DandelionJack wrote:
好文送你五分。...(恕刪)
gfx wrote:您的問題應該是連的...(恕刪)
今天問題又再發生了，我嘗試將fasttrack給停用，並將imcp額外加上accept output
從log和firewall rule都有看到封包進來router也有回應，但位於internet的裝置都沒有收到回應，當然vpn或是web console也都是連不進來的狀態，另外嘗試切換到不同的pppoe public ip也是沒有改善
再沒有重開機的情況下，我將fasttrack給啟用並恢復pppoe 固定public ip，這時候問題又突然消失了，這到底是fasttrack的問題還是中華的問題??
以下是我預設的filter rule
Flags: X - disabled, I - invalid, D - dynamic
0 D ;;; special dummy rule to show fasttrack counters
chain=forward action=passthrough
1 ;;; IPv4 firewall to a router -> default configuration
chain=input action=accept connection-state=established,related log=no
log-prefix=""
2 ;;; IPv4 firewall to a router -> allow to access router
chain=input action=accept src-address-list=allowed_to_router log=no
log-prefix=""
3 ;;; IPv4 firewall to a router -> allow web access
chain=input action=accept protocol=tcp dst-port=444 log=yes
log-prefix="Web444"
4 ;;; IPv4 firewall to a router -> allow web access
chain=output action=accept protocol=tcp src-port=444 log=yes
log-prefix="Web444"
5 ;;; IPv4 firewall to a router -> allow WinBox from VPN
chain=input action=accept protocol=tcp src-address=192.168.99.0/28
dst-port=8291 log=no log-prefix=""
6 X ;;; PPTP
chain=input action=accept protocol=tcp in-interface=HinetPPPoE
dst-port=1723 log=no log-prefix=""
7 X ;;; PPTP
chain=input action=accept protocol=gre in-interface=HinetPPPoE log=no
log-prefix=""
8 ;;; L2TP
chain=input action=accept protocol=udp dst-port=1701,500,4500 log=yes
log-prefix="L2TP"
9 ;;; L2TP
chain=input action=accept protocol=ipsec-esp log=yes log-prefix="L2TP"
10 chain=input action=accept protocol=ipsec-ah log=yes log-prefix="L2TP"
11 ;;; SSTP
chain=input action=accept protocol=tcp in-interface=HinetPPPoE
dst-port=443 log=yes log-prefix="SSTP"
12 ;;; OpenVPN
chain=input action=accept protocol=tcp in-interface=HinetPPPoE
dst-port=1443 log=yes log-prefix="OpenVPN"
13 ;;; IPv4 firewall to a router -> enable ICMP access
chain=input action=accept protocol=icmp log=yes log-prefix="ICMP_in"
14 ;;; IPv4 firewall to a router -> enable ICMP access
chain=output action=accept protocol=icmp log=yes log-prefix="ICMP_out"
15 chain=input action=drop protocol=udp in-interface=HinetPPPoE dst-port=53
log=yes log-prefix=""
16 chain=input action=drop protocol=tcp src-address-list=""
in-interface=HinetPPPoE dst-port=53 log=yes log-prefix=""
17 ;;; IPv4 firewall to a router -> drop everything else
chain=input action=drop log=yes log-prefix=""
18 ;;; IPv4 firewall for clients -> FastTrack
chain=forward action=fasttrack-connection
connection-state=established,related log=no log-prefix=""
19 ;;; IPv4 firewall for clients -> Established, Related
chain=forward action=accept connection-state=established,related log=no
log-prefix=""
20 ;;; block IOS update
chain=forward action=drop layer7-protocol=IOS src-address=0.0.0.0/0
log=no log-prefix=""
21 ;;; IPv4 firewall for clients -> Drop invalid
chain=forward action=drop connection-state=invalid log=no
log-prefix="invalid"
22 ;;; IPv4 firewall for clients -> Drop tries to reach not public addresses >
m LAN
chain=forward action=drop dst-address-list=not_in_internet
in-interface=bridge-local out-interface=!bridge-local log=no
log-prefix="!public_from_LAN"
23 ;;; IPv4 firewall for clients -> Drop incoming packets that are not NATted
chain=forward action=drop connection-state=new
connection-nat-state=!dstnat in-interface=ether1 log=no log-prefix="!NAT"
24 ;;; IPv4 firewall for clients -> Drop incoming from internet which is not >
lic IP
chain=forward action=drop src-address-list=not_in_internet
in-interface=ether1 log=no log-prefix="!public"
25 ;;; IPv4 firewall for clients -> Drop packets from LAN that do not have LA>
P
chain=forward action=drop src-address=!192.168.88.0/24
in-interface=bridge-local log=no log-prefix="LAN_!LAN"
MR喬治 wrote:
今天問題又再發生了，我嘗試將fasttrack給停用，並將imcp額外加上accept output
這筆rule一點意義也沒有吧...
firewall filter頁面又沒有其它chain=output的項目，是不會有連動的作用的。
我猜您會不會弄錯方向？
change mss是在/ip firewall mangle設置，與fasttrack是無關的。
另外還有的是fasttrack是靠switch chip轉發，會挑機器並非所有的機器都支援。
Manual:IP/Fasttrack
若您的機器非是列表上，尤其是安裝RouterOS的x86電腦，是不會有任何作用的。
甚至會因此丟失封包，要注意啊
MR喬治 wrote:我是說firewall filter的項目。
您好我有加上change...(恕刪)
首先您得先懂得action=accept的作用。
action=accept就有如霸王條款，
若您將此規擇的項目放在排序0的位置，只要有相同chain並細節有相關重疊的都會"無效"。
若此項目是擺在3的位置，但2的位置有相同的chain。
因firewall是依先進先出在運作，位於3的action=accept就無法影響2，就這樣。
而我說您在firewall filter新增chain=output action=accept沒意義，
是因為您chain=output的僅止一筆，並沒有其它同為chain=output，
action=accept根本沒有可影響發揮的餘地。
因為它作用不到其它，當然刪除也不會有任何影響。
內文搜尋
從 APP 打開
X