Jump to content

dexter

Forum Members
 View Profile  See their activity

  • Posts

    937

  • Joined

  • Last visited

  • Days Won

    3

 Content Type 

Posts posted by dexter

    Управление vlan`ами в веб интерфейсе

    in 2.15

    Posted

    @AndreyUA, ниже конфиг.

    Скрытый текст

    ! $$$ Model: ZyXEL Keenetic Ultra II
    ! $$$ Version: 2.06.1
    ! $$$ Agent: cli
    ! $$$ Last change: Sat, 15 Dec 2018 12:18:57 GMT
    ! $$$ Md5 checksum: 12d34a3be088ff10228e04e83a5cd86c

    system
        set net.ipv4.ip_forward 1
        set net.ipv4.tcp_fin_timeout 30
        set net.ipv4.tcp_keepalive_time 120
        set net.ipv4.neigh.default.gc_thresh1 256
        set net.ipv4.neigh.default.gc_thresh2 1024
        set net.ipv4.neigh.default.gc_thresh3 2048
        set net.ipv6.neigh.default.gc_thresh1 256
        set net.ipv6.neigh.default.gc_thresh2 1024
        set net.ipv6.neigh.default.gc_thresh3 2048
        set net.netfilter.nf_conntrack_tcp_timeout_established 1200
        set net.netfilter.nf_conntrack_max 16384
        set vm.swappiness 60
        set vm.overcommit_memory 0
        set vm.vfs_cache_pressure 1000
        set dev.usb.force_usb2 0
        set net.core.eoip_allow_fragment 1
        clock timezone Europe/Moscow
        domainname WORKGROUP
        hostname border
        log server 192.168.101.1
    !
    ntp server 0.pool.ntp.org
    ntp server 1.pool.ntp.org
    ntp server 2.pool.ntp.org
    ntp server 3.pool.ntp.org
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    known host 
    access-list _WEBADMIN_OTS
    ! 
    user admin
        password 
        password
        tag cli
        tag http
        tag cifs
        tag printers
        tag opt
        tag ftp
    !
    interface GigabitEthernet0
        up
    !
    interface GigabitEthernet0/0
        rename 1
        description Tag-Vlan
        switchport mode access
        switchport mode trunk
        switchport access vlan 101
        switchport trunk vlan 102
        switchport trunk vlan 103
        up
    !
    interface GigabitEthernet0/1
        rename 2
        description Vlan-101
        switchport mode access
        switchport access vlan 102
        up
    !
    interface GigabitEthernet0/2
        rename 3
        description Vlan-102
        switchport mode access
        switchport access vlan 103
        up
    !
    interface GigabitEthernet0/3
        rename 4
        description nas
        switchport mode access
        switchport access vlan 100
        up
    !
    interface GigabitEthernet0/4
        rename 5
        description admin-pc
        switchport mode access
        switchport access vlan 100
        up
    !
    interface GigabitEthernet0/5
        rename 6
        switchport mode access
        switchport access vlan 253
        up
    !
    interface GigabitEthernet0/6
        rename 7
        description mag
        switchport mode trunk
        switchport trunk vlan 102
        switchport trunk vlan 103
        switchport trunk vlan 101
        switchport trunk vlan 100
        switchport trunk vlan 104
        up
    !
    interface GigabitEthernet0/Vlan3
        description "Guest VLAN"
        security-level public
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface GigabitEthernet0/Vlan100
        rename Vlan100-Home
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface GigabitEthernet0/Vlan101
        rename Vlan101
        description Vlan-101
        mac address 58:8b:f3:66:a1:11
        security-level private
        ip address 192.168.101.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface GigabitEthernet0/Vlan104
        rename Vlan104-MCAST
        description Vlan-104
        mac address 58:8b:f3:66:a1:14
        security-level private
        ip address 192.168.104.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        igmp downstream
        up
    !
    interface GigabitEthernet0/Vlan253
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ip tcp adjust-mss 1300
        up
    !
    interface GigabitEthernet1
        rename OTS
        description Internet
        mac address factory wan
        security-level public
        ip address dhcp
        ip dhcp client no dns-routes
        ip dhcp client no name-servers
        ip access-group _WEBADMIN_OTS in
        ip global 700
        igmp upstream
        up
    !
    interface GigabitEthernet1/0
        rename 0
        up
    !
    interface WifiMaster0
        country-code RU
        compatibility BGN
        channel width 40-below
        power 75
        up
    !
    interface WifiMaster0/AccessPoint0
        rename AccessPoint
        description "Wi-Fi access point"
        mac access-list type deny
        mac access-list address 
        mac access-list address 
        security-level private
        authentication wpa-psk ns3 
        encryption enable
        encryption wpa2
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ssid 
        wmm
        up
    !
    interface WifiMaster0/AccessPoint1
        rename GuestWiFi
        description "Guest access point"
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ssid Guest
        wmm
        down
    !
    interface WifiMaster0/AccessPoint2
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        down
    !
    interface WifiMaster0/AccessPoint3
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        down
    !
    interface WifiMaster0/WifiStation0
        security-level public
        wps
        encryption disable
        ip address dhcp
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface WifiMaster1
        country-code RU
        compatibility AN+AC
        channel width 40-below/80
        power 75
        band-steering
        up
    !
    interface WifiMaster1/AccessPoint0
        rename AccessPoint_5G
        description "5Ghz Wi-Fi access point"
        mac access-list type deny
        mac access-list address 
        mac access-list address 
        security-level private
        authentication wpa-psk ns3 
        encryption enable
        encryption wpa2
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ssid 
        wmm
        up
    !
    interface WifiMaster1/AccessPoint1
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        down
    !
    interface WifiMaster1/AccessPoint2
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        down
    !
    interface WifiMaster1/AccessPoint3
        mac access-list type none
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        down
    !
    interface WifiMaster1/WifiStation0
        security-level public
        wps
        encryption disable
        ip address dhcp
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface Bridge0
        rename Home
        inherit Vlan100-Home
        include AccessPoint
        include AccessPoint_5G
        mac access-list type deny
        mac access-list address 
        mac access-list address
        security-level private
        ip address 192.168.100.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface Bridge1
        rename Guest
        description "Guest VLAN"
        inherit GigabitEthernet0/Vlan3
        include GuestWiFi
        mac access-list type deny
        mac access-list address 
        mac access-list address 
        security-level protected
        ip address 192.168.99.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        up
    !
    interface EoIP0
        mac address 0e:5b:ac:fd:d2:4b
        security-level private
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ip mtu 1100
        ip tcp adjust-mss 1000
        tunnel destination 192.168.254.253
        tunnel eoip id 1500
        up
    !
    interface Bridge2
        rename L2-Vlan253
        inherit GigabitEthernet0/Vlan253
        include EoIP0
        mac access-list type none
        security-level private
        ip address 192.168.253.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ip tcp adjust-mss 1200
        up
    !
    interface IPIP0
        security-level private
        ip address 192.168.254.254 255.255.255.0
        ip dhcp client dns-routes
        ip dhcp client name-servers
        ip mtu 1300
        ip global 100
        ip tcp adjust-mss 1200
        ipsec preshared-key ns3 
        ipsec ikev2
        tunnel source auto
        up
    !
    ip route 192.168.5.0 255.255.255.0 192.168.101.1 Vlan101 auto
    ip route 192.168.102.0 255.255.255.0 192.168.101.1 Vlan101 auto
    ip route 192.168.6.0 255.255.255.0 192.168.101.1 Vlan101 auto
    ip route 192.168.103.0 255.255.255.0 192.168.101.1 Vlan101 auto
    ip route 192.168.31.0 255.255.255.0 192.168.254.253 IPIP0 auto
    ip route 192.168.32.0 255.255.255.0 192.168.254.253 IPIP0 auto
    ip route 192.168.30.0 255.255.255.0 192.168.254.253 IPIP0 auto
    ip route default 192.168.254.253 IPIP0
    ip dhcp pool _WEBADMIN
        enable
    !
    ip dhcp pool _WEBADMIN_GUEST_AP
        enable
    !
    ip dhcp relay lan Vlan104-MCAST
    ip dhcp relay lan Home
    ip dhcp relay wan Vlan101
    ip dhcp relay server 192.168.101.1
    ip name-server 192.168.100.254 ""
    ip name-server 192.168.101.1 ""
    ip policy bikovo
        permit global IPIP0
        no permit global OTS
    !
    ip policy dual-wan
        permit global IPIP0
        permit global OTS
        multipath
    !
    ip http security-level private
    ip http lockout-policy 5 15 3
    ip http ssl redirect
    ip static Vlan101 OTS
    ip static Vlan104-MCAST OTS
    ip static Guest OTS
    ip static tcp OTS 21 
    ip static tcp OTS 3389 
    ip static tcp OTS 6881 through 6889 
    ip static udp OTS 55000 through 55002 
    ip static tcp OTS 55000 through 55002 
    ip static tcp OTS 55536 through 56559 
    ip static Home OTS
    ip static tcp OTS 1194 
    ip static tcp OTS 53  53
    ip static udp OTS 53  53
    ip static tcp OTS 1723  1723
    ip telnet
        security-level private
        lockout-policy 5 15 3
    !
    ip ssh
        security-level private
        lockout-policy 5 15 3
    !
    ip ftp
        security-level private
        lockout-policy 4 15 3
    !
    ip hotspot
        policy Home permit
        policy Guest permit
        policy L2-Vlan253 permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        host  permit
        default-policy permit
    !
    ppe software
    ppe hardware
    crypto engine hardware
    crypto ipsec mtu auto
    igmp-proxy
        force igmp-v2
    !
    snmp contact
    snmp location room
    service dhcp
    service dns-proxy
    service igmp-proxy
    service dhcp-relay
    service http
    service cifs
    service telnet
    service ssh
    service ntp-client
    service upnp
    service ipsec
    service snmp
    cifs
        share OPKG OPKG:
        share test 91236d55-015a-4b91-9847-6d4504bb2699:
        automount
        permissive
    !
    opkg disk OPKG:/
    opkg initrc /opt/etc/init.d/rc.unslung
    opkg dns-override
    components
        auto-update disable
    !
    !
     

     

    Безопасное извлечение USB диска с отключением мотора привода.

    in Реализованные пожелания

    Posted

    Сейчас специально проверил внешний хард сигейт. Что роутер, что сетевое хранилище при "безопасном извлечения USB-диска", не останавливают блины и не отключают питание. При этом винда при "безопасном извлечения USB-диска" блины останавливает и отключает питание. Хард без дополнительного БП.

    Ultra 1 на 2.15.A.3.0-1 что-то сломали в ДНС

    in 2.15

    Posted

    Вот консольные выводы при nslookup

    Запрос с компа 192.168.100.10 cacti.ns.home 

    C:\Users\Admin>nslookup cacti.ns.home 192.168.30.254
╤хЁтхЁ:  UnKnown
Address:  192.168.30.254

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Превышено время ожидания запроса UnKnown

C:\Users\Admin>

    Консоль удаленного кинетика U1 

    ~ # tcpdump -i ipip0  port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ipip0, link-type RAW (Raw IP), capture size 262144 bytes
15:49:14.554113 IP 192.168.100.10.64963 > 192.168.30.254.domain: 10+ A? cacti.ns.home. (31)
15:49:14.557455 IP 192.168.254.253.49690 > 192.168.101.1.domain: 59217+ A? cacti.ns.home. (31)
15:49:14.692518 IP 192.168.254.253.49690 > 192.168.100.254.domain: 5044+ PTR? 10.100.168.192.in-addr.arpa. (45)
15:49:15.573274 IP 192.168.254.253.49690 > 192.168.100.254.domain: 8344+ PTR? 254.30.168.192.in-addr.arpa. (45)
15:49:16.558613 IP 192.168.100.10.64964 > 192.168.30.254.domain: 11+ AAAA? cacti.ns.home. (31)
15:49:16.559241 IP 192.168.254.253.49690 > 192.168.101.1.domain: 36480+ AAAA? cacti.ns.home. (31)
15:49:16.609117 IP 192.168.254.253.49690 > 192.168.100.254.domain: 4309+ PTR? 253.254.168.192.in-addr.arpa. (46)
15:49:17.578655 IP 192.168.254.253.49690 > 192.168.100.254.domain: 35506+ PTR? 1.101.168.192.in-addr.arpa. (44)
15:49:18.565235 IP 192.168.254.253.49690 > 192.168.100.254.domain: 61282+ PTR? 254.100.168.192.in-addr.arpa. (46)
15:49:18.569527 IP 192.168.100.10.64965 > 192.168.30.254.domain: 12+ A? cacti.ns.home. (31)
15:49:19.274013 IP 192.168.254.253.49690 > 192.168.100.254.domain: 21688+ A? nic.ru. (24)
15:49:20.581778 IP 192.168.100.10.64967 > 192.168.30.254.domain: 13+ AAAA? cacti.ns.home. (31)
15:49:20.582463 IP 192.168.254.253.49690 > 192.168.101.1.domain: 43039+ AAAA? cacti.ns.home. (31)
15:49:24.939656 IP 192.168.30.254.domain > 192.168.100.10.64964: 11 Refused 0/0/0 (31)
15:49:24.941136 IP 192.168.30.254.domain > 192.168.100.10.64963: 10 Refused 0/0/0 (31)
15:49:29.274507 IP 192.168.254.253.49690 > 192.168.100.254.domain: 38550+ A? nic.ru. (24)
15:49:29.779547 IP 192.168.30.254.domain > 192.168.100.10.64967: 13 Refused 0/0/0 (31)
15:49:29.779848 IP 192.168.30.254.domain > 192.168.100.10.64965: 12 Refused 0/0/0 (31)
^C
18 packets captured
20 packets received by filter
1 packet dropped by kernel
~ #

    И лог с сервера  

    root@ns:~# tcpdump -i eth0.101 -n host 192.168.254.253 and port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0.101, link-type EN10MB (Ethernet), capture size 262144 bytes
15:53:27.806621 IP 192.168.254.253.49690 > 192.168.101.1.53: 43970+ A? cacti.ns.home. (31)
15:53:27.807113 IP 192.168.101.1.53 > 192.168.254.253.49690: 43970* 4/3/4 CNAME ns.home., A 192.168.102.254, A 192.168.101.1, A 192.168.103.254 (219)
15:53:29.811303 IP 192.168.254.253.49690 > 192.168.101.1.53: 2450+ AAAA? cacti.ns.home. (31)
15:53:29.811728 IP 192.168.101.1.53 > 192.168.254.253.49690: 2450* 1/1/0 CNAME ns.home. (96)
15:53:31.813189 IP 192.168.254.253.49690 > 192.168.101.1.53: 24725+ A? cacti.ns.home. (31)
15:53:31.813640 IP 192.168.101.1.53 > 192.168.254.253.49690: 24725* 4/3/4 CNAME ns.home., A 192.168.103.254, A 192.168.101.1, A 192.168.102.254 (219)
15:53:33.819068 IP 192.168.254.253.49690 > 192.168.101.1.53: 53186+ AAAA? cacti.ns.home. (31)
15:53:33.819448 IP 192.168.101.1.53 > 192.168.254.253.49690: 53186* 1/1/0 CNAME ns.home. (96)
^C
8 packets captured
9 packets received by filter
0 packets dropped by kernel
root@ns:~#

    По IP:

    192.168.100.10 - комп с которого спрашиваем.

    192.168.30.254 - IP сегмента home на удаленном U1.

    192.168.254.253 - IP адрес интерфейса IPIP на уделенной U1.

    192.168.101.1 - адрес DNS сервера. На нем же и крутится cacti.ns.home. Который прописан алиасом к ns.home.

    Судя по дампу с сервера, кинетик обращается верно и сервер ему все отдал, а вот дальше происходит затык.

    Ultra 1 на 2.15.A.3.0-1 что-то сломали в ДНС

    in 2.15

    Posted

    Есть у меня доменная зона home. На уделенном кинетике на вкладке "интернет фильтр" прописано "192.168.101.1 home".

    В итоге, точно на 2.15.A.3.0-1 кинетик перестал резолвить эту зону хотя запись присутствует и с днс сервером связь есть. 

    Ниже постом будет селф-тест.

    Настройка IPsec для NDMS

    in Обсуждение IPsec, OpenVPN и других туннелей

    Posted

    Что-то я уже всю голову сломал. Может так нельзя, но.

    Есть у меня 2 кинетика и между ними 2 туннеля. IPIP c IPsec и внутри него EoIP.

    Сегодня настроил IPSec между данными кинетика из вэб в режиме туннель и заменил в EoIP "tunnel destination" адреса с IPIP туннеля на адреса которые у IPSec. Но туннель по все видимости не поднимается, т.к. с кинетиков не пингуются удаленные бридж интерфейсы, в который входит данный туннель.

    Постом ниже будут 2 селф-теста для понимания картины.

×
×
  • Create New...