Moc děkuji všem za správné nakopnutí. Už mi to funguje jak jsem chtěl. Ale mám dotaz, ze sítě 192.168.168.0/24 si nepingnu bránu 172.30.20.153, což je správně a to chci. Ale pingnu si IP 172.30.20.1 a nevím proč. Takový interface ani IP v síti nemám.
Tady je můj současný konfigurák.
/interface bridge
add name=bridge-michal
add name=bridge-sb
/interface list
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool1 ranges=192.168.168.2-192.168.168.254
add name=dhcp_pool3 ranges=172.30.20.154
/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge-michal name=dhcp1
add address-pool=dhcp_pool3 interface=bridge-sb name=dhcp2
/port
set 0 name=serial0
/routing table
add fib name=IRT-TEST
add fib name=IRT-TEST2
add fib name=sb
add fib name=michal
/interface bridge port
add bridge=bridge-michal disabled=yes interface=ether1
add bridge=bridge-michal interface=ether2
add bridge=bridge-sb interface=ether3
add bridge=bridge-michal interface=ether4
add bridge=bridge-michal interface=ether5
add bridge=bridge-michal interface=ether6
add bridge=bridge-michal interface=ether7
add bridge=bridge-michal interface=ether8
add bridge=bridge-michal interface=ether9
add bridge=bridge-michal interface=ether10
add bridge=bridge-michal interface=sfp1
/interface list member
add interface=ether1 list=WAN
/ip address
add address=192.168.100.154/29 comment=michal-public interface=ether1 \
network=192.168.100.152
add address=192.168.100.155/29 comment=sb-public interface=ether1 network=\
192.168.100.152
add address=172.30.20.153/30 comment=sb-wan interface=ether3 network=\
172.30.20.152
add address=192.168.168.1/24 comment=michal-int interface=bridge-michal \
network=192.168.168.0
/ip dhcp-server network
add address=172.30.20.152/30 gateway=172.30.20.153
add address=192.168.168.0/24 gateway=192.168.168.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip firewall address-list
add address=192.168.168.2-192.168.168.254 list=allowed_to_router
add address=172.30.20.155 list=allowed_to_router
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=\
not_in_internet
/ip firewall filter
add action=drop chain=forward in-interface=bridge-michal out-interface=\
bridge-sb
add action=drop chain=forward in-interface=bridge-sb out-interface=\
bridge-michal
add action=drop chain=input dst-address=172.30.20.152/29 in-interface=\
bridge-michal
add action=drop chain=input dst-address=192.168.168.0/24 in-interface=\
bridge-sb
add action=accept chain=input comment="default configuration" \
connection-state=established,related
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input protocol=icmp
add action=drop chain=input
add action=fasttrack-connection chain=forward comment=FastTrack \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="Established, Related" \
connection-state=established,related
add action=drop chain=forward comment="Drop invalid" connection-state=invalid \
log=yes log-prefix=invalid
add action=jump chain=forward comment="jump to ICMP filters" jump-target=icmp \
protocol=icmp
add action=drop chain=forward comment=\
"Drop incoming from internet which is not public IP" in-interface=ether1 \
log=yes log-prefix=!public src-address-list=not_in_internet
add action=drop chain=forward comment=\
"Drop packets from LAN that do not have LAN IP" in-interface=\
bridge-michal log=yes log-prefix=LAN_!LAN src-address=!192.168.168.0/24
add action=drop chain=forward comment=\
"Drop packets from LAN that do not have LAN IP" in-interface=bridge-sb \
log=yes log-prefix=LAN_!LAN src-address=!172.30.20.155
add action=accept chain=icmp comment="echo reply" icmp-options=0:0 protocol=\
icmp
add action=accept chain=icmp comment="net unreachable" icmp-options=3:0 \
protocol=icmp
add action=accept chain=icmp comment="host unreachable" icmp-options=3:1 \
protocol=icmp
add action=accept chain=icmp comment=\
"host unreachable fragmentation required" icmp-options=3:4 protocol=icmp
add action=accept chain=icmp comment="allow echo request" icmp-options=8:0 \
protocol=icmp
add action=accept chain=icmp comment="allow time exceed" icmp-options=11:0 \
protocol=icmp
add action=accept chain=icmp comment="allow parameter bad" icmp-options=12:0 \
protocol=icmp
add action=drop chain=icmp comment="deny all other types"
/ip firewall nat
add action=src-nat chain=srcnat src-address=172.30.20.154 to-addresses=\
192.168.100.155
add action=src-nat chain=srcnat src-address=192.168.168.0/24 to-addresses=\
192.168.100.154
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=192.168.100.153 \
pref-src=0.0.0.0 routing-table=main scope=30 suppress-hw-offload=no \
target-scope=10
/system clock
set time-zone-name=Europe/Prague
