Pokud se můžu vrátit ke svému původnímu konfiguráku tak problém jsem viděl v tom, že adresou x.x.x.154/29 kterou má na ehter1 vše fungovalo. Ale přes zařízením na IP 172.30.20.155/29 jsem se na internet nedostal. Když jsem se díval na zařízení před, tak jsem ven procházel sice IP x.x.x.155 ale MACem toho ether1 s IP x.x.x.x154/29. V konfiguraci chápej rozsah 192.168.100.152/29 jako veřejný. Hraju si s tím u sebe na stole.
/interface bridge
add name=bridge-michal
add name=bridge-sb
/interface list
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.168.2-192.168.168.254
add name=dhcp_pool3 ranges=172.30.20.154
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge-michal name=dhcp1
add address-pool=dhcp_pool3 interface=bridge-sb name=dhcp2
/port
set 0 name=serial0
/routing table
add fib name=IRT-TEST
add fib name=IRT-TEST2
add fib name=sb
add fib name=michal
/interface bridge port
add bridge=bridge-michal disabled=yes interface=ether1
add bridge=bridge-michal interface=ether2
add bridge=bridge-sb interface=ether3
add bridge=bridge-michal interface=ether4
add bridge=bridge-michal interface=ether5
add bridge=bridge-michal interface=ether6
add bridge=bridge-michal interface=ether7
add bridge=bridge-michal interface=ether8
add bridge=bridge-michal interface=ether9
add bridge=bridge-michal interface=ether10
add bridge=bridge-michal interface=sfp1
/interface list member
add interface=ether1 list=WAN
/ip address
add address=192.168.100.154/29 comment=michal-public interface=ether1 \
network=192.168.100.152
add address=192.168.100.155/29 comment=sb-public interface=ether1 network=\
192.168.100.152
add address=172.30.20.153/30 comment=sb-wan interface=ether3 network=\
172.30.20.152
add address=192.168.168.1/24 comment=michal-int interface=bridge-michal \
network=192.168.168.0
/ip dhcp-server network
add address=172.30.20.152/30 gateway=172.30.20.153
add address=192.168.168.0/24 gateway=192.168.168.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=192.168.168.2-192.168.168.254 list=allowed_to_router
add address=172.30.20.155 list=allowed_to_router
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=\
not_in_internet
/ip firewall filter
add action=drop chain=forward in-interface=bridge-michal out-interface=\
bridge-sb
add action=drop chain=forward in-interface=bridge-sb out-interface=\
bridge-michal
add action=drop chain=input dst-address=172.30.20.152/29 in-interface=\
bridge-michal
add action=drop chain=input dst-address=192.168.168.0/24 in-interface=\
bridge-sb
add action=accept chain=input comment="default configuration" \
connection-state=established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input
add action=fasttrack-connection chain=forward comment=FastTrack \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Established, Related" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid \
log=yes log-prefix=invalid
add action=jump chain=forward comment="jump to ICMP filters" jump-target=icmp \
protocol=icmp
add action=drop chain=forward comment=\
"Drop incoming from internet which is not public IP" in-interface=ether1 \
log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment=\
"Drop packets from LAN that do not have LAN IP" in-interface=\
bridge-michal log=yes log-prefix=LAN_!LAN src-address=!192.168.168.0/24
add action=drop chain=forward comment=\
"Drop packets from LAN that do not have LAN IP" in-interface=bridge-sb \
log=yes log-prefix=LAN_!LAN src-address=!172.30.20.155
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 \
protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 \
protocol=icmp
add action=accept chain=icmp comment=\
"host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 \
protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 \
protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 \
protocol=icmp
add action=drop chain=icmp comment="deny all other types"
/ip firewall nat
add action=src-nat chain=srcnat src-address=172.30.20.154 to-addresses=\
192.168.100.155
add action=src-nat chain=srcnat src-address=192.168.168.0/24 to-addresses=\
192.168.100.154
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.100.153 \
pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/system clock
set time-zone-name=Europe/Prague
Tak jsem to zjednodušil a udělal tuto konfiguraci s tím, že když nastavím IP x.x.x.155/29 na koncové zařízení, tak mi vše funguje a vidím v ARP tabulce správnou IP a MAC dané síťovky.
/interface bridge
add name=bridge-michal
add name=bridge-sb
/interface list
add name=wan
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.168.2-192.168.168.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge-michal name=dhcp1
/port
set 0 name=serial0
/interface bridge port
add bridge=bridge-michal disabled=yes interface=ether1
add bridge=bridge-michal interface=ether2
add bridge=bridge-michal interface=ether3
add bridge=bridge-michal interface=ether4
add bridge=bridge-michal interface=ether5
add bridge=bridge-michal interface=ether6
add bridge=bridge-michal interface=ether7
add bridge=bridge-michal interface=ether8
add bridge=bridge-michal interface=ether9
add bridge=bridge-michal interface=sfp1
/interface list member
add interface=ether1 list=wan
/ip address
add address=192.168.100.154/29 interface=ether1 network=192.168.100.152
add address=192.168.168.1/24 interface=bridge-michal network=192.168.168.0
/ip dhcp-server network
add address=192.168.168.0/24 gateway=192.168.168.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall filter
add action=drop chain=forward dst-address=192.168.168.0/24 src-address=\
192.168.100.156
add action=drop chain=forward dst-address=192.168.100.156 src-address=\
192.168.168.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
add action=masquerade chain=srcnat disabled=yes src-address=192.168.168.0/24
add action=masquerade chain=srcnat disabled=yes src-address=192.168.100.156
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.100.153 \
pref-src="" routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/system clock
set time-zone-name=Europe/Prague
Určitě by se mi líbila víc první varianta, pokud by to šlo nějak udělat. Rozhodně si vážím pomoci a děkuji všem za ni.
