Asus RT-N18U

[serjik]

Íó åñòü èíñòðóêöèÿ è äëÿ ÷àéíèêîâ, è äàæå ñ âåñåëûìè êàðòèíêàìè
http://www.zyxmon.org/2015/02/14/ust...lya-chajnikov/

ê ñîæàëåíèþ òîæå íå âàðèàíò òàê êàê ðàáîòàåò òîëüêî íà ïðîøèâêå Tomato êîòîðàÿ ïî ñîîáùåíèÿì ìíîãèõ íà äàííîì ðîóòåðå ðàáîòàåò óæàñíî! Äà è íå ëþáëþ ÿ ñòîðîííèå ïðîøèâêè, ðîäíûå ñåé÷àñ íå õóæå è íà ðîäíîé íà ïðîøëîì ðîóòåðå ïðåêðàñíî ðàáîòàë transmission, âîò è çäåñü áû õîòåëîñü åãî òàê æå èñïîëüçîâàòü

[sanc_6]

Çäðàâñòâóéòå!

Âîçíèê ñëåäóþùèé âîïðîñ!

Êàêèì îáðàçîì ìîæíî ôèëüòðîâàòü ïëîõèå ïàêåòû PIM-ïðîòîêîëà (ïðîòîêîë igmp-ìàðøðóòèçàöèè, snort ïèñàë çàïèñè òèïà "Bad Protocol" â ëîãè) è IGMP íà èíòåðôåéñå br0? Ïîíèìàåò ëè ôàåðâîëë iptables ïðè ñòàíäàðòíûõ åãî íàñòðîéêàõ ýòè ïðîòîêîëû?


Çàðàíåå ñïàñèáî!

[VOVA_iS]

Çäðàâñòâóéòå,
Íóæíà Âàøà ïîìîùü
Èìåþòñÿ äâà ðîóòåðà RT-N18 ìåæäó íèìè ïîäíÿò OpenVPN

Ðîóòåð À (Ñåðâåð)
Ñåòü 192.168.0.0 ìàñêà 255.255.255.0
Ìàðøðóòèçàöèÿ ïîñëå óñòàíîâêè VPN

Destination Gateway Genmask Flags Metric Ref Use Type Iface
10.94.255.190 * 255.255.255.255 UH 0 0 0 WAN0 ppp0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
192.168.0.0 * 255.255.255.0 U 0 0 0 LAN br0
169.254.0.0 * 255.255.0.0 U 0 0 0 MAN0 eth0
default 10.94.255.190 0.0.0.0 UG 0 0 0 WAN0 ppp0

Iptables

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N ACCESS_RESTRICTION
-N FUPNP
-N INPUT_ICMP
-N PControls
-N PTCSRVLAN
-N PTCSRVWAN
-N SECURITY
-N logaccept
-N logdrop
-A INPUT -i tun21 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i ppp10 -j ACCEPT
-A INPUT -i tun14 -j ACCEPT
-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT ! -i br0 -j PTCSRVWAN
-A INPUT -i br0 -j PTCSRVLAN
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -p icmp -j INPUT_ICMP
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i tun21 -j ACCEPT
-A FORWARD -i ppp10 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i ppp10 -j ACCEPT
-A FORWARD -i tun14 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i br0 -o ppp0 -j DROP
-A FORWARD ! -i br0 -o eth0 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A INPUT_ICMP -p icmp -m icmp --icmp-type 8 -j RETURN
-A INPUT_ICMP -p icmp -m icmp --icmp-type 13 -j RETURN
-A INPUT_ICMP -p icmp -j ACCEPT
-A PControls -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP

Ðîóòåð Â (Êëèåíò)
Ñåòü 192.168.1.0 ìàñêà 255.255.255.0
Ìàðøðóòèçàöèÿ ïîñëå óñòàíîâêè VPN

Destination Gateway Genmask Flags Metric Ref Use Type Iface
10.8.0.5 * 255.255.255.255 UH 0 0 0 tun15
10.94.255.254 * 255.255.255.255 UH 0 0 0 WAN0 ppp0
10.8.0.1 10.8.0.5 255.255.255.255 UGH 0 0 0 tun15
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
192.168.1.0 * 255.255.255.0 U 0 0 0 LAN br0
192.168.0.0 10.8.0.5 255.255.255.0 UG 500 0 0 tun15
169.254.0.0 * 255.255.0.0 U 0 0 0 MAN0 eth0
default 10.94.255.254 0.0.0.0 UG 0 0 0 WAN0 ppp0

iptables

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N ACCESS_RESTRICTION
-N FUPNP
-N INPUT_ICMP
-N PControls
-N PTCSRVLAN
-N PTCSRVWAN
-N SECURITY
-N logaccept
-N logdrop
-A INPUT -i tun15 -j ACCEPT
-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT ! -i br0 -j PTCSRVWAN
-A INPUT -i br0 -j PTCSRVLAN
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -p icmp -j INPUT_ICMP
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i tun15 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i br0 -o ppp0 -j DROP
-A FORWARD ! -i br0 -o eth0 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A FUPNP -d 192.168.1.240/32 -p tcp -m tcp --dport 6881 -j ACCEPT
-A FUPNP -d 192.168.1.240/32 -p udp -m udp --dport 6881 -j ACCEPT
-A FUPNP -d 192.168.1.61/32 -p udp -m udp --dport 9518 -j ACCEPT
-A FUPNP -d 192.168.1.61/32 -p tcp -m tcp --dport 9518 -j ACCEPT
-A FUPNP -d 192.168.1.67/32 -p tcp -m tcp --dport 21760 -j ACCEPT
-A FUPNP -d 192.168.1.67/32 -p tcp -m tcp --dport 4433 -j ACCEPT
-A FUPNP -d 192.168.1.67/32 -p udp -m udp --dport 21760 -j ACCEPT
-A INPUT_ICMP -p icmp -m icmp --icmp-type 8 -j RETURN
-A INPUT_ICMP -p icmp -m icmp --icmp-type 13 -j RETURN
-A INPUT_ICMP -p icmp -j ACCEPT
-A PControls -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP

Ðîóòåð B äàåò äîñòóï â ñåòü Ðîóòåðà À
À âîò ïàêåòû èç "À" â "Â" íå èäóò

Ïîíèìàþ ÷òî íå õâàòàåò ìàðøðóòà òîëüêî íå ïîéìó êàêîãî

[don-pedro]

Çäðàâñòâóéòå,
Íóæíà Âàøà ïîìîùü
Èìåþòñÿ äâà ðîóòåðà RT-N18 ìåæäó íèìè ïîäíÿò OpenVPN

Ðîóòåð À (Ñåðâåð)
Ñåòü 192.168.0.0 ìàñêà 255.255.255.0
Ìàðøðóòèçàöèÿ ïîñëå óñòàíîâêè VPN



Ðîóòåð Â (Êëèåíò)
Ñåòü 192.168.1.0 ìàñêà 255.255.255.0
Ìàðøðóòèçàöèÿ ïîñëå óñòàíîâêè VPN



Ðîóòåð B äàåò äîñòóï â ñåòü Ðîóòåðà À
À âîò ïàêåòû èç "À" â "Â" íå èäóò

Ïîíèìàþ ÷òî íå õâàòàåò ìàðøðóòà òîëüêî íå ïîéìó êàêîãî

Íà ðîóòåðå A:

192.168.1.0 10.8.0.2 255.255.255.0 UG 500 0 0 tun21

íàâåðíî...

[VOVA_iS]

Íà ðîóòåðå A:

192.168.1.0 10.8.0.2 255.255.255.0 UG 500 0 0 tun21

íàâåðíî...

Äîáàâèë â VPN ñåðâåð ñòðî÷êó

route 192.168.1.0 255.255.255.0 

È â ìàðøðóòàõ ïîÿâèëàñü íóæíàÿ ñòðî÷êà

Destination Gateway Genmask Flags Metric Ref Use Type Iface
10.94.255.190 * 255.255.255.255 UH 0 0 0 WAN0 ppp0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun21
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
192.168.1.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun21
192.168.0.0 * 255.255.254.0 U 0 0 0 LAN br0
169.254.0.0 * 255.255.0.0 U 0 0 0 MAN0 eth0
default 10.94.255.190 0.0.0.0 UG 0 0 0 WAN0 ppp0

Íî ïàêåòû èç "À" â "Â" íå èäóò äàæå ðîóòåð íå ïèíãóþòñÿ

[don-pedro]

192.168.0.0 * 255.255.254.0 U 0 0 0 LAN br0
Ïî÷åìó âäðóã òàê?

[VOVA_iS]

192.168.0.0 * 255.255.254.0 U 0 0 0 LAN br0
Ïî÷åìó âäðóã òàê?

Ýòî ÿ óæå ýêñïåðèìåíòû ñòàâèë. Ïðè ìàñêå 255.255.255.0 òàê æå íå èäóò ïàêåòû
Âîçìîæíî ïðàâèë â iptables íå õâàòàåò

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N ACCESS_RESTRICTION
-N FUPNP
-N INPUT_ICMP
-N PControls
-N PTCSRVLAN
-N PTCSRVWAN
-N SECURITY
-N logaccept
-N logdrop
-A INPUT -i tun21 -j ACCEPT
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i ppp11 -j ACCEPT
-A INPUT -i ppp10 -j ACCEPT
-A INPUT -i ppp0 -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT ! -i br0 -j PTCSRVWAN
-A INPUT -i br0 -j PTCSRVLAN
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A INPUT -p icmp -j INPUT_ICMP
-A INPUT -p tcp -m tcp --dport 1723 -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -j DROP
-A FORWARD -i tun21 -j ACCEPT
-A FORWARD -i ppp11 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i ppp11 -j ACCEPT
-A FORWARD -i ppp10 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -i ppp10 -j ACCEPT
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i br0 -o ppp0 -j DROP
-A FORWARD ! -i br0 -o eth0 -j DROP
-A FORWARD -m state --state INVALID -j DROP
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
-A INPUT_ICMP -p icmp -m icmp --icmp-type 8 -j RETURN
-A INPUT_ICMP -p icmp -m icmp --icmp-type 13 -j RETURN
-A INPUT_ICMP -p icmp -j ACCEPT
-A PControls -j ACCEPT
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A SECURITY -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A SECURITY -p icmp -m icmp --icmp-type 8 -m limit --limit 1/sec -j RETURN
-A SECURITY -p icmp -m icmp --icmp-type 8 -j DROP
-A SECURITY -j RETURN
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP