1 Temat przez armen10 (edytowany przez armen10 2020-06-27 09:03:14)

  • Zarejestrowany: 2014-12-17
  • Posty: 243

Temat: Gargoyle version:1.11 przekierowanie portu z WAN

Witam,
mam do Was pytanie.
Chciałbym przekierować adres lokalny 192.168.1.100 i port 8088, tak aby z zewnątrz móc się dostać, ale jak robię tradycyjnie, to nie działa. Działa tylko przekierowanie na port 80.
Do łączenia używam DDNS noip.pl. Czemu działa tylko port 80, a na reszte nie ?
Do firewalla dodałem, ale nic to nie dało...

root@Router:~# uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fe80::/10'
firewall.@rule[3].src_port='547'
firewall.@rule[3].dest_ip='fe80::/10'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-solicitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertisement'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@include[0].reload='1'
firewall.@rule[7]=rule
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[1]=include
firewall.@include[1].type='script'
firewall.@include[1].path='/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
firewall.@include[1].family='IPv4'
firewall.@include[1].reload='1'
firewall.miniupnpd=include
firewall.miniupnpd.type='script'
firewall.miniupnpd.path='/usr/share/miniupnpd/firewall.include'
firewall.miniupnpd.family='any'
firewall.miniupnpd.reload='1'
firewall.openvpn_include_file=include
firewall.openvpn_include_file.path='/etc/openvpn.firewall'
firewall.openvpn_include_file.reload='1'
firewall.vpn_zone=zone
firewall.vpn_zone.name='vpn'
firewall.vpn_zone.network='vpn'
firewall.vpn_zone.input='ACCEPT'
firewall.vpn_zone.output='ACCEPT'
firewall.vpn_zone.forward='ACCEPT'
firewall.vpn_zone.mtu_fix='1'
firewall.vpn_zone.masq='1'
firewall.vpn_lan_forwarding=forwarding
firewall.vpn_lan_forwarding.src='lan'
firewall.vpn_lan_forwarding.dest='vpn'
firewall.ra_openvpn=remote_accept
firewall.ra_openvpn.zone='wan'
firewall.ra_openvpn.local_port='1194'
firewall.ra_openvpn.remote_port='1194'
firewall.ra_openvpn.proto='udp'
firewall.vpn_wan_forwarding=forwarding
firewall.vpn_wan_forwarding.src='vpn'
firewall.vpn_wan_forwarding.dest='wan'
firewall.lan_vpn_forwarding=forwarding
firewall.lan_vpn_forwarding.src='vpn'
firewall.lan_vpn_forwarding.dest='lan'
firewall.ra_8088_8088=remote_accept
firewall.ra_8088_8088.name='freenas'
firewall.ra_8088_8088.local_port='8088'
firewall.ra_8088_8088.remote_port='8088'
firewall.ra_8088_8088.proto='tcp'
firewall.ra_8088_8088.zone='wan'
firewall.ra_443_443=remote_accept
firewall.ra_443_443.local_port='443'
firewall.ra_443_443.remote_port='443'
firewall.ra_443_443.proto='tcp'
root@Router:~# uci show firewall
firewall.@defaults[0]=defaults
firewall.@defaults[0].syn_flood='1'
firewall.@defaults[0].input='ACCEPT'
firewall.@defaults[0].output='ACCEPT'
firewall.@defaults[0].forward='REJECT'
firewall.@zone[0]=zone
firewall.@zone[0].name='lan'
firewall.@zone[0].network='lan'
firewall.@zone[0].input='ACCEPT'
firewall.@zone[0].output='ACCEPT'
firewall.@zone[0].forward='ACCEPT'
firewall.@zone[1]=zone
firewall.@zone[1].name='wan'
firewall.@zone[1].network='wan' 'wan6'
firewall.@zone[1].input='REJECT'
firewall.@zone[1].output='ACCEPT'
firewall.@zone[1].forward='REJECT'
firewall.@zone[1].masq='1'
firewall.@zone[1].mtu_fix='1'
firewall.@forwarding[0]=forwarding
firewall.@forwarding[0].src='lan'
firewall.@forwarding[0].dest='wan'
firewall.@rule[0]=rule
firewall.@rule[0].name='Allow-DHCP-Renew'
firewall.@rule[0].src='wan'
firewall.@rule[0].proto='udp'
firewall.@rule[0].dest_port='68'
firewall.@rule[0].target='ACCEPT'
firewall.@rule[0].family='ipv4'
firewall.@rule[1]=rule
firewall.@rule[1].name='Allow-Ping'
firewall.@rule[1].src='wan'
firewall.@rule[1].proto='icmp'
firewall.@rule[1].icmp_type='echo-request'
firewall.@rule[1].family='ipv4'
firewall.@rule[1].target='ACCEPT'
firewall.@rule[2]=rule
firewall.@rule[2].name='Allow-IGMP'
firewall.@rule[2].src='wan'
firewall.@rule[2].proto='igmp'
firewall.@rule[2].family='ipv4'
firewall.@rule[2].target='ACCEPT'
firewall.@rule[3]=rule
firewall.@rule[3].name='Allow-DHCPv6'
firewall.@rule[3].src='wan'
firewall.@rule[3].proto='udp'
firewall.@rule[3].src_ip='fe80::/10'
firewall.@rule[3].src_port='547'
firewall.@rule[3].dest_ip='fe80::/10'
firewall.@rule[3].dest_port='546'
firewall.@rule[3].family='ipv6'
firewall.@rule[3].target='ACCEPT'
firewall.@rule[4]=rule
firewall.@rule[4].name='Allow-MLD'
firewall.@rule[4].src='wan'
firewall.@rule[4].proto='icmp'
firewall.@rule[4].src_ip='fe80::/10'
firewall.@rule[4].icmp_type='130/0' '131/0' '132/0' '143/0'
firewall.@rule[4].family='ipv6'
firewall.@rule[4].target='ACCEPT'
firewall.@rule[5]=rule
firewall.@rule[5].name='Allow-ICMPv6-Input'
firewall.@rule[5].src='wan'
firewall.@rule[5].proto='icmp'
firewall.@rule[5].icmp_type='echo-request' 'echo-reply' 'destination-unreachable                                                                                        ' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type' 'router-so                                                                                        licitation' 'neighbour-solicitation' 'router-advertisement' 'neighbour-advertise                                                                                        ment'
firewall.@rule[5].limit='1000/sec'
firewall.@rule[5].family='ipv6'
firewall.@rule[5].target='ACCEPT'
firewall.@rule[6]=rule
firewall.@rule[6].name='Allow-ICMPv6-Forward'
firewall.@rule[6].src='wan'
firewall.@rule[6].dest='*'
firewall.@rule[6].proto='icmp'
firewall.@rule[6].icmp_type='echo-request' 'echo-reply' 'destination-unreachable                                                                                        ' 'packet-too-big' 'time-exceeded' 'bad-header' 'unknown-header-type'
firewall.@rule[6].limit='1000/sec'
firewall.@rule[6].family='ipv6'
firewall.@rule[6].target='ACCEPT'
firewall.@include[0]=include
firewall.@include[0].path='/etc/firewall.user'
firewall.@include[0].reload='1'
firewall.@rule[7]=rule
firewall.@rule[7].src='wan'
firewall.@rule[7].dest='lan'
firewall.@rule[7].proto='esp'
firewall.@rule[7].target='ACCEPT'
firewall.@rule[8]=rule
firewall.@rule[8].src='wan'
firewall.@rule[8].dest='lan'
firewall.@rule[8].dest_port='500'
firewall.@rule[8].proto='udp'
firewall.@rule[8].target='ACCEPT'
firewall.@include[1]=include
firewall.@include[1].type='script'
firewall.@include[1].path='/usr/lib/gargoyle_firewall_util/gargoyle_additions.fi                                                                                        rewall'
firewall.@include[1].family='IPv4'
firewall.@include[1].reload='1'
firewall.miniupnpd=include
firewall.miniupnpd.type='script'
firewall.miniupnpd.path='/usr/share/miniupnpd/firewall.include'
firewall.miniupnpd.family='any'
firewall.miniupnpd.reload='1'
firewall.openvpn_include_file=include
firewall.openvpn_include_file.path='/etc/openvpn.firewall'
firewall.openvpn_include_file.reload='1'
firewall.vpn_zone=zone
firewall.vpn_zone.name='vpn'
firewall.vpn_zone.network='vpn'
firewall.vpn_zone.input='ACCEPT'
firewall.vpn_zone.output='ACCEPT'
firewall.vpn_zone.forward='ACCEPT'
firewall.vpn_zone.mtu_fix='1'
firewall.vpn_zone.masq='1'
firewall.vpn_lan_forwarding=forwarding
firewall.vpn_lan_forwarding.src='lan'
firewall.vpn_lan_forwarding.dest='vpn'
firewall.ra_openvpn=remote_accept
firewall.ra_openvpn.zone='wan'
firewall.ra_openvpn.local_port='1194'
firewall.ra_openvpn.remote_port='1194'
firewall.ra_openvpn.proto='udp'
firewall.vpn_wan_forwarding=forwarding
firewall.vpn_wan_forwarding.src='vpn'
firewall.vpn_wan_forwarding.dest='wan'
firewall.lan_vpn_forwarding=forwarding
firewall.lan_vpn_forwarding.src='vpn'
firewall.lan_vpn_forwarding.dest='lan'
firewall.ra_8088_8088=remote_accept
firewall.ra_8088_8088.name='freenas'
firewall.ra_8088_8088.local_port='8088'
firewall.ra_8088_8088.remote_port='8088'
firewall.ra_8088_8088.proto='tcp'
firewall.ra_8088_8088.zone='wan'
firewall.ra_443_443=remote_accept
firewall.ra_443_443.local_port='443'
firewall.ra_443_443.remote_port='443'
firewall.ra_443_443.proto='tcp'
firewall.ra_443_443.zone='wan'
firewall.ra_80_8080=remote_accept
firewall.ra_80_8080.local_port='80'
firewall.ra_80_8080.remote_port='8080'
firewall.ra_80_8080.proto='tcp'
firewall.ra_80_8080.zone='wan'
firewall.ra_22_22=remote_accept
firewall.ra_22_22.local_port='22'
firewall.ra_22_22.remote_port='22'
firewall.ra_22_22.proto='tcp'
firewall.ra_22_22.zone='wan'
firewall.redirect_enabled_number_0=redirect
firewall.redirect_enabled_number_0.name='freenas'
firewall.redirect_enabled_number_0.src='wan'
firewall.redirect_enabled_number_0.dest='lan'
firewall.redirect_enabled_number_0.proto='tcp'
firewall.redirect_enabled_number_0.src_dport='8088'
firewall.redirect_enabled_number_0.dest_ip='192.168.1.100'
firewall.redirect_enabled_number_0.dest_port='8088'
root@Router:~# cat /etc/config/firewall

config defaults
        option syn_flood '1'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'

config zone
        option name 'lan'
        list network 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config forwarding
        option src 'lan'
        option dest 'wan'

config rule
        option name 'Allow-DHCP-Renew'
        option src 'wan'
        option proto 'udp'
        option dest_port '68'
        option target 'ACCEPT'
        option family 'ipv4'

config rule
        option name 'Allow-Ping'
        option src 'wan'
        option proto 'icmp'
        option icmp_type 'echo-request'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-IGMP'
        option src 'wan'
        option proto 'igmp'
        option family 'ipv4'
        option target 'ACCEPT'

config rule
        option name 'Allow-DHCPv6'
        option src 'wan'
        option proto 'udp'
        option src_ip 'fe80::/10'
        option src_port '547'
        option dest_ip 'fe80::/10'
        option dest_port '546'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-MLD'
        option src 'wan'
        option proto 'icmp'
        option src_ip 'fe80::/10'
        list icmp_type '130/0'
        list icmp_type '131/0'
        list icmp_type '132/0'
        list icmp_type '143/0'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Input'
        option src 'wan'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        list icmp_type 'router-solicitation'
        list icmp_type 'neighbour-solicitation'
        list icmp_type 'router-advertisement'
        list icmp_type 'neighbour-advertisement'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config rule
        option name 'Allow-ICMPv6-Forward'
        option src 'wan'
        option dest '*'
        option proto 'icmp'
        list icmp_type 'echo-request'
        list icmp_type 'echo-reply'
        list icmp_type 'destination-unreachable'
        list icmp_type 'packet-too-big'
        list icmp_type 'time-exceeded'
        list icmp_type 'bad-header'
        list icmp_type 'unknown-header-type'
        option limit '1000/sec'
        option family 'ipv6'
        option target 'ACCEPT'

config include
        option path '/etc/firewall.user'
        option reload '1'

config rule
        option src 'wan'
        option dest 'lan'
        option proto 'esp'
        option target 'ACCEPT'

config rule
        option src 'wan'
        option dest 'lan'
        option dest_port '500'
        option proto 'udp'
        option target 'ACCEPT'

config include
        option type 'script'
        option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
        option family 'IPv4'
        option reload '1'

config include 'miniupnpd'
        option type 'script'
        option path '/usr/share/miniupnpd/firewall.include'
        option family 'any'
        option reload '1'

config include 'openvpn_include_file'
        option path '/etc/openvpn.firewall'
        option reload '1'

config zone 'vpn_zone'
        option name 'vpn'
        option network 'vpn'
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'ACCEPT'
        option mtu_fix '1'
        option masq '1'

config forwarding 'vpn_lan_forwarding'
        option src 'lan'
        option dest 'vpn'

config remote_accept 'ra_openvpn'
        option zone 'wan'
        option local_port '1194'
        option remote_port '1194'
        option proto 'udp'

config forwarding 'vpn_wan_forwarding'
        option src 'vpn'
        option dest 'wan'

config forwarding 'lan_vpn_forwarding'
        option src 'vpn'
        option dest 'lan'

config remote_accept 'ra_8088_8088'
        option name 'freenas'
        option local_port '8088'
        option remote_port '8088'
        option proto 'tcp'
        option zone 'wan'

config remote_accept 'ra_443_443'
        option local_port '443'
        option remote_port '443'
        option proto 'tcp'
        option zone 'wan'

config remote_accept 'ra_80_8080'
        option local_port '80'
        option remote_port '8080'
        option proto 'tcp'
        option zone 'wan'

config remote_accept 'ra_22_22'
        option local_port '22'
        option remote_port '22'
        option proto 'tcp'
        option zone 'wan'

config redirect 'redirect_enabled_number_0'
        option name 'freenas'
        option src 'wan'
        option dest 'lan'
        option proto 'tcp'
        option src_dport '8088'
        option dest_ip '192.168.1.100'
        option dest_port '8088'

2 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,284

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

Wywal dmz, wywal to otwarcie portu na 8088. Zostaw tylko przekierowanie.
Skoro działa na 1.1 to na inne też musi, chyba że host nie ustawionego poprawnie gatewaya.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez armen10 (edytowany przez armen10 2020-06-27 09:10:09)

  • Zarejestrowany: 2014-12-17
  • Posty: 243

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

Ja używam internetu z karty sim, którą mam w modemie USB, czy to ma jakieś znaczenie ?
Ale DMZ jest w GUI wyłączone... Chciałbym uzyskać takie przekierowania jak na załączniku, czy to jest możliwe ?
Co to znaczy: "host nie ustawionego poprawnie gatewaya."
10.100.0.1 - adres servera openvpn

Usunąłem inne przekierowania z GUI, ale w pliku firewall jeszcze siedzą. Mie wiem, czy tak ma być ?
Chodzi mi tylko, aby uzyskać dosęp z zewnątrz na VM, gdzie mam freenas-a.

Zrzut ekranu

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,284

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

1. Czy masz wykupioną usługę publicznego adresu ip
2. Co to jest to na 10.100.0.1? Nie możesz mieć 2 przekierowań tego samego portu, usuń to.
3. Po co ci te 22/21/1194? Przecież gargyle samo robi odpowiednie otwarcie portów dla usług które są w gui, nie musisz jeszcze ręcznie dodawać jakiś specjalnych przekierowań.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

5 Odpowiedź przez armen10

  • Zarejestrowany: 2014-12-17
  • Posty: 243

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

Hmm, a taki dynamiczny adres publiczny, jaki mam z modemu gsm, to nie wystarcza?
Ja korzystam z internetu na kartę myślałem, że jak będę używał DDNS, to sobie będę mógł zrobić "stałe" połączenie...

6 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,284

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

Nie, nie wystarcza. I DDNS do tego nie służy. Jak nie wykupisz u operatora komórkowego usługi to się w życiu się nie dostaniesz do routera (a nawet jeżeli cokolwiek teraz działa to za chwilę przestanie bo to ich błąd konfiguracyjny).
Żaden operator u nas w kraju nie umożliwia bezpośredniego dostępu do adresu IP. Tak działa chyba od początku istnienia sieci komórkowej w Polsce.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

7 Odpowiedź przez armen10

  • Zarejestrowany: 2014-12-17
  • Posty: 243

Odp: Gargoyle version:1.11 przekierowanie portu z WAN

Ok bardzo Ci dziękuję za pomoc i innym. Jesteście wielcy. Oby tak inne fora chulały smile
Rozwiązane: Kupić kablówkę z internetem smile