Romych: /* Ссылки */

2022-03-02T13:18:36Z

Ссылки

Нова сторінка

http://mkrtk.zina.com.ua:48787/webfig/#IP:Firewall.NAT

Или зайти на http://mkrtk.zina.com.ua:48787 — IP — Firewall — NAT

== Пример добавления проброса портов ==

Для добавления правила с пробросом, например, '''755''' порта на '''80''' порт хоста '''192.168.1.105''', нужно выполнить две команды через http://mkrtk.zina.com.ua:48787/webfig/#IP:Firewall.NAT.new:

1)

* chain=<code>dstnat</code>
* protocol=<code>6 (tcp)</code>
* dst-port='''755'''
* in-interface=<code>ether1</code>
* action=<code>netmap</code>
* to-addresses='''192.168.1.105'''
* to-ports='''80'''
* Comment: '''HP (HTTP): 755 -> 80'''
2)

* chain=<code>dstnat</code>
* src-address=<code>192.168.1.0/24</code>
* dst-address=<code>37.53.93.49</code>
* protocol=<code>6 (tcp)</code>
* dst-port='''755'''
* in-interface=<code>bridge</code>
* action=<code>netmap</code>
* to-addresses='''192.168.1.105'''
* to-ports='''80'''
* Comment: '''HP (HTTP): 755 -> 80'''

== Упорядоченная компактная версия от 2019-07-26 ==

<source lang="bash">
[admin@MikroTik] > /ip firewall nat print

0 ;;; defconf: masquerade
chain=srcnat action=masquerade out-interface-list=WAN log=yes log-prefix="" ipsec-policy=out,none

1 chain=srcnat action=masquerade src-address=192.168.1.0/24

2 ;;; nikita - Angular (4200)
chain=dstnat action=netmap to-addresses=192.168.1.108 protocol=tcp in-interface=ether1 dst-port=4200

3 ;;; nikita - Angular (4200)
chain=dstnat action=netmap to-addresses=192.168.1.108 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=4200

4 ;;; tserver (RDP)
chain=dstnat action=netmap to-addresses=192.168.1.103 protocol=tcp in-interface=ether1 dst-port=3389

5 ;;; tserver (RDP)
chain=dstnat action=netmap to-addresses=192.168.1.103 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=3389

6 ;;; NAS (http): 30 -> 80
chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=80 protocol=tcp in-interface=ether1 dst-port=30

7 ;;; NAS (http): 30 -> 80
chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=80 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=30

8 ;;; NAS (https): 40 -> 443
chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=443 protocol=tcp in-interface=ether1 dst-port=40

9 ;;; NAS (https): 40 -> 443
chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=443 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=40

10 ;;; NAS (Active Directory - LDAP): 389,445,636,3268
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=389,445,636,3268

11 ;;; NAS (Active Directory - LDAP): 389,445,636,3268
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=389,445,636,3268

12 ;;; NAS (tcp): FTP (20,21), NetBIOS (137-139), SSH (849), RSYNC (873), Synology DSM (5000,5001,5005,5006), (7000,7001,10000,64000-64100)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=20,21,137-139,849,873,5000,5001,5005,5006,7000,7001,10000,64000-64100

13 ;;; NAS (tcp): FTP (20,21), NetBIOS (137-139), SSH (849), RSYNC (873), Synology DSM (5000,5001,5005,5006), (7000,7001,10000,64000-64100)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=20,21,137-139,849,873,5000,5001,5005,5006,7000,7001,10000,64000-64100

14 ;;; NAS (udp): RSYNC (873), (10000,64000-64100)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=udp in-interface=ether1 dst-port=873,10000,64000-64100

15 ;;; NAS (udp): RSYNC (873), (10000,64000-64100)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=udp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=873,10000,64000-64100

16 ;;; NAS (mail): SMTP/SMTPS (25,465,587,2525), 110 (POP3), 995 (POP3S), 143 (IMAP), 993 (IMAPS)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=25,465,587,2525,110,995,143,993

17 ;;; NAS (mail): SMTP/SMTPS (25,465,587,2525), 110 (POP3), 995 (POP3S), 143 (IMAP), 993 (IMAPS)
chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=25,465,587,2525,110,995,143,993

18 ;;; dev (SSH): 850 -> 22
chain=dstnat action=netmap to-addresses=192.168.1.114 to-ports=22 protocol=tcp in-interface=ether1 dst-port=850

19 ;;; dev (SSH): 850 -> 22
chain=dstnat action=netmap to-addresses=192.168.1.114 to-ports=22 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=850

20 ;;; dev (tcp): DNS (53), TELENTS (992), OpenVPN (1194), MySQL (3306), Proxy (8080), (5555,8005,8190)
chain=dstnat action=netmap to-addresses=192.168.1.114 protocol=tcp in-interface=ether1 dst-port=53,992,1194,3306,5555,8080,8005,8190

21 ;;; dev (tcp): DNS (53), TELENTS (992), OpenVPN (1194), MySQL (3306), Proxy (8080), (5555,8005,8190)
</source>

== Инструкция Антона ==

Подключаемся по ssh

ssh admin@http://192.168.1.10

<source lang="bash">
/ip firewall nat add action=masquerade chain=srcnat src-address=192.168.1.0/24

/ip firewall nat add action=netmap chain=dstnat dst-port=850 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=22
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=850 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=22

/ip firewall nat add action=netmap chain=dstnat dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=80
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=80 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=80

/ip firewall nat add action=netmap chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=443
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=443 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=443

/ip firewall nat add action=netmap chain=dstnat dst-port=5000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=5000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=5000

/ip firewall nat add action=netmap chain=dstnat dst-port=20 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=20
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=20 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=20

/ip firewall nat add action=netmap chain=dstnat dst-port=21 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=21
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=21 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=21

/ip firewall nat add action=netmap chain=dstnat dst-port=851 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=80
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=851 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=80

/ip firewall nat add action=netmap chain=dstnat dst-port=137 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=137
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=137 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=137

/ip firewall nat add action=netmap chain=dstnat dst-port=138 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=138
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=138 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=138

/ip firewall nat add action=netmap chain=dstnat dst-port=139 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=139
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=139 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=139

/ip firewall nat add action=netmap chain=dstnat dst-port=852 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=443
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=852 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=443

/ip firewall nat add action=netmap chain=dstnat dst-port=445 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=445
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=445 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=445

/ip firewall nat add action=netmap chain=dstnat dst-port=849 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=849 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-port=849 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=849 in-interface=bridge protocol=гвз src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=849

/ip firewall nat add action=netmap chain=dstnat dst-port=873 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=873 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-port=873 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=873 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=873

/ip firewall nat add action=netmap chain=dstnat dst-port=5000-5006 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=5000-5006
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5000-5006 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=5000-5006

/ip firewall nat add action=netmap chain=dstnat dst-port=7000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=7000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=7000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=7000

/ip firewall nat add action=netmap chain=dstnat dst-port=7001 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=7001
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=7001 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=7001

/ip firewall nat add action=netmap chain=dstnat dst-port=10000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=10000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=10000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=10000

/ip firewall nat add action=netmap chain=dstnat dst-port=10000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=10000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=10000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=10000

/ip firewall nat add action=netmap chain=dstnat dst-port=64000-64100 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=64000-64100 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-port=64000-64100 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=64000-64100 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=64000-64100

/ip firewall nat add action=netmap chain=dstnat dst-port=3389 in-interface=ether1 protocol=tcp to-addresses=192.168.1.103 to-ports=3389
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=3389 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.103 to-ports=3389

/ip firewall nat add action=netmap chain=dstnat dst-port=25 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=25
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=25 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=25

/ip firewall nat add action=netmap chain=dstnat dst-port=53 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=53 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-port=53 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=53 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=53

/ip firewall nat add action=netmap chain=dstnat dst-port=465 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=465
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=465 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=465

/ip firewall nat add action=netmap chain=dstnat dst-port=587 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=587
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=587 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=587

/ip firewall nat add action=netmap chain=dstnat dst-port=992 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=992 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-port=992 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=992 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=992

/ip firewall nat add action=netmap chain=dstnat dst-port=1194 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=1194 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-port=1194 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=1194 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=1194

/ip firewall nat add action=netmap chain=dstnat dst-port=5555 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5555 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-port=5555 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5555 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=5555

/ip firewall nat add action=netmap chain=dstnat dst-port=2525 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=2525
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=2525 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=2525

/ip firewall nat add action=netmap chain=dstnat dst-port=3306 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=3306
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=3306 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=3306

/ip firewall nat add action=netmap chain=dstnat dst-port=8080 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8080
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8080 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8080

/ip firewall nat add action=netmap chain=dstnat dst-port=8005 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8005
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8005 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8005

/ip firewall nat add action=netmap chain=dstnat dst-port=8190 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8190
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8190 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8190
</source>

== Ссылки ==

* [[Mikrotik]]
* [[Ports]]
* [[Servers]]
* [https://habr.com/ru/post/182166/ Проброс портов в Микротике — ликбез для начинающих / Хабр]
* [https://ru.wikipedia.org/wiki/%D0%A1%D0%BF%D0%B8%D1%81%D0%BE%D0%BA_%D0%BF%D0%BE%D1%80%D1%82%D0%BE%D0%B2_TCP_%D0%B8_UDP Список портов TCP и UDP — Википедия]

Проброс портов на Mikrotik - Історія редагувань

Romych: /* Ссылки */