Stránka 1 z 1
Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 23 Aug 2013 19:48
od rado3105
Mam takto povolene porty na inpute vo filteri:
Kód: Vybrat vše
22 ;;; tcp ports
chain=input action=accept protocol=tcp in-interface=ether1
dst-port=22,25,53,1723,2000,7780,8291
23 ;;; udp ports
chain=input action=accept protocol=udp in-interface=ether1 dst-port=53
24 ;;; drop everything else
chain=input action=drop in-interface=ether1(kde 53 udp, tcp je dns), pricom na niektorych pc ktore maju tento mikrotik ako primarny dns(funguje ako dns resolver) nefunguje dns....ether1 je internet...
Neviem ci tam chyba nejaky iny port alebo preco to nejde? dik
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 23 Aug 2013 20:18
od midnight_man
rado ak ti to na niektorych PC ide tak tu problem nehladaj.
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 23 Aug 2013 20:32
od rado3105
vypnem drop a rozbehne sa to....takze je to v tom....
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 24 Aug 2013 17:37
od Rudolf Dvořák
Mozna je to blby napad, ale co treba si pridat pred drop pravidlo pro :log, kde bude source ip ta ze ktere to nejde a kouknout do logu?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 25 Aug 2013 09:02
od Dalibor Toman
rado3105 píše:Mam takto povolene porty na inpute vo filteri:
Kód: Vybrat vše
22 ;;; tcp ports
chain=input action=accept protocol=tcp in-interface=ether1
dst-port=22,25,53,1723,2000,7780,8291
23 ;;; udp ports
chain=input action=accept protocol=udp in-interface=ether1 dst-port=53
24 ;;; drop everything else
chain=input action=drop in-interface=ether1(kde 53 udp, tcp je dns), pricom na niektorych pc ktore maju tento mikrotik ako primarny dns(funguje ako dns resolver) nefunguje dns....ether1 je internet...
Neviem ci tam chyba nejaky iny port alebo preco to nejde? dik
Mozna by problem by mohl byt v tom, ze DNS resolver na MT (nepouzivam ho tak nevim jak se chova) nemusi odesilat requesty z portu 53 (pak by to ale zlobilo vsem klientum). Pak by se mozna dal prekonfigurovat nebo by se muselo pouzit nejake pravidlo svazane s conntrackem (povolit established apod)
Jak uz psal nekdo jde to zalogovat - pripadne odchytat snifferem (doporucuju snifgovat do filu a vysledek si prohlednout na PC wiresharkem - zobrazovani packetu na MT je dost posahane)
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 26 Aug 2013 08:50
od Surface_cz
Klienti nejsou na eth1 ne? Proč tedy definovat in-inferface=eth1?
Zkus nedefinovat in-interface a uvidíš že to bude fungovat.
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 26 Aug 2013 21:39
od rado3105
Surface_cz píše:Klienti nejsou na eth1 ne? Proč tedy definovat in-inferface=eth1?
Zkus nedefinovat in-interface a uvidíš že to bude fungovat.
zaujimavy ostreh ale je to asi jedno kedze dropujem len to co ide na eth1....cize z internetu na router - tym mam poistene ze to neovplyvnuje nic z lokalnej casti(ktora je na eth2)....alebo?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:10
od Surface_cz
Pravda, má nepozornost. Jak píše Dalibor, souvisí to s conntrackem.
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:17
od rado3105
Dalibor Toman píše:rado3105 píše:Mam takto povolene porty na inpute vo filteri:
Kód: Vybrat vše
22 ;;; tcp ports
chain=input action=accept protocol=tcp in-interface=ether1
dst-port=22,25,53,1723,2000,7780,8291
23 ;;; udp ports
chain=input action=accept protocol=udp in-interface=ether1 dst-port=53
24 ;;; drop everything else
chain=input action=drop in-interface=ether1(kde 53 udp, tcp je dns), pricom na niektorych pc ktore maju tento mikrotik ako primarny dns(funguje ako dns resolver) nefunguje dns....ether1 je internet...
Neviem ci tam chyba nejaky iny port alebo preco to nejde? dik
Mozna by problem by mohl byt v tom, ze DNS resolver na MT (nepouzivam ho tak nevim jak se chova) nemusi odesilat requesty z portu 53 (pak by to ale zlobilo vsem klientum). Pak by se mozna dal prekonfigurovat nebo by se muselo pouzit nejake pravidlo svazane s conntrackem (povolit established apod)
Jak uz psal nekdo jde to zalogovat - pripadne odchytat snifferem (doporucuju snifgovat do filu a vysledek si prohlednout na PC wiresharkem - zobrazovani packetu na MT je dost posahane)
robi to len na niektorych PC, aj sa to snazim odchytat z ip ktorych to nejde...len tie neodchytia nic:
Kód: Vybrat vše
0 chain=input action=log src-address=10.13.150.0/28 in-interface=ether1
log-prefix="Filter:"
1 chain=input action=log src-address=10.13.150.0/28 log-prefix="Filter:"
2 chain=input action=log src-address=10.13.150.16/28 in-interface=ether1
log-prefix="Filter:"
3 chain=input action=log src-address=10.13.150.16/28 log-prefix="Filter:"
4 chain=input action=log dst-address=10.13.150.0/28 in-interface=ether1
log-prefix="Filter:"
5 chain=input action=log dst-address=10.13.150.0/28 log-prefix="Filter:"
6 chain=input action=log dst-address=10.13.150.16/28 in-interface=ether1
log-prefix="Filter:"
7 chain=input action=log dst-address=10.13.150.16/28 log-prefix="Filter:" cize mozno to je zalezitost komunikacie mikrotikov medzi sebou...
s tymi connection estabilished to ako myslite?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:25
od Surface_cz
Nejříve vkládám hezký popis funkce conntracku:
Connection Tracking (or Conntrack) system is the heart of firewall, it gathers and manages information about all active connections. By disabling the conntrack system you will lose functionality of the NAT and most of the filter and mangle conditions. Each conntrack table entry represents bidirectional data exchange Conntrack takes a lot of CPU resources (disable it, if you don't use firewall)
Z toho je patrné, že pokud se nepovolí connection state established, nebude dns fungovat.
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:28
od Surface_cz
Opravdu nemají PC na kterých to funguje nastavený jiný DNS server?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:32
od rado3105
Ked tak nad tym rozmyslam tak estabilished, related a drop invalid by mali byt na vrchole inputoveho retazca, pod nim povolene sluzby, porty a nakonieco dropovat vsetko...nemylim sa?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 27 Aug 2013 11:43
od Surface_cz
Já definuji pouze established=accept, a invalid=drop.
Bylo mi to takto ukázáno na modelovém firewallu na školení v i4wifi. Stejný systém je uveden například na mikrotik wiki.
Ano měly by být na vrcholu.
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 28 Aug 2013 09:30
od Majklik
Jestli-že je ether1 internet/uplink a je dostupý zvenčí (má veřejnou IP), tak to pravidlo:
22 ;;; tcp ports
chain=input action=accept protocol=tcp in-interface=ether1
dst-port=22,25,53,1723,2000,7780,8291
23 ;;; udp ports
chain=input action=accept protocol=udp in-interface=ether1 dst-port=53
dosáhne toho, že se z toho routeru časem stane součást nějaké DDoS DNS sítě.
Proč by měl mít ten router povoleno odpovídat na dotazy přicházející z internetu?
Re: Ake porty treba povlit na inpute ROS aby fungoval DNS?
Napsal: 28 Aug 2013 19:40
od rado3105
Majklik píše:Jestli-že je ether1 internet/uplink a je dostupý zvenčí (má veřejnou IP), tak to pravidlo:
22 ;;; tcp ports
chain=input action=accept protocol=tcp in-interface=ether1
dst-port=22,25,53,1723,2000,7780,8291
23 ;;; udp ports
chain=input action=accept protocol=udp in-interface=ether1 dst-port=53
dosáhne toho, že se z toho routeru časem stane součást nějaké DDoS DNS sítě.
Proč by měl mít ten router povoleno odpovídat na dotazy přicházející z internetu?
Uz som nevedel preco mi to nejde...tak som to aj tak povolil....
Po novom to vyzera takto a vyzera ze za vsetkym bolo nepovolenie estabilished connections:
Kód: Vybrat vše
0 ;;; Drop invalid connections
chain=input action=drop connection-state=invalid
1 ;;; Port scanners to list
chain=input action=add-src-to-address-list protocol=tcp psd=21,3s,3,1
address-list=port scanners address-list-timeout=2w
2 ;;; NMAP FIN Stealth scan
chain=input action=add-src-to-address-list
tcp-flags=fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w
3 ;;; SYN/FIN scan
chain=input action=add-src-to-address-list tcp-flags=fin,syn protocol=tcp
address-list=port scanners address-list-timeout=2w
4 ;;; SYN/RST scan
chain=input action=add-src-to-address-list tcp-flags=syn,rst protocol=tcp
address-list=port scanners address-list-timeout=2w
5 ;;; FIN/PSH/URG scan
chain=input action=add-src-to-address-list
tcp-flags=fin,psh,urg,!syn,!rst,!ack pr address-list=port scanners address-list-timeout=2w
6 ;;; ALL/ALL scan
chain=input action=add-src-to-address-list
tcp-flags=fin,syn,rst,psh,ack,urg protocol=tcp address-list=port scanners
address-list-timeout=2w
7 ;;; NMAP NULL scan
chain=input action=add-src-to-address-list
tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg protocol=tcp
address-list=port scanners address-list-timeout=2w
8 ;;; dropping port scanners
chain=input action=drop src-address-list=port scanners
9 ;;; suppress DoS attack
chain=input action=tarpit protocol=tcp src-address-list=black_list
connection-limit=3,32
10 ;;; detect DoS attack(10 connections/ip from internet)
chain=input action=add-src-to-address-list protocol=tcp
address-list=black_list address-list-timeout=1d in-interface=ether1
connection-limit=10,32
11 ;;; DOS attack protection(50 connections/ip)
chain=input action=add-src-to-address-list protocol=tcp
address-list=black_list address-list-timeout=1d connection-limit=50,32
12 ;;; drop ssh brute forcers
chain=input action=drop protocol=tcp src-address-list=ssh_blacklist
dst-port=22
13 chain=input action=add-src-to-address-list connection-state=new protocol=tc>
src-address-list=ssh_stage3 address-list=ssh_blacklist
address-list-timeout=1w3d dst-port=22
14 chain=input action=add-src-to-address-list connection-state=new protocol=tc>
src-address-list=ssh_stage2 address-list=ssh_stage3
address-list-timeout=1m dst-port=22
15 chain=input action=add-src-to-address-list connection-state=new protocol=tc>
src-address-list=ssh_stage1 address-list=ssh_stage2
address-list-timeout=1m dst-port=22
16 chain=input action=add-src-to-address-list connection-state=new protocol=tc>
address-list=ssh_stage1 address-list-timeout=1m dst-port=22
17 ;;; drop ssh brute downstream
chain=forward action=drop protocol=tcp src-address-list=ssh_blacklist
dst-port=22
18 ;;; Allow Broadcast Traffic
chain=input action=accept dst-address-type=broadcast
19 ;;; smtp(e-mail)
chain=input action=accept protocol=tcp src-port=25
20 ;;; vpn(gre)
chain=input action=accept protocol=gre
21 ;;; ping
chain=input action=accept protocol=icmp
22 ;;; tcp ports
chain=input action=accept protocol=tcp dst-port=22,25,1723,2000,7780,8291
23 ;;; allow estabilished connections
chain=input action=accept connection-state=established
24 ;;; drop everything else
chain=input action=drop in-interface=ether1