eavictor wrote:
另一個解法試試看行不行吧，可以的話也是造福後人
1.Address List內將LAN IP分成static和dynamic (在src-address那邊)
2.兩條src-nat規則，分別套用上面的static和dynamic address list
3.手動設定route
這方法以前試過,可以指定PPPoE連出;
但外面經指定的PPPoE連入則一樣沒有辦法.
您會希望這些WAN可自行運用,可連入,可連出!!
透過策略路由,或者在NAT指定Src-Address皆可以管理您的連出;
但連入...您會發現除預設路由(優先對外的PPPoE),其它PPPoE都無法做進階的動作.
如:透過dst-nat轉Server電腦 ,或者是VPN連接.
甚至是從外面Ping PPPoE-IP這簡單動作都會無法回應...
所以您需透過標記,讓嘗試從PPPoE-OUT2入口進入的封包,能轉送到您的Server.
首先您得在/ip firewall address-list 新增All-Lan清單.
All-Lan清單至少要含192.168.1.0/24 10.0.0.0/24 這些本地網域,與VPN網域
接下來請匯入code:
/ip firewall mangle注意action=accept的Rules要先置頂才能發生作用
add chain=prerouting dst-address=192.168.1.0/24 src-address-list=All-Lan
add chain=prerouting dst-address-type=local src-address-list=All-Lan
add action=mark-connection chain=prerouting in-interface=pppoe-out1 \
new-connection-mark=pppoe1_conn
add action=mark-routing chain=output connection-mark=pppoe1_conn \
new-routing-mark=to_pppoe1 passthrough=no
add action=mark-routing chain=prerouting connection-mark=pppoe1_conn \
new-routing-mark=to_pppoe1 passthrough=no src-address=192.168.1.0/24
add action=mark-connection chain=prerouting in-interface=pppoe-out2 \
new-connection-mark=pppoe2_conn
add action=mark-routing chain=output connection-mark=pppoe2_conn \
new-routing-mark=to_pppoe2 passthrough=no
add action=mark-routing chain=prerouting connection-mark=pppoe2_conn \
new-routing-mark=to_pppoe2 passthrough=no src-address=192.168.1.0/24
/ip firewall nat
add action=masquerade chain=srcnat disabled=yes out-interface=pppoe-out1
add action=masquerade chain=srcnat disabled=yes out-interface=pppoe-out2
/ip route
add distance=1 gateway=pppoe-out1 routing-mark=to_pppoe1
add distance=1 gateway=pppoe-out2 routing-mark=to_pppoe2
爾後,您即能從任一個PPPoE入口進行VPN連接;
或者透過dst-nat ,將任一個從PPPoE進入的連線轉到您想要的Server上.
內文搜尋
從 APP 打開
X