Zdravím, help my pleas :-)
- nefunguje mě Harpin NAT ani z jedné sítě
2 kam mám napsat vyjímku pro IP 192.168.111.100, aby vyděl sít 192.168.11.0/24
89.103.223.194
user: test
password: test
/interface bridge
add comment="Lan 2,4,5" name="bridge Doma"
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment="Lan servis"
set [ find default-name=ether3 ] comment="Lan Prace"
set [ find default-name=ether4 ] comment="Lan Synology"
set [ find default-name=ether5 ] comment="Lan Doma"
/interface list
add name=WAN
add name=LAN
/interface bridge port
add bridge="bridge Doma" interface=ether2
add bridge="bridge Doma" interface=ether4
add bridge="bridge Doma" interface=ether5
/interface list member
add interface=ether1 list=WAN
add interface="bridge Doma" list=LAN
add interface=ether3 list=LAN
/ip address
add address=192.168.11.1/24 interface="bridge Doma" network=192.168.11.0
add address=192.168.111.1/24 interface=ether3 network=192.168.111.0
/ip dhcp-client
add interface=ether1
/ip dhcp-server
add address-pool=dhcp_pool_Doma comment=Doma interface="bridge Doma" name=\
"dhcp Doma"
add address-pool=dhcp_pool_Prace comment=Prace interface=ether3 name=dhcp_Prace
/ip dhcp-server lease
add address=192.168.11.200 comment=Synology mac-address=D0:50:99:4F:57:67 \
server="dhcp Doma"
add address=192.168.111.100 comment=Notebook mac-address=48:BA:4E:8B:8F:CE \
server=dhcp_Prace
/ip dhcp-server network
add address=192.168.11.0/24 comment=Doma gateway=192.168.11.1 netmask=24
add address=192.168.111.0/24 comment=Prace gateway=192.168.111.1 netmask=24
/ip firewall filter
add action=add-src-to-address-list address-list=attack address-list-timeout=\
none-dynamic chain=input comment="Blokovani utoku SSH" dst-port=21-23 \
limit=5/1m,5:packet protocol=tcp src-address-list=!secure-ssh
add action=drop chain=input dst-port=21-23 protocol=tcp src-address-list=attack
add action=accept chain=input comment=SSH disabled=yes dst-port=21 protocol=tcp
add action=accept chain=input comment="default configuration" disabled=yes \
protocol=icmp
add action=accept chain=input connection-state=established disabled=yes
add action=accept chain=input connection-state=related disabled=yes
add action=accept chain=input comment="WEB interface" disabled=yes dst-port=80 \
protocol=tcp
add action=accept chain=input comment=WinBox dst-port=8291 protocol=tcp
add action=accept chain=input comment=SSH disabled=yes dst-port=22 protocol=tcp
add action=accept chain=input comment=BTest disabled=yes dst-port=2000 \
protocol=tcp
add action=accept chain=input disabled=yes dst-port=2000 protocol=udp
add action=accept chain=input comment=Telnet disabled=yes dst-port=23 protocol=\
tcp
add action=accept chain=input comment="povolit Ping" connection-state=\
established,related disabled=yes in-interface=ether1 protocol=icmp
add action=drop chain=input comment="ostatni z venku zahodit" in-interface=\
ether1
add action=accept chain=forward connection-state=established
add action=accept chain=forward connection-state=related
add action=drop chain=forward connection-state=invalid
add action=drop chain=forward comment="Izolace site z Prace" dst-address=\
192.168.11.0/24 src-address=192.168.111.0/24
/ip firewall nat
add action=masquerade chain=srcnat comment="Harpin NAT" dst-address=\
192.168.111.0/24 out-interface=ether3 src-address=192.168.111.0/24
add action=masquerade chain=srcnat comment="Harpin NAT" dst-address=\
192.168.11.0/24 out-interface="bridge Doma" src-address=192.168.11.0/24
add action=masquerade chain=srcnat comment=Masquerade out-interface-list=WAN
add action=dst-nat chain=dstnat comment=SYNOLOGY_DOMA_FTP dst-address=\
89.103.223.194 dst-port=21 in-interface=ether1 protocol=tcp to-addresses=\
192.168.11.200 to-ports=21
add action=dst-nat chain=dstnat comment="SYNOLOGY_DOMA_DS File" dst-address=\
89.103.223.194 dst-port=5000 in-interface=ether1 protocol=tcp to-addresses=\
192.168.11.200 to-ports=5000
add action=dst-nat chain=dstnat comment="SYNOLOGY_DOMA_DS File" dst-address=\
89.103.223.194 dst-port=80 in-interface=ether1 protocol=tcp to-addresses=\
192.168.11.200 to-ports=5000
add action=dst-nat chain=dstnat comment=SYNOLOGY_drive dst-address=\
89.103.223.194 dst-port=6690 in-interface=ether1 protocol=tcp to-addresses=\
192.168.11.200 to-ports=6690
/ip pool
add comment=Doma name=dhcp_pool_Doma next-pool=dhcp_pool_Doma ranges=\
192.168.11.120-192.168.11.170
add comment=Prace name=dhcp_pool_Prace next-pool=dhcp_pool_Prace ranges=\
192.168.111.120-192.168.111.170
