Cos nie bardzo na tym routerze xx zrobilem po ciezkich akcjach (TENDA -zmiana poprzez wyexportowanie konfiguracji - backup i dopisanie wsekcji static route statycznego routingu - ale zadzialalo)
mam taka tabele:
Destination IP Subnet Mask Gateway Metric Interface
239.255.255.250 255.255.255.255 0.0.0.0 0 br0
xxx.xxx.xxx.xxx 255.255.255.224 0.0.0.0 0 eth2.2
192.168.100.0 255.255.255.0 192.168.200.100 0 br0
192.168.200.0 255.255.255.0 0.0.0.0 0 br0
0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 0 eth2.2
Druga strona jest taka:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.0.1 0.0.0.0 UG 10 0 0 eth0.2
0.0.0.0 192.168.200.1 0.0.0.0 UG 20 0 0 eth0.3
0.0.0.0 10.64.64.64 0.0.0.0 UG 30 0 0 3g-wan3
10.0.0.0 0.0.0.0 255.255.255.0 U 10 0 0 eth0.2
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
10.64.64.64 0.0.0.0 255.255.255.255 UH 0 0 0 3g-wan3
192.168.100.0 0.0.0.0 255.255.255.0 U 0 0 0 br-lan
192.168.200.0 0.0.0.0 255.255.255.0 U 20 0 0 eth0.3
no i nie widac z xx LAN na yy
moze cos na firewalu trzeba przestawic albo jeszcze jakis routing dodac
Z sieci 192.168.200.0 moge sie tylko pingowac na 192.168.100.100 inne adresy sa niewidoczne zadna usluga na 192.168.100.100 nie jest dostepna 80/443 porty
moj firewal
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option conntrack '1'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan2 wan3'
option conntrack '1'
config forwarding
option src 'lan'
option dest 'wan'
config zone
option name 'wan2'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
option network 'wan2'
option conntrack '1'
config forwarding
option src 'lan'
option dest 'wan2'
config zone
option name 'wan3'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan3'
option conntrack '1'
config forwarding
option src 'lan'
option dest 'wan3'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-Ping'
option src 'wan2'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-Ping'
option src 'wan3'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config include
option path '/usr/lib/gargoyle_firewall_util/gargoyle_additions.firewall'
config include 'openvpn_include_file'
option path '/etc/openvpn.firewall'
option reload '1'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'IPv4'
option reload '1'
config zone 'vpn_zone'
option name 'vpn'
option network 'vpn'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option mtu_fix '1'
option masq '1'
config forwarding 'vpn_lan_forwarding'
option src 'lan'
option dest 'vpn'
config remote_accept 'ra_openvpn'
option zone 'wan'
option local_port '8086'
option remote_port '8086'
option proto 'udp'
config forwarding 'vpn_wan_forwarding'
option src 'vpn'
option dest 'wan'
config remote_accept 'ra_443_8085'
option local_port '443'
option remote_port '8085'
option proto 'tcp'
option zone 'wan'
nmap
Starting Nmap 6.40 ( http://nmap.org ) at 2013-10-13 00:26 CEST
NSE: Loaded 110 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 00:26
Scanning 192.168.100.100 [4 ports]
Completed Ping Scan at 00:26, 0.05s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 00:26
Completed Parallel DNS resolution of 1 host. at 00:26, 13.00s elapsed
Initiating SYN Stealth Scan at 00:26
Scanning 192.168.100.100 [1000 ports]
Increasing send delay for 192.168.100.100 from 0 to 5 due to 35 out of 86 dropped probes since last increase.
Increasing send delay for 192.168.100.100 from 5 to 10 due to 15 out of 36 dropped probes since last increase.
Completed SYN Stealth Scan at 00:27, 38.14s elapsed (1000 total ports)
Initiating Service scan at 00:27
Initiating OS detection (try #1) against 192.168.100.100
Retrying OS detection (try #2) against 192.168.100.100
Initiating Traceroute at 00:27
Completed Traceroute at 00:27, 0.01s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 00:27
Completed Parallel DNS resolution of 2 hosts. at 00:27, 13.00s elapsed
NSE: Script scanning 192.168.100.100.
Initiating NSE at 00:27
Completed NSE at 00:27, 0.00s elapsed
Nmap scan report for 192.168.100.100
Host is up (0.0023s latency).
All 1000 scanned ports on 192.168.100.100 are closed
Too many fingerprints match this host to give specific OS details
Network Distance: 2 hops
TRACEROUTE (using port 3306/tcp)
HOP RTT ADDRESS
1 7.82 ms 192.168.200.1
2 4.69 ms 192.168.100.100
NSE: Script Post-scanning.
Read data files from: /usr/bin/../share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 67.53 seconds
Raw packets sent: 2009 (89.512KB) | Rcvd: 1032 (42.804KB)
Po zmianie w zone wan2
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
zobaczylem port https na ktorym mam forward zrobiony na wan do widzenia na zewnatrz
wydaje mi sie ze role w firewalu dla zone wan jest nadpisana dla wan2
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan2 wan3' <<<<< to jest chyba problemem, ale jak to obejsc jak sie chce miec openvpn i mwana3
option conntrack '1'
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option conntrack '1'
config zone
option name 'wan'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'wan wan2 wan3'
option conntrack '1'
config forwarding
option src 'lan'
option dest 'wan'
config zone
option name 'wan2'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option masq '1'
option mtu_fix '1'
option network 'wan2'
option conntrack '1'
w firewalu gdzies jest problem bo jak zmienilem
w zonie
option network 'wan wan2 wan3'
option network 'wan wan3'
to zaczelo forwardowac pakiety
Ktos moze pomoc w prawidlowej konfiguracji firewala ?
czy jak zostawie
option network 'wan wan3'
w zonie 'wan'
to wszystko mi bedize dzialac prawidlowo z uslugami czy gdzies cos nie zglupieje ?
