• Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Temat: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Witam
Mam dwa routery połączone przez porty LAN (ten podrzędny ma oczywiście wyłączone DHCP i jest w tej samej klasie adresowej). Na tym nadrzędnym routerze (podłączony WAN) dodałem regułę całkowitej blokady urządzenia, które jest podłączone po kablu z routerem podrzędnym. Domyślam się, że blokada powinna zadziałać, nawet jeśli na routerze podrzędnym blokady nie ma? Bo właśnie stwierdziłem, że blokada nie działa.

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

2 Odpowiedź przez Cezary (edytowany przez Cezary 2021-04-13 16:55:27)

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Jak  masz podłączone po kablu to ten podrzędny nawet nie bierze udziału w tym ruchu, więc tak, wszystko robisz na nadrzędnym.

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

3 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

No więc właśnie, mam zrobione tak:

config restriction_rule 'rule_2'
        option is_ingress '0'
        option description 'Blokada VM'
        option local_addr 'XX:XX:XX:52:0A:A8,XX:XX:XX:EE:85:2F,XX:XX:XX:bf:b4:ab,XX:XX:XX:52:0A:A9,XX:XX:XX:7f:7d:f4'
        option enabled '1'

https://www.dropbox.com/s/fiz7hce6oz0jinm/Zrzut%20ekranu%202021-04-13%20161823.png?dl=1

a na blokowanej wirtualce mam:

  1    <1 ms    <1 ms    <1 ms  Gargoyle.lan [192.168.1.11]
  2     6 ms     6 ms     6 ms  10.228.128.1
  3     6 ms     6 ms     8 ms  XXX.XXX.XXX.73
  4    13 ms    13 ms    14 ms  XXX.XXX.XXX.186
  5    16 ms    16 ms    11 ms  XXX.XXX.XXX.186
  6    21 ms    23 ms    22 ms  netia.plix.pl [195.182.218.13]
  7     *        *       16 ms  83.238.248.19
  8     *       16 ms    17 ms  87.204.224.71
  9    18 ms    16 ms    17 ms  83.238.6.13
 10    11 ms    13 ms    12 ms  www.wp.pl [212.77.98.9]
MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

4 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Ale mac czego jest? Wirtualna wychodzi dokładnie z tym adresem mac, widzisz ten adres w statusie połączeń?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

5 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Oczywiście, sprawdziłem dla pewności w ipconfig /all.

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

6 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Router nadrzędny ma normalnie wan?

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

7 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Normalnie? No jest podłączony przez wan do modemu kablowego, który jest w trybie bridge, więc jest przezroczysty.

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

8 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Ok, pokaż wynikt

iptables -v -L
iptables -v -L -t nat

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

9 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

root@Gargoyle:~# iptables -v -L
Chain INPUT (policy ACCEPT 2 packets, 92 bytes)
 pkts bytes target     prot opt in     out     source               destination
 3602  370K ACCEPT     all  --  lo     any     anywhere             anywhere             /* !fw3 */
 514K  427M input_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom input rule chain */
 448K  418M ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED /* !fw3 */
 7276  354K syn_flood  tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN /* !fw3 */
34030 2688K zone_lan_input  all  --  br-lan any     anywhere             anywhere             /* !fw3 */
31248 6391K zone_wan_input  all  --  eth1.2 any     anywhere             anywhere             /* !fw3 */
  608 31616 zone_vpn_input  all  --  tun0   any     anywhere             anywhere             /* !fw3 */

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
9389K 7243M forwarding_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom forwarding rule chain */
9358K 7237M ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED /* !fw3 */
30530 6548K zone_lan_forward  all  --  br-lan any     anywhere             anywhere             /* !fw3 */
    0     0 zone_wan_forward  all  --  eth1.2 any     anywhere             anywhere             /* !fw3 */
  430 22360 zone_vpn_forward  all  --  tun0   any     anywhere             anywhere             /* !fw3 */
    0     0 reject     all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
 3602  370K ACCEPT     all  --  any    lo      anywhere             anywhere             /* !fw3 */
 431K  560M output_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom output rule chain */
 402K  558M ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED /* !fw3 */
  430 70623 zone_lan_output  all  --  any    br-lan  anywhere             anywhere             /* !fw3 */
28731 1982K zone_wan_output  all  --  any    eth1.2  anywhere             anywhere             /* !fw3 */
    0     0 zone_vpn_output  all  --  any    tun0    anywhere             anywhere             /* !fw3 */

Chain forwarding_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain forwarding_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain input_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination
  100  4952 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:https
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:4430

Chain lease_mismatch_check (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     all  --  any    any    !NAS                  anywhere             MAC 00:08:9B:F1:94:42 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     NAS                  anywhere             MAC ! 00:08:9B:F1:94:42 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !OKI_MB492dn          anywhere             MAC 00:25:36:E1:F3:24 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     OKI_MB492dn          anywhere             MAC ! 00:25:36:E1:F3:24 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !PC                   anywhere             MAC 04:D4:C4:04:88:DD reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     PC                   anywhere             MAC ! 04:D4:C4:04:88:DD reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !Lapek_HP             anywhere             MAC 18:1D:EA:58:3F:E0 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     Lapek_HP             anywhere             MAC ! 18:1D:EA:58:3F:E0 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !HUAWEI_P_smart_2019-f0342.lan  anywhere             MAC 4C:D1:A1:31:18:C9 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     HUAWEI_P_smart_2019-f0342.lan  anywhere             MAC ! 4C:D1:A1:31:18:C9 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !VM                   anywhere             MAC 52:54:00:05:5F:4F reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     VM                   anywhere             MAC ! 52:54:00:05:5F:4F reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !Windows              anywhere             MAC 52:54:00:17:15:A3 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     Windows              anywhere             MAC ! 52:54:00:17:15:A3 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !WinTest              anywhere             MAC 52:54:00:52:0A:A8 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     WinTest              anywhere             MAC ! 52:54:00:52:0A:A8 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !WinTestOf            anywhere             MAC 52:54:00:52:0A:A9 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     WinTestOf            anywhere             MAC ! 52:54:00:52:0A:A9 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !vmSzkola             anywhere             MAC 52:54:00:CC:D6:49 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     vmSzkola             anywhere             MAC ! 52:54:00:CC:D6:49 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !android-1cf0d0f2de0ad9f8.lan  anywhere             MAC 7C:0B:C6:A3:F2:CD reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     android-1cf0d0f2de0ad9f8.lan  anywhere             MAC ! 7C:0B:C6:A3:F2:CD reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !192.168.1.217        anywhere             MAC 8E:4A:B5:5F:3F:EE reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     192.168.1.217        anywhere             MAC ! 8E:4A:B5:5F:3F:EE reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !Lapek_Acer           anywhere             MAC 90:CC:DF:FB:1F:EE reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     Lapek_Acer           anywhere             MAC ! 90:CC:DF:FB:1F:EE reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !RedmiNote9Pro-RedmiN.lan  anywhere             MAC 98:F6:21:FA:E4:8E reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     RedmiNote9Pro-RedmiN.lan  anywhere             MAC ! 98:F6:21:FA:E4:8E reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !Mi9TPro-Mi9TPro.lan  anywhere             MAC BC:7F:A4:02:01:EB reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     Mi9TPro-Mi9TPro.lan  anywhere             MAC ! BC:7F:A4:02:01:EB reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !STARY_PC             anywhere             MAC D0:37:45:68:AD:AF reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     STARY_PC             anywhere             MAC ! D0:37:45:68:AD:AF reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any    !Tablet               anywhere             MAC E0:2C:B2:22:FF:C2 reject-with icmp-port-unreachable
    0     0 REJECT     all  --  any    any     Tablet               anywhere             MAC ! E0:2C:B2:22:FF:C2 reject-with icmp-port-unreachable

Chain output_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain output_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain reject (3 references)
 pkts bytes target     prot opt in     out     source               destination
 6520  306K REJECT     tcp  --  any    any     anywhere             anywhere             /* !fw3 */ reject-with tcp-reset
 4345  233K REJECT     all  --  any    any     anywhere             anywhere             /* !fw3 */ reject-with icmp-port-unreachable

Chain syn_flood (1 references)
 pkts bytes target     prot opt in     out     source               destination
 7274  354K RETURN     tcp  --  any    any     anywhere             anywhere             tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50 /* !fw3 */
    2    80 DROP       all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_lan_dest_ACCEPT (5 references)
 pkts bytes target     prot opt in     out     source               destination
  860 92983 ACCEPT     all  --  any    br-lan  anywhere             anywhere             /* !fw3 */

Chain zone_lan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  br-lan br-lan  anywhere             anywhere
30530 6548K forwarding_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan forwarding rule chain */
30530 6548K zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3: Zone lan to wan forwarding policy */
    2    80 zone_vpn_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3: Zone lan to vpn forwarding policy */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port forwards */
    0     0 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_lan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
34030 2688K input_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan input rule chain */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port redirections */
34030 2688K zone_lan_src_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_lan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
  430 70623 output_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan output rule chain */
  430 70623 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_lan_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
34028 2688K ACCEPT     all  --  br-lan any     anywhere             anywhere             ctstate NEW,UNTRACKED /* !fw3 */

Chain zone_vpn_dest_ACCEPT (3 references)
 pkts bytes target     prot opt in     out     source               destination
    2    80 DROP       all  --  any    tun0    anywhere             anywhere             ctstate INVALID /* !fw3: Prevent NAT leakage */
    0     0 ACCEPT     all  --  any    tun0    anywhere             anywhere             /* !fw3 */

Chain zone_vpn_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
  430 22360 forwarding_vpn_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom vpn forwarding rule chain */
  430 22360 zone_lan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3: Zone vpn to lan forwarding policy */
    0     0 zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3: Zone vpn to wan forwarding policy */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port forwards */
    0     0 zone_vpn_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_vpn_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
  608 31616 input_vpn_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom vpn input rule chain */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port redirections */
  608 31616 zone_vpn_src_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_vpn_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 output_vpn_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom vpn output rule chain */
    0     0 zone_vpn_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_vpn_src_ACCEPT (1 references)
 pkts bytes target     prot opt in     out     source               destination
  608 31616 ACCEPT     all  --  tun0   any     anywhere             anywhere             ctstate NEW,UNTRACKED /* !fw3 */

Chain zone_wan_dest_ACCEPT (3 references)
 pkts bytes target     prot opt in     out     source               destination
 2409  122K DROP       all  --  any    eth1.2  anywhere             anywhere             ctstate INVALID /* !fw3: Prevent NAT leakage */
56850 8408K ACCEPT     all  --  any    eth1.2  anywhere             anywhere             /* !fw3 */

Chain zone_wan_dest_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 reject     all  --  any    eth1.2  anywhere             anywhere             /* !fw3 */

Chain zone_wan_forward (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 forwarding_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan forwarding rule chain */
    0     0 zone_lan_dest_ACCEPT  esp  --  any    any     anywhere             anywhere             /* !fw3: Allow-IPSec-ESP */
    0     0 zone_lan_dest_ACCEPT  udp  --  any    any     anywhere             anywhere             udp dpt:isakmp /* !fw3: Allow-ISAKMP */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port forwards */
    0     0 zone_wan_dest_REJECT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_input (1 references)
 pkts bytes target     prot opt in     out     source               destination
31248 6391K input_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan input rule chain */
19267 5811K ACCEPT     udp  --  any    any     anywhere             anywhere             udp dpt:bootpc /* !fw3: Allow-DHCP-Renew */
   49  1734 DROP       icmp --  any    any     anywhere             anywhere             icmp echo-request /* !fw3: Allow-Ping */
  967 34812 ACCEPT     igmp --  any    any     anywhere             anywhere             /* !fw3: Allow-IGMP */
    0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT /* !fw3: Accept port redirections */
10865  539K zone_wan_src_REJECT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_output (1 references)
 pkts bytes target     prot opt in     out     source               destination
28731 1982K output_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan output rule chain */
28731 1982K zone_wan_dest_ACCEPT  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_src_REJECT (1 references)
 pkts bytes target     prot opt in     out     source               destination
10865  539K reject     all  --  eth1.2 any     anywhere             anywhere             /* !fw3 */
root@Gargoyle:~# iptables -v -L -t nat
Chain PREROUTING (policy ACCEPT 65657 packets, 10M bytes)
 pkts bytes target     prot opt in     out     source               destination
65745   10M prerouting_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom prerouting rule chain */
55768 9835K zone_lan_prerouting  all  --  br-lan any     anywhere             anywhere             /* !fw3 */
 9257  468K zone_wan_prerouting  all  --  eth1.2 any     anywhere             anywhere             /* !fw3 */
  720 37440 zone_vpn_prerouting  all  --  tun0   any     anywhere             anywhere             /* !fw3 */

Chain INPUT (policy ACCEPT 27410 packets, 1863K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 21143 packets, 1482K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 1370 packets, 113K bytes)
 pkts bytes target     prot opt in     out     source               destination
45412 6951K postrouting_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom postrouting rule chain */
  394 47046 zone_lan_postrouting  all  --  any    br-lan  anywhere             anywhere             /* !fw3 */
44042 6838K zone_wan_postrouting  all  --  any    eth1.2  anywhere             anywhere             /* !fw3 */
    0     0 zone_vpn_postrouting  all  --  any    tun0    anywhere             anywhere             /* !fw3 */

Chain postrouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain postrouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_lan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_vpn_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain prerouting_wan_rule (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain zone_lan_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
  394 47046 postrouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan postrouting rule chain */

Chain zone_lan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
55768 9835K prerouting_lan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom lan prerouting rule chain */

Chain zone_vpn_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 postrouting_vpn_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom vpn postrouting rule chain */
    0     0 MASQUERADE  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_vpn_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
  720 37440 prerouting_vpn_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom vpn prerouting rule chain */

Chain zone_wan_postrouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
44042 6838K postrouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan postrouting rule chain */
44042 6838K MASQUERADE  all  --  any    any     anywhere             anywhere             /* !fw3 */

Chain zone_wan_prerouting (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REDIRECT   tcp  --  any    any     anywhere             anywhere             tcp dpt:4430 redir ports 4430
   88  4472 REDIRECT   tcp  --  any    any     anywhere             anywhere             tcp dpt:https redir ports 443
 9169  464K prerouting_wan_rule  all  --  any    any     anywhere             anywhere             /* !fw3: Custom wan prerouting rule chain */
MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

10 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Ty w ogóle reguł nie masz od tego w firewallu...

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

11 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Więc o co chodzi? Interfejs wygląda, jakby tam były...

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)

12 Odpowiedź przez Cezary

  • Skąd: Warszawa
  • Zarejestrowany: 2006-02-25
  • Posty: 116,601

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Zrób restart i zobacz. I poczekaj chwilę po restarcie. Te adresy powinny być widoczne w

iptables -v -L  egress_restrictions

Masz niepotrzebny router, uszkodzony czy nie - chętnie przygarnę go.

Cezary's Strona

13 Odpowiedź przez badziewiak

  • Skąd: Chrząszczyżewoszyce Łękołody:)
  • Zarejestrowany: 2010-08-26
  • Posty: 1,810

Odp: Gargoyle 1.12.0.2 (27ec1e48) blokada po MAC

Po restarcie reguły zadziałały. roll

MiniPC 6xRJ45 2Gb, N100, 16GB DDR5, 1TB NVMe (Gargoyle)
Linksys WRT3200ACM (Gargoyle)
Tp-link 1043NDv2 (Gargoyle)