直接接數據機的端口收到來至區網的封包 , 算正常嘛?
chrisintaipei wrote:
請問有辦法這樣嗎:
192.168.0.1 - 192.168.0.100 -> DNS server 8.8.8.8
192.168.0.101 - 192.168.0.254 -> DNS server 114.114.114.114
在RouterOS中的DHCP Server內的Networks設定
chrisintaipei wrote:
請問有辦法這樣嗎:
192.168.0.1 - 192.168.0.100 -> DNS server 8.8.8.8
192.168.0.101 - 192.168.0.254 -> DNS server 114.114.114.114..(恕刪)
直接 redirect. 不過我想你要問的不是這個. 但目的達到了.
Force users to use specified DNS server
This is just simple firewall rule which will force all Your users behind RB to use DNS server which You will define.
In /ip firewall nat
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=udp dst-port=53
This rule will force all users with custom defined DNS server to use 192.168.88.1 as their DNS server, this rule will simply redirect all request sent to ANY-IP:53 to 192.168.88.1:53
FB: Pctine
chrisintaipei wrote:
類似這樣嗎?但 address 只能輸入單個或 192.168.0.0/24 這樣，同網段沒法切開?
以下只有一個網段，192.168.0.0/24，但192.168.0.1 ~ 192.168.0.127取得8.8.8.8為DNS Server，而192.168.0.128 ~ 192.168.0.254取的114.114.114.114為DNS Server
/ip dhcp-server network
add address=192.168.0.0/25 dns-server=8.8.8.8 gateway=192.168.0.1
add address=192.168.0.128/25 dns-server=114.114.114.114 gateway=192.168.0.1
top100011 wrote:
請問各位大大，最近發現有被 DNS 攻擊，但本身我有台主機(192.168.11.100)有做 DNS 伺服器
如果以下列指令做防護的話，會影響到我 DNS 伺服主機運作嗎？
煩請大大幫我確認下，還是有更好的防護方式呢？
這是兩件事。你的 DNS Server (192.168.11.100)看樣子應該是給LAN用的，沒有對外提供服務的話(Port Mapping)，不用擔心這一台DNS Server被攻擊。至於你的router，本來就建議在firewall設定那邊，加上
/ip firewall filter
add action=drop chain=input dst-port=53 in-interface=all-ppp protocol=tcp
add action=drop chain=input dst-port=53 in-interface=all-ppp protocol=udp
阻擋掉所有來自 Internet 的DNS查詢
內文搜尋
從 APP 打開
X