1. Default configuration
System -> Reset Configuration -> [check] No Default Configuration -> [Reset Configuration]
System -> Users -> [admin] -> Password -> ***** -> [OK]
System -> Identity -> [MyMikrotik] -> [OK]
System -> Clock
Time: [current time]
Date: [current date]
Time Zone Name: Europe/Warsaw
Zobacz całość1. Najpierw trzeba ustawić maskaradę na interfejsie WAN (jeśli adres IP WAN jest zmienny) lub srcnat (jeśli adres IP WAN jest stały).
IP > Firewall > [zakładka] NAT > [+] [zakładka] General Chain: srcnat Out Interface: ether1-WAN [zakładka] Action Action: masquerade OK
lub
IP > Firewall > [zakładka] NAT > [+] [zakładka] General Chain: srcnat Out Interface: ether1-WAN [zakładka] Action Action: src-nat To Addresses: 10.20.30.1 OK
2. Teraz wpuszczamy wszystkie połączenia nawiązane (Established, Related).
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Connection State: established,related [zakładka] Action Action: accept OK
3. Wpuszczamy połączenia do serwera DHCP
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: input Protocol: 17 (udp) Dst: Port: 67,68 In Interface: bridge_lan [zakładka] Action Action: accept OK
4. Wpuszczamy wszystko w naszej podsieci
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Src. Address: 10.50.0.0/16 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: accept OK
5. Blokujemy torrenty na portach 6881-6999
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Protocol: 17 (udp)
Dst. Port: 6881-6999 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
6. Blokujemy ruch z podsieci .100 (opcjonalnie)
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Src. Address: 10.50.100.0/24 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
7. Dopuszczamy sieci VPN
IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets Address: 10.10.0.0./16 [OK]
IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets Address: 10.30.0.0./16 [OK]
IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General Chain: forward In Interface: bridge_lan Out Interface: bridge_lan [zakładka] Advanced Src. Address List: vpn-nets [zakładka] Action Action: accept [OK]
8. Blokujemy wszystko pozostałe
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
Wiersz poleceń
/ip firewall nat add action=src-nat chain=srcnat out-interface=ether1-WAN to-addresses=10.50.30.1 /ip firewall filter add action=accept chain=forward comment="Accept Established, Related" connection-state=established,related /ip firewall filter add action=accept chain=input comment="Accept DHCP" dst-port=67,68 in-interface=bridge_lan protocol=udp /ip firewall filter add action=drop chain=forward comment="Drop Torrent" dst-port=6881-6999 in-interface=bridge_lan out-interface=bridge_lan protocol=udp /ip firewall filter add action=drop chain=forward comment="Drop forward from 10.50.100.0/24" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.100.0/24 /ip firewall filter add action=accept chain=forward comment="Accept from vpn-nets" in-interface=bridge_lan out-interface=bridge_lan src-address-list=vpn-nets /ip firewall filter add action=accept chain=forward comment="Accept from 10.50.0.0/16" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.0.0/16 /ip firewall filter add action=drop chain=forward comment="Drop All" in-interface=bridge_lan out-interface=bridge_lan
Dzielenie pasma 100Mb na protokoły:
main - 40Mb
web - 30Mb
ftp - 10Mb
udp - 10Mb
ssh - 8Mb
icmp - 2Mb
Zobacz całość
IP -> Firewall -> [zakładka] Filter Rules -> [+]
Chain: forward Protocol: 6 (tcp) [zakładka] Extra PSD: Weight Threshold: 21 Delay Threshold: 00:00:03 Low Port Weight: 3 High Port Weight: 1 [zakładka] Action Action: add src to address list Address List: TCP Port scanner [OK]
To samo należy ustawić dla UDP
Queues -> [zakładka] Simple Queue -> [+]
Name: wifi_equal Target: 192.168.2.0/24 Target Upload Max Limit: 100M Target Download Max Limit: 100M [zakładka] Advanced Target Upload Queue Type: pcq-upload-default Target Download Queue Type: pcq-download-default (PCQ Per Connection Queue) [OK]
IP -> Firewall -> [zakładka] NAT -> [+]
Chain: dstnat Src. Address: 10.20.30.0/24 Protocol: 6 (tcp) Dst. Port: 80 [zakładka] Actions Action: dst-nat To Address: 10.20.30.100 [OK]
IP -> DHCP Server -> [zakładka] Alerts [+]
Interface: bridge_LAN
Alert Timeout: 01:00:00
On Alert:
:local emailAddress "user@domain.com"
:local hostname [/system identity get name]
:local message "Znaleziono inny DHCP w sieci"
/tool e-mail send to="$emailAddress" subject="[$hostname] DHCP Server Alert" body="$message"
/log warning $message
:beep frequency=500 length=500ms; :delay 500ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 1000ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=810 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=470 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 1000ms;
Na dowolnej liście z komentarzami kliknij prawym klawiszem myszy i wybierz opcję "Inline Comments".
/export file=export_date_ters.rsc ters
Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga
IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting [zakładka] Advanced Src. Address List: Download_1G [zakładka] Action Action: mark packet New Packet Mark: 1G_slow [ ] Passthrough #important! [OK]
Queues -> [zakładka] Simple Queues -> [+]
Name: 1G_slow Target: 0.0.0.0/0 #wszystkie adresy Target Upload Max Limit: 10M Target Download Max Limit: 10M [zakładka] Advanced Packet Marks: 1G_slow [OK]
Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga
System -> Scripts -> [+] Name = "Download 1G" Source
Zobacz całość
# BEGIN SETUP :local scheduleName "Download 10M" :local emailAddress "biuro@cssoft.pl" :local startBuf [:toarray [/log find message~"sciaga_10M"]] :local hostname [/system identity get name] # END SETUP # warn if schedule does not exist :if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={ /log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name" } # get last time :local lastTime [/system scheduler get [find name="$scheduleName"] comment] # for checking time of each log entry :local currentTime # log message :local message # final output :local output :local keepOutput false # if lastTime is empty, set keepOutput to true :if ([:len $lastTime] = 0) do={ :set keepOutput true } :local counter 0 # loop through all log entries that have been found :foreach i in=$startBuf do={ :local keepLog true :if ($keepLog = true) do={ :set message [/log get $i message] # LOG DATE # depending on log date/time, the format may be different. 3 known formats # format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default :set currentTime [ /log get $i time ] # format of 00:00:00 which shows up on current day's logs :if ([:len $currentTime] = 8 ) do={ :set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime) } else={ # format of jan/01 00:00:00 which shows up on previous day's logs :if ([:len $currentTime] = 15 ) do={ :set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15]) } } # if keepOutput is true, add this log entry to output :if ($keepOutput = true) do={ :set output ($output.$currentTime." ".$message."\r\n") } # if currentTime = lastTime, set keepOutput so any further logs found will be added to output # reset output in the case we have multiple identical date/time entries in a row as the last matching logs # otherwise, it would stop at the first found matching log, thus all following logs would be output :if ($currentTime = $lastTime) do={ :set keepOutput true :set output "" } } # if this is last log entry :if ($counter = ([:len $startBuf]-1)) do={ # If keepOutput is still false after loop, this means lastTime has a value, but a matching currentTime was never found. # This can happen if 1) The router was rebooted and matching logs stored in memory were wiped, or 2) An item is added # to the removeThese array that then ignores the last log that determined the lastTime variable. # This resets the comment to nothing. The next run will be like the first time, and you will get all matching logs :if ($keepOutput = false) do={ # if previous log was found, this will be our new lastTime entry :if ([:len $message] > 0) do={ :set output ($output.$currentTime." ".$message."\r\n") } } } :set counter ($counter + 1) } # If we have output, save new date/time, and send email if ([:len $output] > 0) do={ /system scheduler set [find name="$scheduleName"] comment=$currentTime /tool e-mail send to="$emailAddress" subject="[$hostname] Alert [$scheduleName] - $currentTime" body="$output" /log info "[LOGMON] New logs found, send email" }
https://wiki.mikrotik.com/wiki/Monitor_logs,_send_email_alert_/_run_script
IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting Src. Address: 10.20.30.0/24 [zakładka] Advanced Src. Address List [!] download_1G #jeśli go nie ma na tej liście Connection Byte: 1000M-0 [zakładka] Action Action: add_src_to_address_list [check] Log Log Prefix: Download_1G Address List: download_1G Timeout: 24:00:00 Comment: 'Download > 1G' [OK]
System -> Logging -> [zakładka] Rules -> [+]
Topics: firewall action: email [OK]
System -> Logging -> [zakładka] Rules -> [+]
Topics: critical, error Action: disk [OK]
Queues -> [zakładka] Simple Queues -> [+] Name: queue_vlan_100 Target: 192.168.100.0/24 Target Upload: Max Limit: 10M Target Download: Max Limit: 10M [zakładka] Advanced Target Upload: Limit At: 10M Target Download: Limit At: 10M [OK]
https://grzegorzkowalik.com/mikrotik-od-zera-ograniczenie-pasma-06/
Brigde -> [zakładka] Bridge -> [+] Name: bridge_vlan_100 [OK]
Brigde -> [zakładka] Ports -> [+] Interface: ether5 (ether6, ether7, ether8) Bridge: bridge_vlan_100 [OK]
Interfaces -> [zakładka] VLAN -> [+] Name: vlan_100 VLAN ID: 100 Interface: bridge_vlan_100 [OK]
IP -> Addresses -> [+] Address: 192.168.100.1/24 Network: 192.168.100.0 Interface: bridge_vlan_100 [OK]
IP -> Pool -> [+] Name: pool_vlan_100 Addresses: 192.168.100.150-192.168.100.200 [OK]
IP -> DHCP Server -> [zakładka] DHCP -> [+] Name: dhcp_vlan_100 Interface: bridge_vlan_100 Address Pool: pool_vlan_100 [OK]
IP -> DHCP Server -> [zakładka] Networks -> [+] Address: 192.168.100.0/24 Gateway: 192.168.100.1 DNS Servers: 8.8.8.8 [OK]
IP > DHCP Server > [+] > zakładka [Script]
Lease Script:
:local recipient "user@domain.com" /ip dhcp-server lease :if ($leaseBound = 1 && ([/ip dhcp-server lease find where dynamic mac-address=$leaseActMAC])) do={ :do { :local dhcphostname $"lease-hostname" :tool e-mail send to=$recipient subject="DHCP Address Alert [$leaseActIP] [$leaseActMAC] [$dhcphostname]" body="MAC address: [$leaseActMAC]\nIP address: [$leaseActIP]\nDHCP Server: [$leaseServerName]\nHostname: [$dhcphostname]" #:log info "Sent DHCP alert for MAC $leaseActMAC" } on-error={:log error "Failed to send alert email to $recipient"}}
Interfaces > [zakładka] Interfaces List > [Lists] > [+]
Name: allow_winbox > [OK]
Interfaces > [zakładka] Interfaces List > [+]
List: allow_winbox Interface: ether2
[OK]
Teraz ustawiamy listę adresów z której będzie można wyszukiwać winboxa.
IP ->Neighbors -> [Discovery Settings]
Interface: [ ] allow winbox [OK]
Teraz wyszukiwanie przez winboxa będzie dostępne tylko z interfejsu ether2.
Z ether1-WAN nikt nie wyszuka.
Można jeszcze dodać blokowanie portu winbox 8291 na interfejsie ether1-WAN żeby nikt z zewnątrz się nie podłączył.
IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: input Protocol: 6 (tcp) Dst. Port: 8291 In. Interface: ether1-WAN [zakładka] Action Action: drop [OK]
Skrypt do zrzucania logów do pliku + wysyłanie ich na maila i FTP
System -> Scripts -> [+]
Name = "Logs_backup"
Source
# months array :local months ("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec"); # get time :local ts [/system clock get time] :set ts ([:pick $ts 0 2].[:pick $ts 3 5].[:pick $ts 6 8]) # get Date :local ds [/system clock get date] # convert name of month to number :local month [ :pick $ds 0 3 ]; :local mm ([ :find $months $month -1 ] + 1); :if ($mm < 10) do={ :set mm ("0" . $mm); } # set $ds to format YYYY-MM-DD :set ds ([:pick $ds 7 11] . $mm . [:pick $ds 4 6]) # file name for logs backup - servername-YYYYMMDD-HHMMSS_logs.txt :local fname ([/system identity get name]."-".$ds."-".$ts."_logs.txt") :local sfname ("/".$fname1) # backup logs /log print file=$sfname1 :log info message="Logs backup finished (1/1)."; # ftp server :local ftphost "192.168.1.1" :local ftpuser "ftp_user" :local ftppassword "ftp_password" :local ftppath "/folder/subfolder/" # upload the system backup :log info message="Uploading logs backup (1/1)." /tool fetch address="$ftphost" src-path=$sfname1 user="$ftpuser" mode=ftp password="$ftppassword" dst-path="$ftppath/$fname" upload=yes # delay time to finish the upload - increase it if your backup file is big #:delay 30s; :local mname ([/system identity get name]." - Backup logs - ".$ds) :local mailTo "admin@domain.com" :local emailbody ("Plik z backupem logow: ".$sfname1) /tool e-mail send subject=$mname to=$mailTo body=$emailbody
Następnie należy dodać skrypt do Schedulera
System -> Scheduler -> [+]
Name = "Logs_backup" Interval ="1d 00:00:00" On Event /system script run Logs_backup