segabug wrote:
小弟今天從辦公室網路(恕刪)
segabug wrote:不放心的話用防火牆禁止吧。
我的SMB選單跟你的(恕刪)
/ip firewall raw add action=drop chain=output protocol=tcp src-port=139
ouchwe wrote:假設rb3011 eth10與wac510連接：
請問有人知道如何用VLAN...(恕刪)
/interface bridge
add name=bridge1
/interface bridge port
add bridge=bridge1 interface=ether2 hw=no
add bridge=bridge1 interface=ether3 hw=no
add bridge=bridge1 interface=ether4 hw=no
add bridge=bridge1 interface=ether5 hw=no
add bridge=bridge1 interface=ether6 hw=no
add bridge=bridge1 interface=ether7 hw=no
add bridge=bridge1 interface=ether8 hw=no
add bridge=bridge1 interface=ether9 hw=no
add bridge=bridge1 interface=ether10 hw=no
add bridge=bridge1 interface=sfp1 hw=no
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether10 untagged=ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,sfp1 vlan-ids=1
add bridge=bridge1 tagged=bridge1,ether10 vlan-ids=1733
/interface vlan
add interface=bridge1 vlan-id=1733 name=vlan1733
/ip address
add address=192.168.4.1/24 interface=bridge1
add address=172.16.0.1/24 interface=vlan1733
/interface bridge
set bridge1 vlan-filtering=yes
/ip pool
add name=lan ranges=192.168.4.2-192.168.4.254
add name=guest ranges=172.16.0.2-172.16.0.254
/ip dhcp-server
add address-pool=lan interface=bridge1
add address-pool=guest interface=vlan1733
/ip dhcp-server network
add address=192.168.4.0/24 gateway=192.168.4.1
add address=172.16.0.0/24 gateway=172.16.0.1
/ip dns
set allow-remote-requests=yes servers=168.95.1.1
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=pppoe-out1 src-address-type=!local
/ip firewall raw
add action=drop src-address=172.16.0.0/24 dst-address=192.168.4.0/24
ouchwe wrote:可以用switch chip操作啊
感謝gfx大大請問RB3011...(恕刪)
rb3011可以用switch chip橋接，也支持援cpu橋接。
但rb3011有兩個switch chip，彼此又不能控制對方chip的port，
所以這兩個chip需必取其中一個port用實體線串起來(ether5<->ether6)，
才算是真正的用switch chip串聯。
所以若vlan使用switch chip，您至少需準備兩個bridge：
bridge1：橋接ether2-ether5，還有sfp1。不啟用vlan。
bridge2：橋接ether6-ether10，啟用vlan。
/interface bridge
add name=bridge1 fast-forward=no protocol-mode=none
add name=bridge2 fast-forward=no protocol-mode=none
/interface bridge port
add bridge=bridge1 interface=sfp1
add bridge=bridge1 interface=ether2 hw=yes
add bridge=bridge1 interface=ether3 hw=yes
add bridge=bridge1 interface=ether4 hw=yes
add bridge=bridge1 interface=ether5 hw=yes
add bridge=bridge2 interface=ether6 hw=yes
add bridge=bridge2 interface=ether7 hw=yes
add bridge=bridge2 interface=ether8 hw=yes
add bridge=bridge2 interface=ether9 hw=yes
add bridge=bridge2 interface=ether10 hw=yes
/interface ethernet switch vlan
add ports=bridge2,ether10 switch=switch2 vlan-id=1733
/ip address
add address=192.168.4.1/24 interface=bridge1
add address=172.16.0.1/24 interface=bridge2
/interface ethernet switch port
set ether2 vlan-mode=disabled vlan-header=leave-as-is
set ether3 vlan-mode=disabled vlan-header=leave-as-is
set ether4 vlan-mode=disabled vlan-header=leave-as-is
set ether5 vlan-mode=disabled vlan-header=leave-as-is
set ether6 vlan-mode=secure vlan-header=leave-as-is
set ether7 vlan-mode=secure vlan-header=leave-as-is
set ether8 vlan-mode=secure vlan-header=leave-as-is
set ether9 vlan-mode=secure vlan-header=leave-as-is
set ether10 vlan-mode=secure vlan-header=leave-as-is
set switch1-cpu vlan-mode=disabled vlan-header=leave-as-is
set switch2-cpu vlan-mode=secure vlan-header=leave-as-is default-vlan-id=1733
/ip pool
add name=lan ranges=192.168.4.2-192.168.4.254
add name=guest ranges=172.16.0.2-172.16.0.254
/ip dhcp-server
add address-pool=lan interface=bridge1
add address-pool=guest interface=bridge2
/ip dhcp-server network
add address=192.168.4.0/24 gateway=192.168.4.1
add address=172.16.0.0/24 gateway=172.16.0.1
/ip dns
set allow-remote-requests=yes servers=168.95.1.1
/ip firewall nat
add action=masquerade chain=srcnat ipsec-policy=out,none out-interface=pppoe-out1 src-address-type=!local
/ip firewall raw
add action=drop src-address=172.16.0.0/24 dst-address=192.168.4.0/24
內文搜尋