Kategoria - MikroTik - liczba wpisów 29

Mikrotik - AccessPoint with LTE WAN Kategoria: MikroTik | Tagi: lte, mikrotik | Autor: Bartłomiej Gałęzia

1. Default configuration

System -> Reset Configuration -> [check] No Default Configuration -> [Reset Configuration]

System -> Users -> [admin] -> Password -> ***** -> [OK]

System -> Identity -> [MyMikrotik] -> [OK]

System -> Clock

Time: [current time]

Date: [current date]

Time Zone Name: Europe/Warsaw

Zobacz całość

Mikrotik - Firewall - Podstawowe reguły Kategoria: MikroTik | Tagi: firewall, mikrotik | Autor: Bartłomiej Gałęzia

1. Najpierw trzeba ustawić maskaradę na interfejsie WAN (jeśli adres IP WAN jest zmienny) lub srcnat (jeśli adres IP WAN jest stały).

IP > Firewall > [zakładka] NAT > [+]
[zakładka] General
Chain: srcnat
Out Interface: ether1-WAN
[zakładka] Action
Action: masquerade
OK

lub

IP > Firewall > [zakładka] NAT > [+]
[zakładka] General
Chain: srcnat
Out Interface: ether1-WAN
[zakładka] Action
Action: src-nat
To Addresses: 10.20.30.1
OK

2. Teraz wpuszczamy wszystkie połączenia nawiązane (Established, Related).

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
Connection State: established,related
[zakładka] Action
Action: accept
OK

3. Wpuszczamy połączenia do serwera DHCP

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: input
Protocol: 17 (udp)
Dst: Port: 67,68
In Interface: bridge_lan
[zakładka] Action
Action: accept
OK

4. Wpuszczamy wszystko w naszej podsieci

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
Src. Address: 10.50.0.0/16
In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: accept OK

5. Blokujemy torrenty na portach 6881-6999

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
Protocol: 17 (udp)
Dst. Port: 6881-6999 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK

6. Blokujemy ruch z podsieci .100 (opcjonalnie)

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
Src. Address: 10.50.100.0/24
In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK

7. Dopuszczamy sieci VPN

IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets
Address: 10.10.0.0./16
[OK]
IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets
Address: 10.30.0.0./16
[OK]
IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
In Interface: bridge_lan
Out Interface: bridge_lan

[zakładka] Advanced
Src. Address List: vpn-nets

[zakładka] Action
Action: accept

[OK]

8. Blokujemy wszystko pozostałe

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: forward
In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK

Wiersz poleceń

/ip firewall nat add action=src-nat chain=srcnat out-interface=ether1-WAN to-addresses=10.50.30.1
/ip firewall filter add action=accept chain=forward comment="Accept Established, Related" connection-state=established,related
/ip firewall filter add action=accept chain=input comment="Accept DHCP" dst-port=67,68 in-interface=bridge_lan protocol=udp
/ip firewall filter add action=drop chain=forward comment="Drop Torrent" dst-port=6881-6999 in-interface=bridge_lan out-interface=bridge_lan protocol=udp
/ip firewall filter add action=drop chain=forward comment="Drop forward from 10.50.100.0/24" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.100.0/24
/ip firewall filter add action=accept chain=forward comment="Accept from vpn-nets" in-interface=bridge_lan out-interface=bridge_lan src-address-list=vpn-nets
/ip firewall filter add action=accept chain=forward comment="Accept from 10.50.0.0/16" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.0.0/16
/ip firewall filter add action=drop chain=forward comment="Drop All" in-interface=bridge_lan out-interface=bridge_lan

Dzielenie pasma 100Mb na protokoły:

main - 40Mb

web - 30Mb

ftp - 10Mb

udp - 10Mb

ssh - 8Mb

icmp - 2Mb

Zobacz całość

Mikrotik - Wykrywanie skanowania portów Kategoria: MikroTik | Tagi: mikrotik, port scanning | Autor: Bartłomiej Gałęzia

IP -> Firewall -> [zakładka] Filter Rules -> [+]
Chain: forward
Protocol: 6 (tcp)

[zakładka] Extra
PSD:
Weight Threshold: 21
Delay Threshold: 00:00:03
Low Port Weight: 3
High Port Weight: 1

[zakładka] Action
Action: add src to address list
Address List: TCP Port scanner

[OK]

To samo należy ustawić dla UDP

Queues -> [zakładka] Simple Queue -> [+]
Name: wifi_equal

Target: 192.168.2.0/24

Target Upload Max Limit: 100M
Target Download Max Limit: 100M

[zakładka] Advanced

Target Upload
Queue Type: pcq-upload-default
Target Download
Queue Type: pcq-download-default

(PCQ Per Connection Queue)

[OK]
IP -> Firewall -> [zakładka] NAT -> [+]
Chain: dstnat
Src. Address: 10.20.30.0/24
Protocol: 6 (tcp)
Dst. Port: 80

[zakładka] Actions
Action: dst-nat
To Address: 10.20.30.100

[OK]

Mikrotik - Alert jeśli wykryje inny DHCP w sieci Kategoria: MikroTik | Tagi: dhcp alert, mikrotik | Autor: Bartłomiej Gałęzia

IP -> DHCP Server -> [zakładka] Alerts [+]

Interface: bridge_LAN

Alert Timeout: 01:00:00

On Alert:

:local emailAddress "user@domain.com"
:local hostname [/system identity get name]
:local message "Znaleziono inny DHCP w sieci"

/tool e-mail send to="$emailAddress" subject="[$hostname] DHCP Server Alert" body="$message"
/log warning $message

:beep frequency=500 length=500ms;
:delay 500ms;
 
:beep frequency=500 length=500ms;
:delay 500ms;

:beep frequency=500 length=500ms;
:delay 500ms;

:beep frequency=400 length=500ms;
:delay 400ms;

:beep frequency=600 length=200ms;
:delay 100ms;

:beep frequency=500 length=500ms;
:delay 500ms;

:beep frequency=400 length=500ms;
:delay 400ms;

:beep frequency=600 length=200ms;
:delay 100ms;

:beep frequency=500 length=500ms;
:delay 1000ms;



:beep frequency=750 length=500ms;
:delay 500ms;

:beep frequency=750 length=500ms;
:delay 500ms;

:beep frequency=750 length=500ms;
:delay 500ms;

:beep frequency=810 length=500ms;
:delay 400ms;

:beep frequency=600 length=200ms;
:delay 100ms;

:beep frequency=470 length=500ms;
:delay 500ms;

:beep frequency=400 length=500ms;
:delay 400ms;

:beep frequency=600 length=200ms;
:delay 100ms;

:beep frequency=500 length=500ms;
:delay 1000ms;

https://github.com/houruck/mikrotik-imperial-march

Mikrotik - Pokaż komentarze jako kolumnę w tabeli Kategoria: MikroTik | Tagi: mikrotik | Autor: Bartłomiej Gałęzia

Na dowolnej liście z komentarzami kliknij prawym klawiszem myszy i wybierz opcję "Inline Comments".

/export file=export_date_ters.rsc ters

Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga

IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting
[zakładka] Advanced
Src. Address List: Download_1G

[zakładka] Action
Action: mark packet
New Packet Mark: 1G_slow
[ ] Passthrough #important!

[OK]
Queues -> [zakładka] Simple Queues -> [+]
Name: 1G_slow
Target: 0.0.0.0/0 #wszystkie adresy
Target Upload Max Limit: 10M
Target Download Max Limit: 10M
[zakładka] Advanced
Packet Marks: 1G_slow
[OK]

Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga

System -> Scripts -> [+]
Name = "Download 1G"
Source

Zobacz całość

Mikrotik - Log prefix - Send email Kategoria: MikroTik | Tagi: logs, mikrotik | Autor: Bartłomiej Gałęzia

# BEGIN SETUP
:local scheduleName "Download 10M"
:local emailAddress "biuro@cssoft.pl"
:local startBuf [:toarray [/log find message~"sciaga_10M"]]
:local hostname [/system identity get name]

# END SETUP

# warn if schedule does not exist
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
  /log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name"
}

# get last time
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
# for checking time of each log entry
:local currentTime
# log message
:local message
 
# final output
:local output

:local keepOutput false
# if lastTime is empty, set keepOutput to true
:if ([:len $lastTime] = 0) do={
  :set keepOutput true
}


:local counter 0
# loop through all log entries that have been found
:foreach i in=$startBuf do={
 
  :local keepLog true

  :if ($keepLog = true) do={
   
   :set message [/log get $i message]

#   LOG DATE
#   depending on log date/time, the format may be different. 3 known formats
#   format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default
    :set currentTime [ /log get $i time ]
#   format of 00:00:00 which shows up on current day's logs
   :if ([:len $currentTime] = 8 ) do={
     :set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
    } else={
#     format of jan/01 00:00:00 which shows up on previous day's logs
     :if ([:len $currentTime] = 15 ) do={
        :set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
      }
   }
    
#   if keepOutput is true, add this log entry to output
   :if ($keepOutput = true) do={
     :set output ($output.$currentTime." ".$message."\r\n")
   }
#   if currentTime = lastTime, set keepOutput so any further logs found will be added to output
#   reset output in the case we have multiple identical date/time entries in a row as the last matching logs
#   otherwise, it would stop at the first found matching log, thus all following logs would be output
    :if ($currentTime = $lastTime) do={
     :set keepOutput true
     :set output ""
   }
  }

#   if this is last log entry
  :if ($counter = ([:len $startBuf]-1)) do={
#   If keepOutput is still false after loop, this means lastTime has a value, but a matching currentTime was never found.
#   This can happen if 1) The router was rebooted and matching logs stored in memory were wiped, or 2) An item is added
#   to the removeThese array that then ignores the last log that determined the lastTime variable.
#   This resets the comment to nothing. The next run will be like the first time, and you will get all matching logs
   :if ($keepOutput = false) do={
#     if previous log was found, this will be our new lastTime entry      
     :if ([:len $message] > 0) do={
        :set output ($output.$currentTime." ".$message."\r\n")
      }
    }
  }
  :set counter ($counter + 1)
}

# If we have output, save new date/time, and send email
if ([:len $output] > 0) do={
  /system scheduler set [find name="$scheduleName"] comment=$currentTime
  /tool e-mail send to="$emailAddress" subject="[$hostname] Alert [$scheduleName] - $currentTime" body="$output"
  /log info "[LOGMON] New logs found, send email"
}

https://wiki.mikrotik.com/wiki/Monitor_logs,_send_email_alert_/_run_script

https://wiki.mikrotik.com/wiki/Manual:Scripting

https://wiki.mikrotik.com/wiki/Manual:Scripting-examples

IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting
Src. Address: 10.20.30.0/24

[zakładka] Advanced
Src. Address List [!] download_1G #jeśli go nie ma na tej liście
Connection Byte: 1000M-0

[zakładka] Action
Action: add_src_to_address_list

[check] Log
Log Prefix: Download_1G
Address List: download_1G
Timeout: 24:00:00

Comment: 'Download > 1G'
[OK]
System -> Logging -> [zakładka] Rules -> [+]
Topics: firewall
action: email
[OK]

Mikrotik - Logi krytyczne zapisuj na dysku a nie w RAMie Kategoria: MikroTik | Tagi: logi, mikrotik | Autor: Bartłomiej Gałęzia

System -> Logging -> [zakładka] Rules -> [+]
Topics:
critical, error
Action:
disk
[OK]

Mikrotik - Ograniczenie prędkości do 10Mb Kategoria: MikroTik | Tagi: mikrotik, queue | Autor: Bartłomiej Gałęzia

Queues -> [zakładka] Simple Queues -> [+]
Name: queue_vlan_100
Target: 192.168.100.0/24
Target Upload:
Max Limit: 10M
Target Download:
Max Limit: 10M
[zakładka] Advanced
Target Upload:
Limit At: 10M
Target Download:
Limit At: 10M
[OK]

https://grzegorzkowalik.com/mikrotik-od-zera-ograniczenie-pasma-06/

Mikrotik - Setup VLAN Kategoria: MikroTik | Tagi: mikrotik, vlan | Autor: Bartłomiej Gałęzia

Brigde -> [zakładka] Bridge -> [+]
Name: bridge_vlan_100
[OK]
Brigde -> [zakładka] Ports -> [+]
Interface: ether5 (ether6, ether7, ether8)
Bridge: bridge_vlan_100
[OK]
Interfaces -> [zakładka] VLAN -> [+]
Name: vlan_100
VLAN ID: 100
Interface: bridge_vlan_100
[OK]
IP -> Addresses -> [+]
Address: 192.168.100.1/24
Network: 192.168.100.0
Interface: bridge_vlan_100
[OK]
IP -> Pool -> [+]
Name: pool_vlan_100
Addresses: 192.168.100.150-192.168.100.200
[OK]
IP -> DHCP Server -> [zakładka] DHCP -> [+]
Name: dhcp_vlan_100
Interface: bridge_vlan_100
Address Pool: pool_vlan_100
[OK]
IP -> DHCP Server -> [zakładka] Networks -> [+]
Address: 192.168.100.0/24
Gateway: 192.168.100.1
DNS Servers: 8.8.8.8
[OK]

https://www.youtube.com/watch?v=mKmE9Iv3lhY

IP > DHCP Server > [+] > zakładka [Script]

Lease Script:

:local recipient "user@domain.com"
/ip dhcp-server lease

:if ($leaseBound = 1 && ([/ip dhcp-server lease find where dynamic mac-address=$leaseActMAC])) do={
	:do {
        :local dhcphostname $"lease-hostname"        
		:tool e-mail send to=$recipient subject="DHCP Address Alert [$leaseActIP] [$leaseActMAC] [$dhcphostname]" body="MAC address: [$leaseActMAC]\nIP address: [$leaseActIP]\nDHCP Server: [$leaseServerName]\nHostname: [$dhcphostname]"
		#:log info "Sent DHCP alert for MAC $leaseActMAC"
        
	} on-error={:log error "Failed to send alert email to $recipient"}}

https://forum.mikrotik.com/viewtopic.php?t=153641

Interfaces > [zakładka] Interfaces List > [Lists] > [+]
Name: allow_winbox > [OK]
Interfaces > [zakładka] Interfaces List > [+]
List: allow_winbox
Interface: ether2
[OK]

Teraz ustawiamy listę adresów z której będzie można wyszukiwać winboxa.

IP ->Neighbors -> [Discovery Settings]
Interface: [ ] allow winbox
[OK]

Teraz wyszukiwanie przez winboxa będzie dostępne tylko z interfejsu ether2.

Z ether1-WAN nikt nie wyszuka.

Można jeszcze dodać blokowanie portu winbox 8291 na interfejsie ether1-WAN żeby nikt z zewnątrz się nie podłączył.

IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: input
Protocol: 6 (tcp)
Dst. Port: 8291
In. Interface: ether1-WAN
[zakładka] Action
Action: drop
[OK]

Mikrotik - Logs backup - Local, FTP, e-mail Kategoria: MikroTik | Tagi: backup, logs, mikrotik | Autor: Bartłomiej Gałęzia

Skrypt do zrzucania logów do pliku + wysyłanie ich na maila i FTP

System -> Scripts -> [+]
Name = "Logs_backup"
Source
 # months array
 :local months ("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec");

 # get time
 :local ts [/system clock get time]
 :set ts ([:pick $ts 0 2].[:pick $ts 3 5].[:pick $ts 6 8])

 # get Date
 :local ds [/system clock get date]

 # convert name of month to number
 :local month [ :pick $ds 0 3 ];
 :local mm ([ :find $months $month -1 ] + 1);
 :if ($mm < 10) do={ :set mm ("0" . $mm); }

 # set $ds to format YYYY-MM-DD
 :set ds ([:pick $ds 7 11] . $mm . [:pick $ds 4 6])

 # file name for logs backup - servername-YYYYMMDD-HHMMSS_logs.txt
 :local fname ([/system identity get name]."-".$ds."-".$ts."_logs.txt")
 :local sfname ("/".$fname1)

 # backup logs
 /log print file=$sfname1
 :log info message="Logs backup finished (1/1).";

# ftp server
 :local ftphost "192.168.1.1"
 :local ftpuser "ftp_user"
 :local ftppassword "ftp_password"
 :local ftppath "/folder/subfolder/"

 # upload the system backup
 :log info message="Uploading logs backup (1/1)."
 /tool fetch address="$ftphost" src-path=$sfname1 user="$ftpuser" mode=ftp password="$ftppassword" dst-path="$ftppath/$fname" upload=yes

 # delay time to finish the upload - increase it if your backup file is big
 #:delay 30s;

:local mname ([/system identity get name]." - Backup logs - ".$ds)
:local mailTo "admin@domain.com"
:local emailbody ("Plik z backupem logow: ".$sfname1)

/tool e-mail send subject=$mname to=$mailTo body=$emailbody

Następnie należy dodać skrypt do Schedulera

System -> Scheduler -> [+]
Name = "Logs_backup"
Interval ="1d 00:00:00"
On Event
/system script run Logs_backup

Wyszukaj

Zapisz się do newsletera