FTP forward

jval

Zdravím je možné nějak nastavit forward na FTP tak aby to fugovalo jak z internetu, tak z local sítě?

Mám nastaven forward:4 ;;; Synology - FTP

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=20-21

protocol=tcp dst-address=90.183.250.70 dst-port=20-21

Z netu ok, ale když se chci na ftp připojit z local sítě tak to nejede.

Jde mi o to abych mohl mít ve FTP klientovi jen jedno spojení směrované na tu veřejku 90.182.250.70

Díky

mazzalo

http://wiki.mikrotik.com/wiki/Hairpin_NAT

jval

Tak jsem to zkusil nastavit a stejně mi to nefunguje. Konfiguraci mám takto:

0 ;;; Synology - Webgui

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=5000-5001 protocol=tcp in-interface=ether10 - WAN dst-port=5000-5001

1 ;;; Synology - Pyload

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=7227 protocol=tcp in-interface=ether10 - WAN dst-port=8000

2 ;;; Synology - Pyload

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=7227 protocol=tcp in-interface=ether10 - WAN dst-port=7227

3 ;;; Synology - Cloud

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=6690 protocol=tcp in-interface=ether10 - WAN dst-port=6690

4 ;;; Synology - FTP

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=20-21 protocol=tcp dst-address=90.183.250.70 dst-port=20-21

5 X ;;; Synology - SSH

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=22 protocol=tcp in-interface=ether10 - WAN dst-port=22

6 ;;; default configuration

chain=srcnat action=masquerade out-interface=ether10 - WAN

7 chain=srcnat action=masquerade protocol=tcp src-address=192.168.1.0/24 dst-address=90.183.250.70 out-interface=ether10 - WAN

a Firewall takto:

0 chain=forward action=accept protocol=icmp in-interface=ether10 - WAN

1 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=80

2 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=443

3 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=21-22

4 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=5000-5001

5 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=8000

6 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=7227

7 chain=forward action=accept protocol=tcp in-interface=ether10 - WAN dst-port=6690

8 chain=forward action=accept connection-state=established in-interface=ether10 - WAN

9 chain=forward action=accept connection-state=related in-interface=ether10 - WAN

10 chain=forward action=accept out-interface=ether10 - WAN

11 chain=forward action=drop in-interface=ether10 - WAN

12 ;;; WLAN - hosts

chain=forward action=reject reject-with=icmp-network-unreachable src-address=192.168.2.0/24 dst-address=192.168.1.0/24

out-interface=!ether10 - WAN

mazzalo

Nikde tam nevidim pravidlo, ktere je popsane v odkazu, melo by to vypadat takto:

/ip firewall nat

add chain=srcnat src-address=192.168.1.0/24 \

dst-address=192.168.1.2 protocol=tcp dst-port=20-21 \

out-interface=LAN action=masquerade

Jen nahrad misto LAN out interface za jmeno tveho.

Kdyz mas natovane nektere porty nemusis je uz psat do FW povoli se automaticky.

jval

0 ;;; Synology - Webgui

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=5000-5001 protocol=tcp in-interface=ether10 - WAN dst-port=5000-5001

1 ;;; Synology - Pyload

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=7227 protocol=tcp in-interface=ether10 - WAN dst-port=8000

2 ;;; Synology - Pyload

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=7227 protocol=tcp in-interface=ether10 - WAN dst-port=7227

3 ;;; Synology - Cloud

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=6690 protocol=tcp in-interface=ether10 - WAN dst-port=6690

4 ;;; Synology - FTP

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=20-21 protocol=tcp dst-address=90.183.250.70 dst-port=20-21

5 X ;;; Synology - SSH

chain=dstnat action=dst-nat to-addresses=192.168.1.2 to-ports=22 protocol=tcp in-interface=ether10 - WAN dst-port=22

6 ;;; default configuration

chain=srcnat action=masquerade out-interface=ether10 - WAN

7 chain=srcnat action=masquerade protocol=tcp src-address=192.168.1.0/24 dst-address=192.168.1.2 out-interface=ether10 - WAN dst-port=20-21

Ale stejně nefunguje připojení na FTP z vnitřní sítě.

To nastavení firewallu jsem vyčetl zde na fóru. Styl vše z venku zakázat a povolit jen to co potřebuji se mi líbil, tak jsem to tak nastavil.

mazzalo

Mas tam asi porad chybu, davas tam wan interface ma tam byt lokalni LAN interface.

jval

Acháá, já jsem tam dával WAN podle toho prvního příkladu a nevšiml jsem si, že v druhém je LAN. Dal jsem tedy bridge-local a už to vrčí.

Děkuji za pomoc.