use-tag wds-default-bridge=\
bridge-lan wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge-lan interface=ether1
add bridge=bridge-lan interface=ether2
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5
add bridge=bridge-lan interface=wlan1
add bridge=bridge-lan interface=wlan2
add interface="wlan1(virtual1)"
add interface="wlan2(virtual2)"
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface detect-internet
set detect-interface-list=all
/ip address
add address=192.168.255.10/24 interface=bridge-lan network=192.168.255.0
/ip dns
set allow-remote-requests=yes servers=192.168.1.1
/system clock
set time-zone-name=Europe/Bratislava
/system identity
set name="MikroTik hAPac2 (Spalna c.2) DOM"
/system leds settings
set all-leds-off=after-1h
/system routerboard reset-button
set enabled=yes hold-time=0s..15s

s_a_m

ZeIRO Mas blbe dnska tedy konkretne mamas z te vlany pristup ven. Posteluj si gwcko aby melo nat a ipecko na spravne vlan, sakra kde ti ta vlana vznika na 960 nebo na ty ubine nebo na tu ubinu mas predany neco v qiq moc to nechapu???

Asi tak běžná konfigurace je, že se všechny VLAN sejdou v jednom routeru. Ten ví o tom, kde je která síť, na které VLAN. A je schopen provoz směrovat správně. Jakákoliv jiná konfigurace už je vyšší dívčí

ludvik

Sorry, ale tohle ti na dálku asi nikdo nedá.

Ten switch - podle mě moc nechápeš, jak to má fungovat. Je to switch, který má několik částí, několik vlan. A jen jedna vlan má IP - jak mají být ostatní dostupné pomocí IP protokolu?
Pokud je z ostatních segmentů sítě dostupná síť, co máš na VLAN20, tak ti to fungovat bude. Jen budeš potřebovat výchozí bránu. A nezakázaný RP filter na routerech, případně jiné ochrany (jako např. nové tcp spojení bez syn paketu, což v návodech často bývá).
Jinak potřebuješ nějakou IP síť i na ostatní VLANách.

Ale pro mikrotik by ti mohl stačit přístup přes MAC-winbox (telnet). K tomu IP nepotřebuješ.

Asi tak běžná konfigurace je, že se všechny VLAN sejdou v jednom routeru. Ten ví o tom, kde je která síť, na které VLAN. A je schopen provoz směrovat správně. Jakákoliv jiná konfigurace už je vyšší dívčí ...