Проброс портов на Mikrotik

Матеріал з Wiki.Zina
Версія від 13:18, 2 березня 2022, створена Romych (обговорення | внесок) (→Ссылки)
(різн.) ← Попередня версія | Поточна версія (різн.) | Новіша версія → (різн.)
Перейти до навігації Перейти до пошуку

http://mkrtk.zina.com.ua:48787/webfig/#IP:Firewall.NAT

Или зайти на http://mkrtk.zina.com.ua:48787 — IP — Firewall — NAT

Пример добавления проброса портов

[ред. | ред. код]

Для добавления правила с пробросом, например, 755 порта на 80 порт хоста 192.168.1.105, нужно выполнить две команды через http://mkrtk.zina.com.ua:48787/webfig/#IP:Firewall.NAT.new:

1)

  • chain=dstnat
  • protocol=6 (tcp)
  • dst-port=755
  • in-interface=ether1
  • action=netmap
  • to-addresses=192.168.1.105
  • to-ports=80
  • Comment: HP (HTTP): 755 -> 80

2)

  • chain=dstnat
  • src-address=192.168.1.0/24
  • dst-address=37.53.93.49
  • protocol=6 (tcp)
  • dst-port=755
  • in-interface=bridge
  • action=netmap
  • to-addresses=192.168.1.105
  • to-ports=80
  • Comment: HP (HTTP): 755 -> 80

Упорядоченная компактная версия от 2019-07-26

[ред. | ред. код]
[admin@MikroTik] > /ip firewall nat print 

 0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=WAN log=yes log-prefix="" ipsec-policy=out,none 

 1    chain=srcnat action=masquerade src-address=192.168.1.0/24 

 2    ;;; nikita - Angular (4200)
      chain=dstnat action=netmap to-addresses=192.168.1.108 protocol=tcp in-interface=ether1 dst-port=4200

 3    ;;; nikita - Angular (4200)
      chain=dstnat action=netmap to-addresses=192.168.1.108 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=4200

 4    ;;; tserver (RDP)
      chain=dstnat action=netmap to-addresses=192.168.1.103 protocol=tcp in-interface=ether1 dst-port=3389

 5    ;;; tserver (RDP)
      chain=dstnat action=netmap to-addresses=192.168.1.103 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=3389

 6    ;;; NAS (http): 30 -> 80
      chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=80 protocol=tcp in-interface=ether1 dst-port=30

 7    ;;; NAS (http): 30 -> 80
      chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=80 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=30

 8    ;;; NAS (https): 40 -> 443
      chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=443 protocol=tcp in-interface=ether1 dst-port=40

 9    ;;; NAS (https): 40 -> 443
      chain=dstnat action=netmap to-addresses=192.168.1.102 to-ports=443 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=40

10    ;;; NAS (Active Directory - LDAP): 389,445,636,3268
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=389,445,636,3268

11    ;;; NAS (Active Directory - LDAP): 389,445,636,3268
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=389,445,636,3268

12    ;;; NAS (tcp): FTP (20,21), NetBIOS (137-139), SSH (849), RSYNC (873), Synology DSM (5000,5001,5005,5006), (7000,7001,10000,64000-64100)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=20,21,137-139,849,873,5000,5001,5005,5006,7000,7001,10000,64000-64100

13    ;;; NAS (tcp): FTP (20,21), NetBIOS (137-139), SSH (849), RSYNC (873), Synology DSM (5000,5001,5005,5006), (7000,7001,10000,64000-64100)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=20,21,137-139,849,873,5000,5001,5005,5006,7000,7001,10000,64000-64100

14    ;;; NAS (udp): RSYNC (873), (10000,64000-64100)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=udp in-interface=ether1 dst-port=873,10000,64000-64100

15    ;;; NAS (udp): RSYNC (873), (10000,64000-64100)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=udp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=873,10000,64000-64100

16    ;;; NAS (mail): SMTP/SMTPS (25,465,587,2525), 110 (POP3), 995 (POP3S), 143 (IMAP), 993 (IMAPS)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp in-interface=ether1 dst-port=25,465,587,2525,110,995,143,993

17    ;;; NAS (mail): SMTP/SMTPS (25,465,587,2525), 110 (POP3), 995 (POP3S), 143 (IMAP), 993 (IMAPS)
      chain=dstnat action=netmap to-addresses=192.168.1.102 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=25,465,587,2525,110,995,143,993

18    ;;; dev (SSH): 850 -> 22
      chain=dstnat action=netmap to-addresses=192.168.1.114 to-ports=22 protocol=tcp in-interface=ether1 dst-port=850

19    ;;; dev (SSH): 850 -> 22
      chain=dstnat action=netmap to-addresses=192.168.1.114 to-ports=22 protocol=tcp src-address=192.168.1.0/24 dst-address=37.53.93.49 in-interface=bridge dst-port=850

20    ;;; dev (tcp): DNS (53), TELENTS (992), OpenVPN (1194), MySQL (3306), Proxy (8080), (5555,8005,8190)
      chain=dstnat action=netmap to-addresses=192.168.1.114 protocol=tcp in-interface=ether1 dst-port=53,992,1194,3306,5555,8080,8005,8190

21    ;;; dev (tcp): DNS (53), TELENTS (992), OpenVPN (1194), MySQL (3306), Proxy (8080), (5555,8005,8190)

Инструкция Антона

[ред. | ред. код]

Подключаемся по ssh 

ssh admin@http://192.168.1.10

/ip firewall nat add action=masquerade chain=srcnat src-address=192.168.1.0/24

/ip firewall nat add action=netmap chain=dstnat dst-port=850 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=22
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=850 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=22

/ip firewall nat add action=netmap chain=dstnat dst-port=80 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=80
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=80 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=80

/ip firewall nat add action=netmap chain=dstnat dst-port=443 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=443
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=443 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=443


/ip firewall nat add action=netmap chain=dstnat dst-port=5000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=5000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=5000

/ip firewall nat add action=netmap chain=dstnat dst-port=20 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=20
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=20 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=20


/ip firewall nat add action=netmap chain=dstnat dst-port=21 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=21
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=21 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=21


/ip firewall nat add action=netmap chain=dstnat dst-port=851 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=80
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=851 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=80

/ip firewall nat add action=netmap chain=dstnat dst-port=137 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=137
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=137 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=137

/ip firewall nat add action=netmap chain=dstnat dst-port=138 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=138
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=138 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=138

/ip firewall nat add action=netmap chain=dstnat dst-port=139 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=139
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=139 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=139

/ip firewall nat add action=netmap chain=dstnat dst-port=852 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=443
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=852 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=443

/ip firewall nat add action=netmap chain=dstnat dst-port=445 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=445
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=445 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=445



/ip firewall nat add action=netmap chain=dstnat dst-port=849 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=849 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-port=849 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=849
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=849 in-interface=bridge protocol=гвз src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=849


/ip firewall nat add action=netmap chain=dstnat dst-port=873 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=873 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-port=873 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=873
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=873 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=873


/ip firewall nat add action=netmap chain=dstnat dst-port=5000-5006 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=5000-5006
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5000-5006 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=5000-5006


/ip firewall nat add action=netmap chain=dstnat dst-port=7000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=7000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=7000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=7000

/ip firewall nat add action=netmap chain=dstnat dst-port=7001 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=7001
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=7001 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=7001

/ip firewall nat add action=netmap chain=dstnat dst-port=10000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=10000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=10000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=10000


/ip firewall nat add action=netmap chain=dstnat dst-port=10000 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=10000
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=10000 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=10000


/ip firewall nat add action=netmap chain=dstnat dst-port=64000-64100 in-interface=ether1 protocol=tcp to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=64000-64100 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-port=64000-64100 in-interface=ether1 protocol=udp to-addresses=192.168.1.102 to-ports=64000-64100
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=64000-64100 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.102 to-ports=64000-64100



/ip firewall nat add action=netmap chain=dstnat dst-port=3389 in-interface=ether1 protocol=tcp to-addresses=192.168.1.103 to-ports=3389
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=3389 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.103 to-ports=3389

/ip firewall nat add action=netmap chain=dstnat dst-port=25 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=25
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=25 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=25

/ip firewall nat add action=netmap chain=dstnat dst-port=53 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=53 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-port=53 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=53
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=53 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=53



/ip firewall nat add action=netmap chain=dstnat dst-port=465 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=465
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=465 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=465

/ip firewall nat add action=netmap chain=dstnat dst-port=587 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=587
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=587 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=587

/ip firewall nat add action=netmap chain=dstnat dst-port=992 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=992 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-port=992 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=992
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=992 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=992

/ip firewall nat add action=netmap chain=dstnat dst-port=1194 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=1194 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-port=1194 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=1194
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=1194 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=1194

/ip firewall nat add action=netmap chain=dstnat dst-port=5555 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5555 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-port=5555 in-interface=ether1 protocol=udp to-addresses=192.168.1.114 to-ports=5555
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=5555 in-interface=bridge protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=5555


/ip firewall nat add action=netmap chain=dstnat dst-port=2525 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=2525
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=2525 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=2525

/ip firewall nat add action=netmap chain=dstnat dst-port=3306 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=3306
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=3306 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=3306


/ip firewall nat add action=netmap chain=dstnat dst-port=8080 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8080
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8080 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8080

/ip firewall nat add action=netmap chain=dstnat dst-port=8005 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8005
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8005 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8005

/ip firewall nat add action=netmap chain=dstnat dst-port=8190 in-interface=ether1 protocol=tcp to-addresses=192.168.1.114 to-ports=8190
/ip firewall nat add action=netmap chain=dstnat dst-address=37.53.93.49 dst-port=8190 in-interface=bridge protocol=tcp src-address=192.168.1.0/24 to-addresses=192.168.1.114 to-ports=8190

Ссылки

[ред. | ред. код]
Отримано з https://mediawiki.zina.run/index.php?title=Проброс_портов_на_Mikrotik&oldid=731