<div dir="ltr">ho rimosso le regole di drop, ma ancora nessun risultato:<div><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1">[admin@MikroTik] > ip firewall filter print</font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1">Flags: X - disabled, I - invalid, D - dynamic </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> 0 ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> chain=input action=accept protocol=icmp </font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"><br></font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 1 ;;; default configuration</font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> chain=input action=accept connection-state=established </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"><br></font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 2 ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> chain=input action=accept connection-state=related </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"><br></font></div></div>
</blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 3 ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> chain=forward action=accept connection-state=established </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"><br></font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 4 ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> chain=forward action=accept connection-state=related </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"><br></font></div></div>
</blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 5 chain=input action=accept protocol=tcp in-interface=ether1-gateway </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1">[admin@MikroTik] > ip firewall nat print </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1">Flags: X - disabled, I - invalid, D - dynamic </font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 0 X ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> chain=srcnat action=masquerade out-interface=ether1-gateway </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"><br></font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 1 chain=dstnat action=dst-nat to-addresses=192.168.88.20 to-ports=2080 protocol=tcp in-interface=ether1-gateway dst-port=2080 </font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1">[admin@MikroTik] > ip address print</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1">Flags: X - disabled, I - invalid, D - dynamic </font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> # ADDRESS NETWORK INTERFACE </font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 0 ;;; default configuration</font></div></div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px">
<div><div><font size="1"> <a href="http://192.168.88.1/24">192.168.88.1/24</a> 192.168.88.0 ether2-master-local </font></div>
</div></blockquote><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><font size="1"> 1 D <a href="http://192.168.0.25/24">192.168.0.25/24</a> 192.168.0.0 ether1-gateway </font></div></div><div>
<font size="1"><br></font></div></blockquote></blockquote>dove sbaglio?</div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-06-02 19:05 GMT+02:00 Filippo Madaro <span dir="ltr"><<a href="mailto:filippo.madaro@gmail.com" target="_blank">filippo.madaro@gmail.com</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">La regola 3 taglia tutto ciò che tenta di entrare dalla wan e quindi<br>
la regola 7 non viene presa in considerazione ... chain=input<br>
action=drop in-interface=ether1-gateway<br>
<br>
<br>
Il 02/06/14, Luca Postregna<<a href="mailto:luca.postregna@gmail.com">luca.postregna@gmail.com</a>> ha scritto:<br>
<div class="HOEnZb"><div class="h5">> Salve genti,<br>
> ho da poco iniziato a giocare con un mikrotik rb750gl, aggiornato a<br>
> firmware 6.13.<br>
> Il device è configurato in modalità router, ed ho difficoltà a configurare<br>
> il port forwarding.<br>
> Sulla porta WAN è assegnato l'indirizzo <a href="http://192.168.0.25/24" target="_blank">192.168.0.25/24</a>, mentre lato LAN<br>
> distribuisco la subnet di default <a href="http://192.168.88.0/24" target="_blank">192.168.88.0/24</a>.<br>
> Su un device locale lato LAN è in ascolto un server web <a href="http://192.168.88.20:2080" target="_blank">192.168.88.20:2080</a>,<br>
> che vorrei raggiungere direttamente dall'ip della WAN su <a href="http://192.168.0.25:2080" target="_blank">192.168.0.25:2080</a>.<br>
> Questa è la mia configurazione attuale:<br>
><br>
> [admin@MikroTik] > ip firewall filter print<br>
> Flags: X - disabled, I - invalid, D - dynamic<br>
> 0 ;;; default configuration<br>
> chain=input action=accept protocol=icmp<br>
><br>
> 1 ;;; default configuration<br>
> chain=input action=accept connection-state=established<br>
><br>
> 2 ;;; default configuration<br>
> chain=input action=accept connection-state=related<br>
><br>
> 3 ;;; default configuration<br>
> chain=input action=drop in-interface=ether1-gateway<br>
><br>
> 4 ;;; default configuration<br>
> chain=forward action=accept connection-state=established<br>
><br>
> 5 ;;; default configuration<br>
> chain=forward action=accept connection-state=related<br>
><br>
> 6 ;;; default configuration<br>
> chain=forward action=drop connection-state=invalid<br>
><br>
> 7 chain=input action=accept protocol=tcp in-interface=ether1-gateway<br>
> [admin@MikroTik] > ip firewall nat print<br>
> Flags: X - disabled, I - invalid, D - dynamic<br>
> 0 ;;; default configuration<br>
> chain=srcnat action=masquerade out-interface=ether1-gateway<br>
><br>
> 1 chain=dstnat action=dst-nat to-addresses=192.168.88.20 to-ports=2080<br>
> protocol=tcp in-interface=ether1-gateway dst-port=2080<br>
> [admin@MikroTik] > ip address print<br>
> Flags: X - disabled, I - invalid, D - dynamic<br>
> # ADDRESS NETWORK INTERFACE<br>
><br>
><br>
> 0 ;;; default configuration<br>
> <a href="http://192.168.88.1/24" target="_blank">192.168.88.1/24</a> 192.168.88.0 ether2-master-local<br>
><br>
><br>
> 1 D <a href="http://192.168.0.25/24" target="_blank">192.168.0.25/24</a> 192.168.0.0 ether1-gateway<br>
><br>
><br>
> Con questa configurazione se digito nel browser <a href="http://192.168.0.25:2080" target="_blank">192.168.0.25:2080</a> il port<br>
> forwarding non funge, questo vale per test con il client in entrambe le<br>
> subnet <a href="http://192.168.0.0/24" target="_blank">192.168.0.0/24</a> e <a href="http://192.168.88.0/24" target="_blank">192.168.88.0/24</a>.<br>
> Non capisco dove sia il problema, qualche regola sbagliata, piuttosto che<br>
> priorità nelle regole del firewall.<br>
><br>
> Qualcuno mi da una mano?<br>
><br>
> Saluti,<br>
> Luca.<br>
><br>
> --<br>
> <a href="http://luca.postregna.name" target="_blank">luca.postregna.name</a><br>
> <a href="http://twitter.com/lucapost" target="_blank">twitter.com/lucapost</a><br>
><br>
<br>
<br>
</div></div><span class="HOEnZb"><font color="#888888">--<br>
p.i. *Filippo Madaro*<br>
Mob. <a href="tel:3883448904" value="+393883448904">3883448904</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><a href="http://luca.postregna.name/" target="_blank">luca.postregna.name</a></div><div><a href="http://twitter.com/lucapost" target="_blank">twitter.com/lucapost</a></div>
</div>