daniel323 wrote:
小弟目前線路有三條一...(恕刪)
我覺得您的設定很有問題,幾乎需要砍掉重做.
假設您從未設置下進行設定,您再檢討看看設定中,您遺漏了什麼地方.
/interface ethernet
先檢查您的ether設定(紅框的地方請特別注意):
ether1~4:
ether5:
/ip dhcp-client
固1:
固2:
記得記錄"固1"和"固2"的IP-Address及Gateway (極重要)
在Status頁面可查得到:
假設:
固1 IP:111.111.111.111 Gateway:111.111.111.1
固2 IP:222.222.222.222 Gateway:222.222.222.1
/interface pppoe-client
假設
DVR IP:192.168.88.3
WEB Server IP:192.168.88.2
房間電腦IP範圍:192.168.88.11-192.168.88.30
Office IP範圍:192.168.88.31-192.168.88.50
將下面的文字(rule)貼入Terminal視窗:
(在匯入前記得先把部份內容更正為您的IP)
/ip firewall nat
add action=src-nat chain=srcnat comment=Static1 \
out-interface=ether2 to-addresses=111.111.111.111
add action=src-nat chain=srcnat comment=Static2 \
out-interface=ether3 to-addresses=222.222.222.222
add action=masquerade chain=srcnat comment=PPPoE out-interface=pppoe-out1
add action=dst-nat chain=dstnat comment=DVR dst-address=111.111.111.111 \
to-addresses=192.168.88.3
add action=dst-nat chain=dstnat comment="WEB Server" dst-address=222.222.222.222 \
dst-port=80 protocol=tcp to-addresses=192.168.88.2
/ip firewall mangle
add action=mark-routing chain=prerouting comment="WEB server" \
new-routing-mark=to_static2 passthrough=no \
src-address=192.168.88.2
add action=mark-routing chain=prerouting comment=Office \
new-routing-mark=to_static2 passthrough=no \
src-address=192.168.88.31-192.168.88.50
add action=mark-routing chain=prerouting comment=Room \
new-routing-mark=to_pppoe passthrough=no \
src-address=192.168.88.11-192.168.88.30
/ip route
add comment=Static2 distance=1 gateway=222.222.222.1 \
routing-mark=to_static2
add comment=PPPoE distance=1 gateway=pppoe-out1 \
routing-mark=to_pppoe
何謂備援?
即固2 或PPPoE斷線,或未在/ip firewall mangle定義的連線都會往固1"送出".
所以DVR不需設定mangle ,因為它原本就選擇固1"送出".
但是DVR還是需設定Port Mapping ,這樣從固1連進來的封包才會往DVR"送入".
