Zabezpečení RB

[rubaspavel]

Zdravím,

jak řešíte zabezpeční RB, kdy je použit jako NAT pro klienta z venčí internetu? Na RB dělám překlad ze sítě 192.168.143.0 na 192.168.1.0. Síť 143 je ještě předtím přeložena na veřejnou IP. Potřebuji tedy v RBčku nastavit FW pro vstupní rozhraní - internet. Používám směrování portů, cca 15 pravidel, vše na jednu IP (192.168.1.6). Mam dva nápady jak to udělat
1: vytvořit pravidlo dstnat a vše směrovat na danou IP, jednotlivé porty povolit v řetěci forward
2: v řetězci forward propustit všechnu komunikaci a v dstnat nastavit jednotlivé porty

Je potřeba přidávat nějaká pravidla pro řetězce INPUT, OUTPUT pro větší bezpečnost?
Ve službách mám zapnutý pouze winbox a www na jiném portu.

[jarda.jezek]

Mikrotik bez pravidel pustí všechno. Takže paranoik by měl mít na každý chain generální drop a výjimky před ním. Osobně preferuji variantu 1.

[rubaspavel]

A můžeš sem hodit způsob jak to máš udělaný? Moje pravidlo pro www vypadá takto:

Kód: Vybrat vše

add chain=forward comment="Povolit WWW" dst-port=80 in-interface=ether1 out-interface=VLAN10 protocol=tcp

[jarda.jezek]

Tak třeba takhle:

Kód: Vybrat vše

add action=fasttrack-connection chain=forward comment="FastTrack Local" connection-state=established,related dst-address=192.168.0.0/16 src-address=192.168.0.0/16
add action=fasttrack-connection chain=forward comment="FastTrack uTorrent" connection-state=established,related dst-port=33333 protocol=udp
add action=fasttrack-connection chain=forward comment="FastTrack uTorrent" connection-state=established,related dst-port=33333 protocol=tcp
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related disabled=yes
add chain=forward comment="Established, Related" connection-state=established,related
add action=drop chain=forward comment=Invalid connection-state=invalid
add chain=forward comment="Forward local" connection-state=new dst-address=192.168.0.0/16 src-address=192.168.0.0/16
add chain=forward comment=Printer connection-state=new dst-port=80 log-prefix=Printer protocol=tcp
add chain=forward comment=Dude connection-state=new dst-port=88 protocol=tcp
add chain=forward comment=VNC connection-state=new dst-port=81 protocol=tcp
add chain=forward comment=uTorrent connection-state=new disabled=yes dst-port=33333 in-interface=ether1GW protocol=tcp
add chain=forward comment=uTorrent connection-state=new disabled=yes dst-port=33333 in-interface=ether1GW protocol=udp
add action=drop chain=forward comment="Drop All - WAN" connection-state=new in-interface=ether1GW log-prefix="DROP WAN"
add chain=forward comment="Od sousedu jen ven" connection-state=new in-interface=bridge2 out-interface=ether1GW
add action=drop chain=forward comment="Prunik od sousedu" connection-state=new in-interface=bridge2 log=yes log-prefix="Pokus o vnitrni prunik" out-interface=!ether1GW src-address-list=!vlastni
add chain=forward comment="Forward out" connection-state=new log-prefix=Leak out-interface=ether1GW
add chain=forward comment="Tunels out" connection-state=new out-interface=all-ppp
add chain=forward comment="Tunels in" connection-state=new in-interface=all-ppp
add action=drop chain=forward comment=Leak log=yes log-prefix=Leak
add action=fasttrack-connection chain=input comment=FastTrack connection-state=established,related
add chain=input comment="Established, Related" connection-state=established,related
add action=drop chain=input comment=Invalid connection-state=invalid
add chain=input comment="File Sharing - LAN" connection-state=new dst-port=137-139,445 in-interface=!ether1GW protocol=udp
add chain=input comment=Ping connection-state=new protocol=icmp
add chain=input comment="Web Interface" connection-state=new dst-port=80 protocol=tcp
add action=tarpit chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1GW protocol=tcp
add action=drop chain=input comment="DNS from WAN" dst-port=53 in-interface=ether1GW protocol=udp
add chain=input comment=Winbox connection-state=new dst-port=8291 protocol=tcp
add chain=input comment="ping before android box" connection-state=new disabled=yes dst-port=7 protocol=tcp
add chain=input comment=API connection-state=new dst-port=8728,8729 in-interface=!ether1GW protocol=tcp
add chain=input comment=SNMP connection-state=new dst-port=161-162 in-interface=!ether1GW protocol=udp
add chain=input comment="SSTP server" connection-state=new dst-port=444 protocol=tcp
add chain=input comment="SSL Web Access" connection-state=new dst-port=443 protocol=tcp
add chain=input comment="L2TP server" connection-state=new dst-port=1701,500,4500 protocol=udp
add chain=input comment="L2TP server" connection-state=new protocol=ipsec-esp
add chain=input comment="File Sharing - LAN" connection-state=new dst-port=137-139,445 in-interface=!ether1GW protocol=tcp
add action=drop chain=input comment="Drop All - WAN" in-interface=ether1GW
add chain=input comment="All from LAN" in-interface=!ether1GW
add action=drop chain=input comment=Leak log=yes log-prefix=Leak
add action=fasttrack-connection chain=output comment=FastTrack connection-state=established,related
add chain=output comment="Established, Related" connection-state=established,related
add action=drop chain=output comment=Invalid connection-state=invalid
add chain=output comment="Output local" connection-state=new out-interface=!ether1GW
add chain=output comment="DNS, Time, DHCP" connection-state=new dst-port=53,123,67,68 out-interface=ether1GW protocol=udp
add chain=output comment=DnsExit dst-address-list=DnsExit
add chain=output comment="ICMP ECHO" protocol=icmp
add action=drop chain=output comment=Leak log=yes log-prefix=Leak


Ale jinde to je zase jinak, záleží jak kde a proč...