1. Default configuration
System -> Reset Configuration -> [check] No Default Configuration -> [Reset Configuration]
System -> Users -> [admin] -> Password -> ***** -> [OK]
System -> Identity -> [MyMikrotik] -> [OK]
System -> Clock
Time: [current time]
Date: [current date]
Time Zone Name: Europe/Warsaw
Zobacz całość1. Najpierw trzeba ustawić maskaradę na interfejsie WAN (jeśli adres IP WAN jest zmienny) lub srcnat (jeśli adres IP WAN jest stały).
IP > Firewall > [zakładka] NAT > [+] [zakładka] General Chain: srcnat Out Interface: ether1-WAN [zakładka] Action Action: masquerade OK
lub
IP > Firewall > [zakładka] NAT > [+] [zakładka] General Chain: srcnat Out Interface: ether1-WAN [zakładka] Action Action: src-nat To Addresses: 10.20.30.1 OK
2. Teraz wpuszczamy wszystkie połączenia nawiązane (Established, Related).
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Connection State: established,related [zakładka] Action Action: accept OK
3. Wpuszczamy połączenia do serwera DHCP
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: input Protocol: 17 (udp) Dst: Port: 67,68 In Interface: bridge_lan [zakładka] Action Action: accept OK
4. Wpuszczamy wszystko w naszej podsieci
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Src. Address: 10.50.0.0/16 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: accept OK
5. Blokujemy torrenty na portach 6881-6999
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Protocol: 17 (udp)
Dst. Port: 6881-6999 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
6. Blokujemy ruch z podsieci .100 (opcjonalnie)
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward Src. Address: 10.50.100.0/24 In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
7. Dopuszczamy sieci VPN
IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets Address: 10.10.0.0./16 [OK]
IP > Firewall > [zakładka] Address Lists > [+]
Name: vpn-nets Address: 10.30.0.0./16 [OK]
IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General Chain: forward In Interface: bridge_lan Out Interface: bridge_lan [zakładka] Advanced Src. Address List: vpn-nets [zakładka] Action Action: accept [OK]
8. Blokujemy wszystko pozostałe
IP > Firewall > [zakładka] Filter Rules > [+] [zakładka] General Chain: forward In Interface: bridge_lan
Out Interface: bridge_lan [zakładka] Action Action: drop OK
Wiersz poleceń
/ip firewall nat add action=src-nat chain=srcnat out-interface=ether1-WAN to-addresses=10.50.30.1 /ip firewall filter add action=accept chain=forward comment="Accept Established, Related" connection-state=established,related /ip firewall filter add action=accept chain=input comment="Accept DHCP" dst-port=67,68 in-interface=bridge_lan protocol=udp /ip firewall filter add action=drop chain=forward comment="Drop Torrent" dst-port=6881-6999 in-interface=bridge_lan out-interface=bridge_lan protocol=udp /ip firewall filter add action=drop chain=forward comment="Drop forward from 10.50.100.0/24" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.100.0/24 /ip firewall filter add action=accept chain=forward comment="Accept from vpn-nets" in-interface=bridge_lan out-interface=bridge_lan src-address-list=vpn-nets /ip firewall filter add action=accept chain=forward comment="Accept from 10.50.0.0/16" in-interface=bridge_lan out-interface=bridge_lan src-address=10.50.0.0/16 /ip firewall filter add action=drop chain=forward comment="Drop All" in-interface=bridge_lan out-interface=bridge_lan
Dzielenie pasma 100Mb na protokoły:
main - 40Mb
web - 30Mb
ftp - 10Mb
udp - 10Mb
ssh - 8Mb
icmp - 2Mb
Zobacz całość
IP -> Firewall -> [zakładka] Filter Rules -> [+]
Chain: forward Protocol: 6 (tcp) [zakładka] Extra PSD: Weight Threshold: 21 Delay Threshold: 00:00:03 Low Port Weight: 3 High Port Weight: 1 [zakładka] Action Action: add src to address list Address List: TCP Port scanner [OK]
To samo należy ustawić dla UDP
Queues -> [zakładka] Simple Queue -> [+]
Name: wifi_equal Target: 192.168.2.0/24 Target Upload Max Limit: 100M Target Download Max Limit: 100M [zakładka] Advanced Target Upload Queue Type: pcq-upload-default Target Download Queue Type: pcq-download-default (PCQ Per Connection Queue) [OK]
IP -> Firewall -> [zakładka] NAT -> [+]
Chain: dstnat Src. Address: 10.20.30.0/24 Protocol: 6 (tcp) Dst. Port: 80 [zakładka] Actions Action: dst-nat To Address: 10.20.30.100 [OK]
IP -> DHCP Server -> [zakładka] Alerts [+]
Interface: bridge_LAN
Alert Timeout: 01:00:00
On Alert:
:local emailAddress "user@domain.com"
:local hostname [/system identity get name]
:local message "Znaleziono inny DHCP w sieci"
/tool e-mail send to="$emailAddress" subject="[$hostname] DHCP Server Alert" body="$message"
/log warning $message
:beep frequency=500 length=500ms; :delay 500ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 1000ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=750 length=500ms; :delay 500ms; :beep frequency=810 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=470 length=500ms; :delay 500ms; :beep frequency=400 length=500ms; :delay 400ms; :beep frequency=600 length=200ms; :delay 100ms; :beep frequency=500 length=500ms; :delay 1000ms;
Na dowolnej liście z komentarzami kliknij prawym klawiszem myszy i wybierz opcję "Inline Comments".
/export file=export_date_ters.rsc ters
Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga
IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting [zakładka] Advanced Src. Address List: Download_1G [zakładka] Action Action: mark packet New Packet Mark: 1G_slow [ ] Passthrough #important! [OK]
Queues -> [zakładka] Simple Queues -> [+]
Name: 1G_slow Target: 0.0.0.0/0 #wszystkie adresy Target Upload Max Limit: 10M Target Download Max Limit: 10M [zakładka] Advanced Packet Marks: 1G_slow [OK]
Kontynuacja postu: https://blog.cssoft.pl/post/mikrotik-wysylaj-maila-jesli-ktos-duzo-sciaga
System -> Scripts -> [+] Name = "Download 1G" Source
Zobacz całość
# BEGIN SETUP
:local scheduleName "Download 10M"
:local emailAddress "biuro@cssoft.pl"
:local startBuf [:toarray [/log find message~"sciaga_10M"]]
:local hostname [/system identity get name]
# END SETUP
# warn if schedule does not exist
:if ([:len [/system scheduler find name="$scheduleName"]] = 0) do={
/log warning "[LOGMON] ERROR: Schedule does not exist. Create schedule and edit script to match name"
}
# get last time
:local lastTime [/system scheduler get [find name="$scheduleName"] comment]
# for checking time of each log entry
:local currentTime
# log message
:local message
# final output
:local output
:local keepOutput false
# if lastTime is empty, set keepOutput to true
:if ([:len $lastTime] = 0) do={
:set keepOutput true
}
:local counter 0
# loop through all log entries that have been found
:foreach i in=$startBuf do={
:local keepLog true
:if ($keepLog = true) do={
:set message [/log get $i message]
# LOG DATE
# depending on log date/time, the format may be different. 3 known formats
# format of jan/01/2002 00:00:00 which shows up at unknown date/time. Using as default
:set currentTime [ /log get $i time ]
# format of 00:00:00 which shows up on current day's logs
:if ([:len $currentTime] = 8 ) do={
:set currentTime ([:pick [/system clock get date] 0 11]." ".$currentTime)
} else={
# format of jan/01 00:00:00 which shows up on previous day's logs
:if ([:len $currentTime] = 15 ) do={
:set currentTime ([:pick $currentTime 0 6]."/".[:pick [/system clock get date] 7 11]." ".[:pick $currentTime 7 15])
}
}
# if keepOutput is true, add this log entry to output
:if ($keepOutput = true) do={
:set output ($output.$currentTime." ".$message."\r\n")
}
# if currentTime = lastTime, set keepOutput so any further logs found will be added to output
# reset output in the case we have multiple identical date/time entries in a row as the last matching logs
# otherwise, it would stop at the first found matching log, thus all following logs would be output
:if ($currentTime = $lastTime) do={
:set keepOutput true
:set output ""
}
}
# if this is last log entry
:if ($counter = ([:len $startBuf]-1)) do={
# If keepOutput is still false after loop, this means lastTime has a value, but a matching currentTime was never found.
# This can happen if 1) The router was rebooted and matching logs stored in memory were wiped, or 2) An item is added
# to the removeThese array that then ignores the last log that determined the lastTime variable.
# This resets the comment to nothing. The next run will be like the first time, and you will get all matching logs
:if ($keepOutput = false) do={
# if previous log was found, this will be our new lastTime entry
:if ([:len $message] > 0) do={
:set output ($output.$currentTime." ".$message."\r\n")
}
}
}
:set counter ($counter + 1)
}
# If we have output, save new date/time, and send email
if ([:len $output] > 0) do={
/system scheduler set [find name="$scheduleName"] comment=$currentTime
/tool e-mail send to="$emailAddress" subject="[$hostname] Alert [$scheduleName] - $currentTime" body="$output"
/log info "[LOGMON] New logs found, send email"
}
https://wiki.mikrotik.com/wiki/Monitor_logs,_send_email_alert_/_run_script
IP -> Firewall -> [zakładka] Mangle -> [+]
Chain: prerouting Src. Address: 10.20.30.0/24 [zakładka] Advanced Src. Address List [!] download_1G #jeśli go nie ma na tej liście Connection Byte: 1000M-0 [zakładka] Action Action: add_src_to_address_list [check] Log Log Prefix: Download_1G Address List: download_1G Timeout: 24:00:00 Comment: 'Download > 1G' [OK]
System -> Logging -> [zakładka] Rules -> [+]
Topics: firewall action: email [OK]
System -> Logging -> [zakładka] Rules -> [+]
Topics: critical, error Action: disk [OK]
Queues -> [zakładka] Simple Queues -> [+] Name: queue_vlan_100 Target: 192.168.100.0/24 Target Upload: Max Limit: 10M Target Download: Max Limit: 10M [zakładka] Advanced Target Upload: Limit At: 10M Target Download: Limit At: 10M [OK]
https://grzegorzkowalik.com/mikrotik-od-zera-ograniczenie-pasma-06/
Brigde -> [zakładka] Bridge -> [+] Name: bridge_vlan_100 [OK]
Brigde -> [zakładka] Ports -> [+] Interface: ether5 (ether6, ether7, ether8) Bridge: bridge_vlan_100 [OK]
Interfaces -> [zakładka] VLAN -> [+] Name: vlan_100 VLAN ID: 100 Interface: bridge_vlan_100 [OK]
IP -> Addresses -> [+] Address: 192.168.100.1/24 Network: 192.168.100.0 Interface: bridge_vlan_100 [OK]
IP -> Pool -> [+] Name: pool_vlan_100 Addresses: 192.168.100.150-192.168.100.200 [OK]
IP -> DHCP Server -> [zakładka] DHCP -> [+] Name: dhcp_vlan_100 Interface: bridge_vlan_100 Address Pool: pool_vlan_100 [OK]
IP -> DHCP Server -> [zakładka] Networks -> [+] Address: 192.168.100.0/24 Gateway: 192.168.100.1 DNS Servers: 8.8.8.8 [OK]
IP > DHCP Server > [+] > zakładka [Script]
Lease Script:
:local recipient "user@domain.com"
/ip dhcp-server lease
:if ($leaseBound = 1 && ([/ip dhcp-server lease find where dynamic mac-address=$leaseActMAC])) do={
:do {
:local dhcphostname $"lease-hostname"
:tool e-mail send to=$recipient subject="DHCP Address Alert [$leaseActIP] [$leaseActMAC] [$dhcphostname]" body="MAC address: [$leaseActMAC]\nIP address: [$leaseActIP]\nDHCP Server: [$leaseServerName]\nHostname: [$dhcphostname]"
#:log info "Sent DHCP alert for MAC $leaseActMAC"
} on-error={:log error "Failed to send alert email to $recipient"}}
Interfaces > [zakładka] Interfaces List > [Lists] > [+]
Name: allow_winbox > [OK]
Interfaces > [zakładka] Interfaces List > [+]
List: allow_winbox Interface: ether2
[OK]
Teraz ustawiamy listę adresów z której będzie można wyszukiwać winboxa.
IP ->Neighbors -> [Discovery Settings]
Interface: [ ] allow winbox [OK]
Teraz wyszukiwanie przez winboxa będzie dostępne tylko z interfejsu ether2.
Z ether1-WAN nikt nie wyszuka.
Można jeszcze dodać blokowanie portu winbox 8291 na interfejsie ether1-WAN żeby nikt z zewnątrz się nie podłączył.
IP > Firewall > [zakładka] Filter Rules > [+]
[zakładka] General
Chain: input Protocol: 6 (tcp) Dst. Port: 8291 In. Interface: ether1-WAN [zakładka] Action Action: drop [OK]
Skrypt do zrzucania logów do pliku + wysyłanie ich na maila i FTP
System -> Scripts -> [+]
Name = "Logs_backup"
Source
# months array
:local months ("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec");
# get time
:local ts [/system clock get time]
:set ts ([:pick $ts 0 2].[:pick $ts 3 5].[:pick $ts 6 8])
# get Date
:local ds [/system clock get date]
# convert name of month to number
:local month [ :pick $ds 0 3 ];
:local mm ([ :find $months $month -1 ] + 1);
:if ($mm < 10) do={ :set mm ("0" . $mm); }
# set $ds to format YYYY-MM-DD
:set ds ([:pick $ds 7 11] . $mm . [:pick $ds 4 6])
# file name for logs backup - servername-YYYYMMDD-HHMMSS_logs.txt
:local fname ([/system identity get name]."-".$ds."-".$ts."_logs.txt")
:local sfname ("/".$fname1)
# backup logs
/log print file=$sfname1
:log info message="Logs backup finished (1/1).";
# ftp server
:local ftphost "192.168.1.1"
:local ftpuser "ftp_user"
:local ftppassword "ftp_password"
:local ftppath "/folder/subfolder/"
# upload the system backup
:log info message="Uploading logs backup (1/1)."
/tool fetch address="$ftphost" src-path=$sfname1 user="$ftpuser" mode=ftp password="$ftppassword" dst-path="$ftppath/$fname" upload=yes
# delay time to finish the upload - increase it if your backup file is big
#:delay 30s;
:local mname ([/system identity get name]." - Backup logs - ".$ds)
:local mailTo "admin@domain.com"
:local emailbody ("Plik z backupem logow: ".$sfname1)
/tool e-mail send subject=$mname to=$mailTo body=$emailbody
Następnie należy dodać skrypt do Schedulera
System -> Scheduler -> [+]
Name = "Logs_backup" Interval ="1d 00:00:00" On Event /system script run Logs_backup