chengjc wrote:需要我幫忙嗎
小弟我有兩台rb750gr3...(恕刪)
個人積分：1603分
文章編號：72557494
個人積分：4588分
文章編號：72557930
個人積分：82分
文章編號：72558052
原本天真的想法只要把舊的RB450G設定參數Backup後拿到RB450GX4 Restore 就可無痛升級..哪知道事情不是我想的那麼簡單..因為RB450GX4 被Restore後 5個接口 MAC-Address都被設定成原本RB450G的參數. 然後透過MAC Address Reset 後..MAC Address排列順序也是亂掉.. (例如原本MAC 是 1 2 3 4 5 , MAC Reset 會變成 2 4 5 3 1), 然後透過Neighbor登入的MAC Address 也是= RB450G 舊的 MAC...
不知道其他有經驗的大大們..請問小弟該怎樣操作才能把升級的工作 弄得最簡單呢?? 麻煩救救小弟吧..感恩.
PS: 因為小弟想到 RB450GX4 還要跟以前一樣..要一個一個Key..一個一個去設定....想到快要瘋掉...
個人單車日記 http://www.bikemap.net/user/kk57
個人積分：23分
文章編號：72558403
個人積分：368分
文章編號：72572386
個人積分：954分
文章編號：72573192
個人積分：79分
文章編號：72575023
目前用CCR內建的TERMINAL沒辦法PING任何的WAN網址，但PING LAN上的IP都可以
LAN上的每一個HOST也都可以順利上網，不知到是哪裡的問題導致內建無法PING出去
以下是我的設定，因為是公司的固定IP，所以我先刪除了部分資訊
# mar/27/2019 19:45:50 by RouterOS 6.43.4
# model = CCR1009-7G-1C-1S+
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=combo1 ] comment="HP Switch 1"
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes comment=Hinet interface=ether1 name=pppoe-Hinet \
password= service-name=Hinet use-peer-dns=yes user=\
@ip.hinet.net
/interface vlan
add interface=combo1 name=vlan10 vlan-id=10
add interface=combo1 name=vlan20 vlan-id=20
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.50-192.168.1.200
add name=OVPN_pool ranges=172.18.22.1-172.18.22.5
add name=Pool10 ranges=192.168.10.1-192.168.10.250
add name=Pool20 ranges=192.168.20.1-192.168.20.253
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 lease-time=1d name=dhcp1
add address-pool=Pool10 disabled=no interface=vlan10 lease-time=1d name=\
dhcp10
add address-pool=Pool20 disabled=no interface=vlan20 lease-time=1d name=\
dhcp20
/ppp profile
add dns-server=168.95.1.1,8.8.8.8 local-address=172.18.22.254 name=OVPN \
remote-address=OVPN_pool
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=combo1
/interface bridge settings
set use-ip-firewall=yes
/interface list member
add interface=bridge1 list=LAN
add interface=ether1 list=WAN
/interface ovpn-server server
set certificate=ca.crt_0 cipher=blowfish128,aes128,aes192,aes256 mode=\
ethernet port=1943
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2 network=\
192.168.1.0
add address=/24 interface=ether1 network=220.128.137.0
add address=192.168.10.254/24 interface=vlan10 network=192.168.10.0
add address=192.168.20.254/24 interface=vlan20 network=192.168.20.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
add address=192.168.10.0/24 gateway=192.168.10.254
add address=192.168.20.0/24 gateway=192.168.20.254
/ip dns
set servers=168.95.1.1
/ip firewall nat
add action=masquerade chain=srcnat comment="\\B9w\\B3]NAT" out-interface-list=\
WAN
add action=dst-nat chain=dstnat comment=OVPN dst-address=\
dst-port=1943 in-interface=ether1 protocol=udp to-addresses=192.168.1.252 \
to-ports=1943
add action=dst-nat chain=dstnat comment="\\BA\\CA\\B5\\F8\\BE\\B9DVR" disabled=yes \
dst-address= dst-port=34567 in-interface=ether1 protocol=\
tcp to-addresses=192.168.1.30 to-ports=34567
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add distance=1 gateway=220.128.137.254
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/ip upnp
set allow-disable-external-interface=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=pppoe-Hinet type=external
個人積分：82分
文章編號：72576034
個人積分：1603分
文章編號：72576897
個人積分：79分
文章編號：72577237
另外現在只有純固定IP對外(一固6 IP)其他中某一個IP我拿來架WEBSERVER是可以直接PING出去的(不透過ROUTEROS，直接對外)，PPPOE已經沒有再用只是留著但是DISABLE了，請您再看一下有沒有什麼地方需要調整
/interface bridge
add name=bridge1
/interface ethernet
set [ find default-name=combo1 ] comment="HP Switch 1"
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=sfp-sfpplus1 ] disabled=yes
/interface pppoe-client
add add-default-route=yes comment=Hinet interface=ether1 name=pppoe-Hinet \
password=lobuxtfn service-name=Hinet use-peer-dns=yes user=\
7XXXXX@ip.hinet.net
/interface vlan
add interface=combo1 name=vlan10 vlan-id=10
add interface=combo1 name=vlan20 vlan-id=20
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.1.50-192.168.1.200
add name=OVPN_pool ranges=172.18.22.1-172.18.22.5
add name=Pool10 ranges=192.168.10.1-192.168.10.250
add name=Pool20 ranges=192.168.20.1-192.168.20.253
/ip dhcp-server
add address-pool=dhcp disabled=no interface=bridge1 lease-time=1d name=dhcp1
add address-pool=Pool10 disabled=no interface=vlan10 lease-time=1d name=\
dhcp10
add address-pool=Pool20 disabled=no interface=vlan20 lease-time=1d name=\
dhcp20
/ppp profile
add dns-server=168.95.1.1,8.8.8.8 local-address=172.18.22.254 name=OVPN \
remote-address=OVPN_pool
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=sfp-sfpplus1
add bridge=bridge1 interface=combo1
/interface bridge settings
set use-ip-firewall=yes
/interface list member
add interface=bridge1 list=LAN
add interface=ether1 list=WAN
/interface ovpn-server server
set certificate=ca.crt_0 cipher=blowfish128,aes128,aes192,aes256 mode=\
ethernet port=1943
/ip address
add address=192.168.1.1/24 comment=defconf interface=ether2 network=\
192.168.1.0
add address=220.128.137.XXX/24 interface=ether1 network=220.128.137.0
add address=192.168.10.254/24 interface=vlan10 network=192.168.10.0
add address=192.168.20.254/24 interface=vlan20 network=192.168.20.0
/ip dhcp-client
add dhcp-options=hostname,clientid interface=ether1
/ip dhcp-server network
add address=192.168.1.0/24 gateway=192.168.1.1 netmask=24
add address=192.168.10.0/24 gateway=192.168.10.254
add address=192.168.20.0/24 gateway=192.168.20.254
/ip dns
set servers=168.95.1.1
/ip firewall address-list
add address=trendmicro.com list=WFBS
add address=wfbs-svc-nabu-aal.trendmicro.com list=WFBS
add address=saasubt.trendmicro.com list=WFBS
add address=wfbs-svc-dl-nabu.trendmicro.com list=WFBS
add address=wfbs-svc-nabu.trendmicro.com list=WFBS
add address=wfbs-svc30-p.activeupdate.trendmicro.com list=WFBS
add address=wfbs-svc30-p.pre-opr-au.trendmicro.com list=WFBS
add address=wfbs-svc-dl-emea.trendmicro.com list=WFBS
add address=wfbssvc61.icrc.trendmicro.com list=WFBS
add address=wfbs-svc500-en.fbs10.trendmicro.com list=WFBS
add address=wfbss57-en-us.grid-gfr.trendmicro.com list=WFBS
add address=wfbs-svc550-en.census.trendmicro.com list=WFBS
add address=cspi.trendmicro.com list=WFBS
add address=housecall71.nfc.trendmicro.com list=WFBS
add address=attk-en.census.trendmicro.com list=WFBS
add address=wfbssvc63-attk.icrc.trendmicro.com list=WFBS
add address=wfbs-svc61-ja-b.trx.trendmicro.com list=WFBS
add address=wfbs-svc61-ja-f.trx.trendmicro.com list=WFBS
add address=wfbs-svc50-el.url.trendmicro.com list=WFBS
add address=backup36.url.trendmicro.com list=WFBS
add address=wfbs-svc-emea.trendmicro.com list=WFBS
add address=wfbs-svc-emea-aal.trendmicro.com list=WFBS
add address=wfbs-svc-nabu-mobile-aal.trendmicro.com list=WFBS
add address=wfbs-svc-emea-mobile-aal.trendmicro.com list=WFBS
add address=168.95.1.1 list=WFBS
add comment="Black List (Telnet)" list="Black List (Telnet)"
add address=192.168.1.250 list="Block Internet"
add address=192.168.1.251 list="Block Internet"
add address=192.168.1.9 list="Block Internet"
/ip firewall filter
add action=add-src-to-address-list address-list=syn-flood \
address-list-timeout=1h chain=input comment=Anti-Syn-flood \
connection-limit=30,32 protocol=tcp tcp-flags=syn
add action=drop chain=input src-address-list=syn-flood
add action=drop chain=input comment="\\C3\\F6\\B3\\AC\\A5~\\BA\\F4ICMP\\A6^\\C0\\B3" \
in-interface=ether1 protocol=icmp
add action=drop chain=input comment=\
"\AB\CA\C2\EA\A5~\BA\F4\B5n\BF\FDRouterOS\BA\F4\AD\B6" dst-port=80 \
in-interface=ether1 protocol=tcp
add action=drop chain=input comment="\\A8\\BE\\A4\\EEDoS\\A7\\F0\\C0\\BB" \
connection-limit=10,32 protocol=tcp
add action=drop chain=input comment="\\A8\\BE\\A4\\EE port scanning" protocol=tcp \
src-address-list="port scanners"
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=\
fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=\
fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=input protocol=tcp tcp-flags=\
!fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=forward protocol=tcp tcp-flags=\
fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=forward protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=forward protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=forward protocol=tcp tcp-flags=\
fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list="port scanners" \
address-list-timeout=2w chain=forward protocol=tcp tcp-flags=\
fin,syn,rst,psh,ack,urg
add action=drop chain=forward comment="#\\A8\\BE\\A4\\EESSH\\A1BTelnet\\A4j\\B6q\\B3s\\
\\BDu(DMZ)\\A1G30\\AC\\ED\\A4\\BA\\A1A\\AB\\D8\\A5\\DF\\B3s\\BDu4\\A6\\B8\\A5H\\A4W(\\A7t)\\
\\A1C\\B4NDrop\\B1\\BC" dst-port=22,23 protocol=tcp src-address-list=\
ssh_blacklist
add action=log chain=forward connection-state=new dst-port=22,23 log-prefix=\
"Ban SSH_" protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=1d chain=forward connection-state=new dst-port=22,23 \
protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=30s chain=forward connection-state=new \
dst-address-list=!Admin_IP dst-port=22,23 protocol=tcp src-address-list=\
ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
address-list-timeout=30s chain=forward connection-state=new dst-port=\
22,23 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
address-list-timeout=30s chain=forward connection-state=new dst-address=\
192.168.1.0/24 dst-port=22,23 protocol=tcp src-address-list=!Admin_IP
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \
protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist \
address-list-timeout=2w6d chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 \
address-list-timeout=1m chain=input connection-state=new dst-port=22 \
protocol=tcp
add action=drop chain=forward comment="drop ssh brute downstream" dst-port=22 \
protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input comment="Drop anyone in Black List (Telnet)." \
log=yes log-prefix="BL_Black List (Telnet)" src-address-list=\
"Black List (Telnet)"
add action=jump chain=input comment="Jump to Black List (Telnet) chain." \
dst-port=23 jump-target="Black List (Telnet) Chain" protocol=tcp
add action=add-src-to-address-list address-list="Black List (Telnet)" \
address-list-timeout=4w2d chain="Black List (Telnet) Chain" comment="Trans\\
fer repeated attempts from Black List (Telnet) Stage 3 to Black List (Teln\\
et)." connection-state=new log=yes log-prefix="Add_Black List (Telnet)" \
src-address-list="Black List (Telnet) Stage 3"
add action=add-src-to-address-list address-list="Black List (Telnet) Stage 3" \
address-list-timeout=4w2d chain="Black List (Telnet) Chain" comment=\
"Add successive attempts to Black List (Telnet) Stage 3." \
connection-state=new log=yes log-prefix="Add_Black List (Telnet) S3" \
src-address-list="Black List (Telnet) Stage 2"
add action=add-src-to-address-list address-list="Black List (Telnet) Stage 2" \
address-list-timeout=1w3d chain="Black List (Telnet) Chain" comment=\
"Add successive attempts to Black List (Telnet) Stage 2." \
connection-state=new log=yes log-prefix="Add_Black List (Telnet) S2" \
src-address-list="Black List (Telnet) Stage 1"
add action=add-src-to-address-list address-list="Black List (Telnet) Stage 1" \
address-list-timeout=1d chain="Black List (Telnet) Chain" comment=\
"Add initial attempt to Black List (Telnet) Stage 1." connection-state=\
new log=yes log-prefix="Add_Black List (Telnet) S1"
add action=return chain="Black List (Telnet) Chain" comment=\
"Return From Black List (Telnet) chain."
add action=accept chain=forward comment=\
"WFBS\A8\BE\ACr\A7\F3\B7s\A5\D5\A6W\B3\E6" dst-address-list=WFBS
add action=drop chain=forward comment="\\A9\\DA\\B5\\B4\\B3s\\A5~Block Internet" \
src-address-list="Block Internet"
add action=drop chain=forward comment="\\B8T\\A4\\EEOVPN\\B3s\\BDuServer" \
dst-address-list="Block Internet" src-address=172.18.22.0/24
add action=add-src-to-address-list address-list=OVPN_LOGIN \
address-list-timeout=2w1d chain=forward comment=\
"OVPN\B3s\BDu\AC\F6\BF\FD" connection-state=new dst-port=1943 protocol=\
udp
add action=drop chain=forward comment="\\B8T\\A4\\EEDVR\\B3s\\BDu\\A4\\BA\\BA\\F4" \
disabled=yes dst-address=192.168.1.0/24 src-address=192.168.1.30
add action=drop chain=forward comment="\\B8T\\A4\\EEDVR\\B3s\\BDu\\A4\\BA\\BA\\F4" \
disabled=yes dst-address=192.168.1.30 src-address=192.168.1.92
/ip firewall nat
add action=masquerade chain=srcnat comment="\\B9w\\B3]NAT" out-interface-list=\
WAN
add action=dst-nat chain=dstnat comment=\
"\BB\B7\BA\DD\AE\E0\AD\B1192.168.1.10" disabled=yes dst-address=\
220.132.243.XXX dst-port=11116 in-interface=pppoe-Hinet protocol=tcp \
to-addresses=192.168.1.10 to-ports=3389
add action=dst-nat chain=dstnat comment=OVPN dst-address=220.128.137.XXX \
dst-port=1943 in-interface=ether1 protocol=udp to-addresses=192.168.1.252 \
to-ports=1943
add action=dst-nat chain=dstnat comment="\\BA\\CA\\B5\\F8\\BE\\B9DVR" disabled=yes \
dst-address=220.128.137.XXX dst-port=34567 in-interface=ether1 protocol=\
tcp to-addresses=192.168.1.30 to-ports=34567
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
set udplite disabled=yes
set dccp disabled=yes
set sctp disabled=yes
/ip route
add distance=1 gateway=220.128.137.254
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=192.168.1.0/24
set api-ssl disabled=yes
/ip upnp
set allow-disable-external-interface=yes
/ip upnp interfaces
add interface=bridge1 type=internal
add interface=pppoe-Hinet type=external
/lcd
set backlight-timeout=5m
/lcd pin
set pin-number=1379
/system clock
set time-zone-name=Asia/Taipei
/system ntp client
set enabled=yes primary-ntp=103.18.128.60 secondary-ntp=118.163.81.61
/system routerboard settings
set silent-boot=no
