1 Temat przez farben (edytowany przez farben 2025-02-26 20:34:22)

  • farben
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2018-07-21
  • Posty: 30

Temat: Blokada strony webadmin dla wybranych VLAN

Witam,

Mam ustawione 3 VLANy wg schematu, który znalazłem w jednym z postów na forum.

VLAN 10 192.168.10.2/24 - o nazwie "man", który powinien mi dać dostęp do webadmin
VLAN 20 192.168.20.2/24 - o nazwie "pcs", do którego podłączam inne urzadzenia kablem lub wifi ale nie powinny mieć dostępu do webadmin
VLAN 30 192.168.30.2/24 - o nazwie "iot", tylko wifi bez dostępu do webadmin

Moja konfiguracja wygląda tak:

root@AX3000T:~# cat /etc/config/network

config interface 'loopback'
    option device 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd6a:4de:5cd3::/48'
    option packet_steering '1'

config device
    option name 'br0'
    option type 'bridge'
    option igmp_snooping '1'
    option ipv6 '0'
    list ports 'lan2'
    list ports 'lan3'
    list ports 'lan4'
    list ports 'wan'

config bridge-vlan
    option device 'br0'
    option vlan '10'
    option alias 'man'
    list ports 'lan4:t'
    list ports 'wan'

config bridge-vlan
    option device 'br0'
    option vlan '20'
    option alias 'pcs'
    list ports 'lan2'
    list ports 'lan3'
    list ports 'lan4:t'

config bridge-vlan
    option device 'br0'
    option vlan '30'
    option alias 'iot'
    list ports 'lan4:t'

config interface 'man'
    option proto 'static'
    option device 'br0.man'
    option ipaddr '192.168.10.2'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option type 'bridge'

config interface 'iot'
    option proto 'static'
    option device 'br0.iot'
    option ipaddr '192.168.30.2'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option type 'bridge'

config interface 'pcs'
    option proto 'static'
    option device 'br0.pcs'
    option ipaddr '192.168.20.2'
    option netmask '255.255.255.0'
    option ip6assign '60'
    option type 'bridge'

config device
    option name 'br0.10'
    option type '8021q'
    option ifname 'br0'
    option vid '10'
    option ipv6 '0'

config device
    option name 'br0.20'
    option type '8021q'
    option ifname 'br0'
    option vid '20'
    option ipv6 '0'

config device
    option name 'br0.30'
    option type '8021q'
    option ifname 'br0'
    option vid '30'
    option ipv6 '0'
root@AX3000T:~# cat /etc/config/firewall

config defaults
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option synflood_protect '1'
    option flow_offloading '1'
    option flow_offloading_hw '1'

config zone
    option name 'lan'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    list network 'man'

config zone
    option name 'wan'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option masq '1'
    option mtu_fix '1'

config forwarding
    option src 'lan'
    option dest 'wan'

config rule
    option name 'Allow-DHCP-Renew'
    option src 'wan'
    option proto 'udp'
    option dest_port '68'
    option target 'ACCEPT'
    option family 'ipv4'

config rule
    option name 'Allow-Ping'
    option src 'wan'
    option proto 'icmp'
    option icmp_type 'echo-request'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-IGMP'
    option src 'wan'
    option proto 'igmp'
    option family 'ipv4'
    option target 'ACCEPT'

config rule
    option name 'Allow-DHCPv6'
    option src 'wan'
    option proto 'udp'
    option dest_port '546'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-MLD'
    option src 'wan'
    option proto 'icmp'
    option src_ip 'fe80::/10'
    list icmp_type '130/0'
    list icmp_type '131/0'
    list icmp_type '132/0'
    list icmp_type '143/0'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Input'
    option src 'wan'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    list icmp_type 'router-solicitation'
    list icmp_type 'neighbour-solicitation'
    list icmp_type 'router-advertisement'
    list icmp_type 'neighbour-advertisement'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-ICMPv6-Forward'
    option src 'wan'
    option dest '*'
    option proto 'icmp'
    list icmp_type 'echo-request'
    list icmp_type 'echo-reply'
    list icmp_type 'destination-unreachable'
    list icmp_type 'packet-too-big'
    list icmp_type 'time-exceeded'
    list icmp_type 'bad-header'
    list icmp_type 'unknown-header-type'
    option limit '1000/sec'
    option family 'ipv6'
    option target 'ACCEPT'

config rule
    option name 'Allow-IPSec-ESP'
    option src 'wan'
    option dest 'lan'
    option proto 'esp'
    option target 'ACCEPT'

config rule
    option name 'Allow-ISAKMP'
    option src 'wan'
    option dest 'lan'
    option dest_port '500'
    option proto 'udp'
    option target 'ACCEPT'

config zone
    option name 'iot'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    list network 'iot'

config forwarding
    option src 'iot'
    option dest 'wan'

config zone
    option name 'pcs'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    list network 'pcs'

config forwarding
    option src 'pcs'
    option dest 'wan'

config rule
    option src 'iot'
    option proto 'udp'
    option src_port '67-68'
    option dest_port '67-68'
    option target 'ACCEPT'
    option family 'ipv4'
    option name 'iot'

config rule
    option src 'iot'
    option dest_port '53'
    option target 'ACCEPT'
    option family 'ipv4'
    option name 'iot'
    list proto 'tcp'
    list proto 'udp'

config rule
    option src 'pcs'
    option proto 'udp'
    option src_port '67-68'
    option dest_port '67-68'
    option target 'ACCEPT'
    option family 'ipv4'
    option name 'pcs'

config rule
    option name 'pcs'
    option family 'ipv4'
    option target 'ACCEPT'
    option dest_port '53'
    option proto 'tcp udp'
    option src 'pcs'

Gdzie jest błąd?

2 Odpowiedź przez Q002 (edytowany przez Q002 2025-02-26 20:16:22)

  • Q002
  • Użytkownik
  • Nieaktywny
  • Zarejestrowany: 2021-09-14
  • Posty: 26

Odp: Blokada strony webadmin dla wybranych VLAN

Skonfiguruj uhttpd aby nasłuchiwał tylko na interfejsie man, domyślnie słucha na wszystkich:

cat /etc/config/uhttpd
#
list listen_http '192.168.10.2:80'
list listen_https '192.168.10.2:443'
#

3 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 115,912

Odp: Blokada strony webadmin dla wybranych VLAN

Albo zablokuj na firewallu dostęp do 192.168.10.2 z określonych podsieci.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona