Пытаюсь внедрить в одной организации L3 маршрутизацию: по сути просто деление одной большой одноранговой сетки на 5 по меньше.
Поставил 2011uai-rs настроил правила фильтрации, пакеты бегают классно и все вроде норм, но сегодня столкнулся с одной крупной проблемой.
Суть дела: в сети есть сервера 192.168.1.10/24 и 192.168.1.87/24 на которых расположенно несколько программ (1c77, clipper, бизнес-инфо) обращение к которым идет по SMB (тупо вытянуты ярлыки или идет чтение dbf)
В одноранговой сети все прекрасно работает, при переводе клиентов в сегменты 192.168.4.х/26 и 192.168.3.х/29 у компов с WinXP наблюдается потеря связи с данными приложениями: сетевые ошибки на подобии External exception C0000006, read error и просто вылетов. При этом эти же программы на Win7/8 работают вроде как без сбоев.
Мне кажется причина в том что микрот как-то рвет зависшие/тяжелые соединения/пакеты, а хрюша их не может на лету восстанавливать. Подскажите где я мог накосячить или недоделать в фаерволе, что рвутся только зависшие/тяжелые пакеты?
Легкий траффик типо RDP интернета, открытия файликов пролетает без проблем.
export compact
/interface bridge
add name=bridge1-pro
add name=bridge2-file
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=pool1-adm ranges=192.168.4.40-192.168.4.60
add name=pool2-guest ranges=192.168.8.20-192.168.8.60
/ip dhcp-server
add address-pool=pool1-adm authoritative=after-2sec-delay disabled=no interface=ether9-adm lease-time=\
1d name=dhcp-adm
add address-pool=pool2-guest authoritative=after-2sec-delay disabled=no interface=ether2-file \
lease-time=1d name=dhcp-guest
/port
set 1 baud-rate=9600 data-bits=8 flow-control=none name=usb2 parity=none stop-bits=1
/interface ppp-client
add apn=internet name=ppp-out1 port=usb2
/interface bridge port
add bridge=bridge2-file interface=ether3-file
add bridge=bridge2-file interface=ether4-file
add bridge=bridge1-pro comment="proizvodstvo network" interface=ether6-pro
add bridge=bridge1-pro interface=ether7-pro
add bridge=bridge1-pro interface=ether8-pro
add bridge=bridge2-file comment="fileserver and sysadmnin network" interface=ether2-file
/ip address
add address=192.168.1.3/24 interface=ether10-wan network=192.168.1.0
add address=192.168.2.1/29 interface=ether5-db network=192.168.2.0
add address=192.168.3.1/29 interface=bridge2-file network=192.168.3.0
add address=192.168.4.1/26 interface=ether9-adm network=192.168.4.0
add address=192.168.5.1/26 interface=bridge1-pro network=192.168.5.0
add address=192.168.8.1/26 interface=ether1-guest network=192.168.8.0
/ip dhcp-server network
add address=192.168.4.0/26 dns-server=192.168.4.1,82.209.200.16,82.209.200.17,8.8.8.8,1.1.1.1 gateway=\
192.168.4.1 netmask=26
add address=192.168.8.0/26 dns-server=192.168.8.1,82.209.200.16,82.209.200.17,8.8.8.8,1.1.1.1 gateway=\
192.168.8.1 netmask=26
/ip dns
set allow-remote-requests=yes query-server-timeout=4s servers=\
82.209.200.16,82.209.200.17,8.8.8.8,1.1.1.1
/ip firewall filter
add action=accept chain=forward comment="ICMP PING" protocol=icmp
add action=accept chain=forward comment="TO DB" dst-address=192.168.2.0/29 dst-port=80,443,3389 \
in-interface=bridge2-file out-interface=ether5-db protocol=tcp src-address=192.168.3.0/29
add action=accept chain=forward dst-address=192.168.3.0/29 in-interface=ether5-db out-interface=\
bridge2-file protocol=tcp src-address=192.168.2.0/29 src-port=80,443,3389
add action=accept chain=forward dst-address=192.168.2.0/29 dst-port=3389 in-interface=ether9-adm \
out-interface=ether5-db protocol=tcp src-address=192.168.4.0/26
add action=accept chain=forward dst-address=192.168.4.0/26 in-interface=ether5-db out-interface=\
ether9-adm protocol=tcp src-address=192.168.2.0/29 src-port=3389
add action=accept chain=forward dst-address=192.168.2.0/29 dst-port=3389 in-interface=bridge1-pro \
out-interface=ether5-db protocol=tcp src-address=192.168.5.0/26
add action=accept chain=forward dst-address=192.168.5.0/26 in-interface=ether5-db out-interface=\
bridge1-pro protocol=tcp src-address=192.168.2.0/29 src-port=3389
add action=accept chain=forward comment="NETWORK FILE" dst-address=192.168.3.0/29 dst-port=139,445 \
in-interface=ether5-db out-interface=bridge2-file protocol=tcp src-address=192.168.2.0/29 \
src-port=139,445
add action=accept chain=forward dst-address=192.168.3.0/29 dst-port=80,139,445,3389,8080 in-interface=\
ether9-adm out-interface=bridge2-file protocol=tcp src-address=192.168.4.0/26 src-port=""
add action=accept chain=forward dst-address=192.168.4.0/26 dst-port="" in-interface=bridge2-file \
out-interface=ether9-adm protocol=tcp src-address=192.168.3.0/29 src-port=80,139,445,3389,8080
add action=accept chain=forward dst-address=192.168.3.0/29 dst-port=139,445,3389 in-interface=\
bridge1-pro out-interface=bridge2-file port="" protocol=tcp src-address=192.168.5.0/26 src-port=\
139,445,3389
add action=accept chain=forward comment=IPMI dst-address=192.168.4.0/26 dst-port=\
80,443,623,5900,5901,5120,5123 in-interface=bridge2-file out-interface=ether9-adm protocol=tcp \
src-address=192.168.3.0/29 src-port=80,443,623,5900,5901,5120,5123
add action=accept chain=forward dst-address=192.168.4.0/26 dst-port=623 in-interface=bridge2-file \
out-interface=ether9-adm protocol=udp src-address=192.168.3.0/29 src-port=623
add action=accept chain=forward dst-address=192.168.3.0/29 dst-port=80,443,623,5900,5901,5120,5123 \
in-interface=ether9-adm out-interface=bridge2-file protocol=tcp src-address=192.168.4.0/26 \
src-port=80,443,623,5900,5901,5120,5123
add action=accept chain=forward dst-address=192.168.3.0/29 dst-port=623 in-interface=ether9-adm \
out-interface=bridge2-file protocol=udp src-address=192.168.4.0/26 src-port=623
add action=accept chain=forward comment="FORWARD INTERNET" connection-state=established,new \
in-interface=ether1-guest out-interface=ether10-wan src-address=192.168.8.0/26
add chain=forward connection-state=established,new in-interface=ether5-db out-interface=ether10-wan \
src-address=192.168.2.0/29
add chain=forward connection-state=established,new in-interface=bridge2-file out-interface=ether10-wan \
src-address=192.168.3.0/29
add action=accept chain=forward connection-state=invalid,established,related,new,untracked \
in-interface=ether9-adm out-interface=ether10-wan src-address=192.168.4.0/26
add action=accept chain=forward connection-state=established,new in-interface=bridge1-pro \
out-interface=ether10-wan src-address=192.168.5.0/26
add action=accept chain=forward connection-state=established,related in-interface=ether10-wan \
out-interface=ether1-guest
add chain=forward connection-state=established,related in-interface=ether10-wan out-interface=\
ether5-db
add chain=forward connection-state=established,related in-interface=ether10-wan out-interface=\
bridge2-file
add action=accept chain=forward connection-state=invalid,established,related,new,untracked \
in-interface=ether10-wan out-interface=ether9-adm
add chain=forward connection-state=established,related in-interface=ether10-wan out-interface=\
bridge1-pro
add action=accept chain=input comment="INPUT INTERNET" protocol=icmp
add action=accept chain=input connection-state=new dst-port=80,8291,22 in-interface=ether1-guest \
protocol=tcp src-address=192.168.8.0/26
add chain=input connection-state=new dst-port=80,8291,22 in-interface=ether5-db protocol=tcp \
src-address=192.168.2.0/29
add chain=input connection-state=new dst-port=80,8291,22 in-interface=bridge2-file protocol=tcp \
src-address=192.168.3.0/29
add chain=input connection-state=new dst-port=80,8291,22 in-interface=ether9-adm protocol=tcp \
src-address=192.168.4.0/26
add chain=input connection-state=new dst-port=80,8291,22 in-interface=bridge1-pro protocol=tcp \
src-address=192.168.5.0/26
add chain=input connection-mark=allow_in connection-state=new dst-port=80 in-interface=ether10-wan \
protocol=tcp
add chain=input connection-state=new dst-port=53,123 protocol=udp src-address=192.168.8.0/26
add chain=input connection-state=new dst-port=53,123 protocol=udp src-address=192.168.2.0/29
add chain=input connection-state=new dst-port=53,123 protocol=udp src-address=192.168.3.0/29
add chain=input connection-state=new dst-port=53,123 protocol=udp src-address=192.168.4.0/26
add chain=input connection-state=new dst-port=53,123 protocol=udp src-address=192.168.5.0/26
add chain=input connection-state=established,related
add chain=output connection-state=!invalid
add action=accept chain=forward comment="WEB CLI TO ACCESS POINT" dst-address=192.168.4.0/26 \
in-interface=bridge2-file out-interface=ether9-adm protocol=tcp src-address=192.168.3.0/29 \
src-port=80,445,8080
add action=accept chain=forward dst-address=192.168.3.0/29 dst-port=80,445,8080 in-interface=\
ether9-adm out-interface=bridge2-file protocol=tcp src-address=192.168.4.0/26 src-port=""
add action=drop chain=input comment=DROP disabled=yes
add action=drop chain=output disabled=yes
add action=drop chain=forward disabled=yes
/ip firewall mangle
add action=mark-connection chain=prerouting connection-state=new dst-port=9999 new-connection-mark=\
allow_in protocol=tcp
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether10-wan src-address=192.168.8.0/26
add action=masquerade chain=srcnat out-interface=ether10-wan src-address=192.168.2.0/29
add action=masquerade chain=srcnat out-interface=ether10-wan src-address=192.168.3.0/29
add action=masquerade chain=srcnat out-interface=ether10-wan src-address=192.168.4.0/26
add action=masquerade chain=srcnat out-interface=ether10-wan src-address=192.168.5.0/26
add action=redirect chain=dstnat dst-port=9999 protocol=tcp to-ports=80
/ip route
add comment="default route" distance=1 gateway=192.168.1.97
