[研究所] MikroTik RouterOS 學習 (持續更新)

1分

5481樓

個人積分：1分

文章編號：63038745

請問各位大大，

我現在有一條中華電信的FTTB線路給的資訊是Gateway=114.67.111.81 mask=255.255.255.240
有台WEB SERVER想用.84這個IP，其他的用.82上網出去，目前我的設定內部的所有電腦可以上網出的去，但是Service的部分進不來，請各位指教一下，謝謝。

以下是我的設定
/ip address
add address=114.67.111.82/28 interface=ether4-FTTB network=114.67.111.80
add address=192.168.12.1/24 interface=ether5-Lan2 network=192.168.12.0
add address=114.67.111.83/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.84/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.85/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.86/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.87/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.88/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.89/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.90/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.91/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.92/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.93/28 interface=ether4-FTTB network=114.67.111.80
add address=114.67.111.94/28 interface=ether4-FTTB network=114.67.111.80
/ip firewall filter
add action=accept chain=input comment=\
"\A4\B9\B3\\21,22,23,80,443,1723,8291 tcp port \B3s\A4J" dst-port=\
21,22,23,80,443,1723,8291 protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether4-FTTB \
src-address-list=192.168.12.1/24
add action=dst-nat chain=dstnat comment="Webserver Service Ports" \
dst-address=114.67.111.84 dst-port=53 in-interface=ether4-FTTB protocol=\
udp to-addresses=192.168.12.107 to-ports=53
add action=dst-nat chain=dstnat dst-address=114.67.111.84 dst-port=80 \
in-interface=ether4-FTTB protocol=tcp to-addresses=192.168.12.107 \
to-ports=80
add action=dst-nat chain=dstnat dst-address=114.67.111.84 dst-port=443 \
in-interface=ether4-FTTB protocol=tcp to-addresses=192.168.12.107 \
to-ports=443
add action=src-nat chain=srcnat out-interface=ether4-FTTB src-address=\
192.168.12.107 to-addresses=114.67.111.84
add action=src-nat chain=srcnat comment="Lan2 other IP Out by 114.67.111.82" \
out-interface=ether4-FTTB src-address=192.168.12.0/24 to-addresses=\
114.67.111.82
/ip route
add distance=1 gateway=114.67.111.81 pref-src=114.67.111.82

wiss075

56分

5482樓

wiss075

個人積分：56分

文章編號：63044313

請問前輩有遇過NAT的Src Port與Dst Port無法修改的情況嗎?

我的版本是6.39rc12配winbox 3.8...

wiss075

56分

5483樓

wiss075

個人積分：56分

文章編號：63044593

wiss075 wrote:
請問前輩有遇過NAT...(恕刪)

抱歉，找到方法了，Protocol欄位直接按箭頭跳出6 (tcp)無法修改，要按左邊下拉式箭頭才可改Src與Dst欄位，不曉得算是winbox3.8的bug還是正常的....

gfx

1603分

5484樓

gfx

個人積分：1603分

文章編號：63044608

boneyard wrote:
請問各位大大，
我現在有一條中華電信的FTTB線路...(恕刪)

gfx

1603分

5485樓

gfx

個人積分：1603分

文章編號：63044803

boneyard wrote:
請問各位大大，我現...(恕刪)

您主要的問題在排序,記得"越獨特的項目要越優先執行.

/ip firewall nat
add action=masquerade chain=srcnat comment="Nat Loopback" \
dst-address=192.168.12.0/24 src-address=192.168.12.0/24

add action=src-nat chain=srcnat comment="Webserver Service" \
out-interface=ether4-FTTB src-address=192.168.12.107 to-addresses=\
114.67.111.84

add action=src-nat chain=srcnat comment="Other IP Out by 114.67.111.82" \
out-interface=ether4-FTTB to-addresses=114.67.111.82

add action=dst-nat chain=dstnat comment="Webserver Service Ports" \
dst-address=114.67.111.84 dst-port=53 in-interface=ether4-FTTB protocol=\
udp to-addresses=192.168.12.107

add action=dst-nat chain=dstnat dst-address=114.67.111.84 dst-port=80,443 \
in-interface=ether4-FTTB protocol=tcp to-addresses=192.168.12.107

/ip route
add distance=5 gateway=114.67.111.81