Witam,
znajomy poprosił mnie o rzucenie okiem na jego internet... problem z miktorikiem rb941.
na porcie eth4 występuje błąd: interface,warning ether4 received loop protect pack
et originated from Dc:XX:B7 (ether4)
inne urządzenia zarządzane przez capsman.
z tego co widzę urządzenie na porcie eth4 komunikuje się z innymi urządzeniami, ale odnajduje tam też swoje pakiety, pętla zostaje wykryta i port pada.. nie wiem czemu mikrotiki nie chcą przyjąć ip z serwera dhcp.
adres Dc:XX:B7 to dokładnie port eht4.
co robić?!
# software id = 6,49,7
#
# model = RB941-2nD
# serial number = FDFDFDFDFDFDFD
/caps-man channel
add band=2ghz-g/n control-channel-width=20mhz frequency=2412,2437,2462 name=\
3kanaly1_6_11
add band=2ghz-b/g/n frequency=2412 name=channel1
add band=2ghz-b/g/n frequency=2437 name=channel6
add band=2ghz-b/g/n frequency=2462 name=channel11
/interface bridge
add admin-mac=6C:3B:XX:XX:2A:97 auto-mac=no name=bridgeADMIN
add mtu=1500 name=bridgeKLIENT
/interface wireless
# managed by CAPsMAN
set [ find default-name=wlan1 ] band=2ghz-b/g/n mode=ap-bridge ssid=MikroTikA
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=WAN \
name=ether1-WAN
set [ find default-name=ether2 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full loop-protect=\
on
set [ find default-name=ether3 ] comment="Siec klient"
# 2023.03.28-12:29:19: received loop protect packet originated from Dc:XX:B7 (ether4)
set [ find default-name=ether4 ] loop-protect=on
/caps-man datapath
add bridge=bridgeADMIN client-to-client-forwarding=yes local-forwarding=yes \
name=datapath1aadm
add bridge=bridgeKLIENT client-to-client-forwarding=yes name="datapath2 kli"
/caps-man configuration
add channel=channel11 channel.band=2ghz-b/g/n channel.control-channel-width=\
20mhz country=poland datapath="datapath2 kli" \
datapath.client-to-client-forwarding=no datapath.local-forwarding=no \
name=cfg2GOPOGO rates.basic=1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps \
rates.supported=1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps,12Mbps \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.passphrase=DOLCE123 ssid=GOPOGO
/caps-man security
add authentication-types=wpa2-psk name="sec adm" passphrase=789467894657xx
add authentication-types=wpa2-psk name="sec GOPOGO" passphrase=DOLCE123
/caps-man configuration
add channel=3kanaly1_6_11 channel.band=2ghz-b/g/n \
channel.control-channel-width=20mhz country=poland datapath=datapath1aadm \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=no \
name=cfg2admin rates.basic="1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps,12Mbps,\
18Mbps,24Mbps,36Mbps,48Mbps,54Mbps" rates.supported="1Mbps,2Mbps,5.5Mbps,1\
1Mbps,6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps" rx-chains="" \
security="sec adm" ssid=DOLCE tx-chains=""
add channel.band=5ghz-n/ac channel.control-channel-width=20mhz \
channel.extension-channel=XXXX country=poland \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \
name=cfg-5ghz-ac security="sec adm" ssid=""
add channel.band=5ghz-onlyn channel.control-channel-width=20mhz \
channel.extension-channel=XX country=poland \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \
name=cfg-5ghz-an security="sec adm" ssid=""
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server
add authoritative=after-2sec-delay interface=ether1-WAN name=server3
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=aes-256,aes-128,3des name=profile_1
/ip ipsec peer
add disabled=yes name=peer1 passive=yes profile=profile_1
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=\
aes-256-cbc,aes-128-cbc lifetime=0s pfs-group=none
/ip pool
add name=pool1-ADMIN ranges=192.168.1.50-192.168.1.150
add name=pool2-KLIENT ranges=192.168.2.50-192.168.2.199
add name=pool3_VPN ranges=10.10.10.10-10.10.10.200
add name=dhcp ranges=192.168.1.50-192.168.1.150
/ip dhcp-server
add add-arp=yes address-pool=pool1-ADMIN authoritative=after-2sec-delay \
disabled=no interface=bridgeADMIN lease-time=1h name=server1ADMIN
add address-pool=pool2-KLIENT authoritative=after-2sec-delay disabled=no \
interface=bridgeKLIENT lease-time=1d name=server2-KLIENT
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=10.10.10.1 name=VPN-L2TP \
remote-address=pool3_VPN use-encryption=required
/queue simple
add burst-limit=6M/9M burst-time=30s/30s disabled=yes max-limit=4M/8M name=\
LimitowanieKlientow queue=default/default target=192.168.2.0/24
add burst-limit=6M/9M burst-time=30s/30s disabled=yes max-limit=4M/8M name=\
queue1 queue=default/default target=55.10.55.132/32
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 0 memory-lines=1500
/caps-man access-list
add action=accept allow-signal-out-of-range=10s comment=accept disabled=yes \
signal-range=-80..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s comment=reject disabled=yes \
signal-range=-120..-81 ssid-regexp=""
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg2admin name-format=\
identity slave-configurations=cfg2GOPOGO
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=\
cfg2GOPOGO name-format=identity
/interface bridge port
add bridge=bridgeADMIN interface=ether4
add bridge=bridgeADMIN interface=ether2
add bridge=bridgeADMIN interface=ether3
add bridge=bridgeADMIN interface=wlan1
/ip firewall connection tracking
set tcp-established-timeout=5s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1-WAN list=WAN
add interface=bridgeKLIENT list=LAN
add interface=bridgeADMIN list=LAN
/interface wireless cap
#
set certificate=CAPsMAN-CA-DBB4 discovery-interfaces=ether4 enabled=\
yes interfaces=wlan1
/ip address
add address=55.10.55.132/24 interface=ether1-WAN network=55.10.55.0
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
add address=192.168.1.1/24 interface=bridgeADMIN network=192.168.1.0
add address=192.168.2.1/24 interface=bridgeKLIENT network=192.168.2.0
add address=55.10.55.131/24 interface=ether1-WAN network=55.10.55.0
add address=192.168.103.1/24 disabled=yes interface=bridgeADMIN network=\
192.168.103.0
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 \
netmask=24
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.1.1 \
netmask=24
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d cache-size=512KiB servers=\
83.238.216.22
/ip dns static
add address=192.168.1.1 name=router.lan
/ip firewall address-list
add address=192.168.1.0/24 list=SiecAdmin
add address=192.168.2.0/24 list=SiecKLIENT
/ip firewall filter
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1-WAN
add action=accept chain=input dst-port=5246,5247 protocol=udp
/ip firewall mangle
add action=mark-connection chain=input disabled=yes dst-address=55.10.55.132 \
log=yes new-connection-mark=klient2 passthrough=yes
/ip route
add check-gateway=ping disabled=yes distance=1 gateway=192.168.4.10 \
routing-mark=do_WAN1
add check-gateway=ping disabled=yes distance=1 gateway=192.168.116.1 \
pref-src=192.168.2.1 routing-mark=do_WAN2
/ip service
set telnet disabled=yes
set ftp address=192.168.1.0/24 disabled=yes
set www address=192.168.1.0/24,192.168.103.0/24
set ssh address=192.168.1.0/24 disabled=yes
set api disabled=yes
set winbox address=\
192.168.1.0/24,192.168.103.0/24,192.168.2.0/24,55.10.55.0/24
set api-ssl disabled=yes
/ip socks
set enabled=yes port=4145
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=nowenowe
/system logging
set 0 action=echo
set 2 action=echo
set 3 action=memory
add topics=firewall
add action=echo topics=wireless
znajomy poprosił mnie o rzucenie okiem na jego internet... problem z miktorikiem rb941.
na porcie eth4 występuje błąd: interface,warning ether4 received loop protect pack
et originated from Dc:XX:B7 (ether4)
inne urządzenia zarządzane przez capsman.
z tego co widzę urządzenie na porcie eth4 komunikuje się z innymi urządzeniami, ale odnajduje tam też swoje pakiety, pętla zostaje wykryta i port pada.. nie wiem czemu mikrotiki nie chcą przyjąć ip z serwera dhcp.
adres Dc:XX:B7 to dokładnie port eht4.
co robić?!
# software id = 6,49,7
#
# model = RB941-2nD
# serial number = FDFDFDFDFDFDFD
/caps-man channel
add band=2ghz-g/n control-channel-width=20mhz frequency=2412,2437,2462 name=\
3kanaly1_6_11
add band=2ghz-b/g/n frequency=2412 name=channel1
add band=2ghz-b/g/n frequency=2437 name=channel6
add band=2ghz-b/g/n frequency=2462 name=channel11
/interface bridge
add admin-mac=6C:3B:XX:XX:2A:97 auto-mac=no name=bridgeADMIN
add mtu=1500 name=bridgeKLIENT
/interface wireless
# managed by CAPsMAN
set [ find default-name=wlan1 ] band=2ghz-b/g/n mode=ap-bridge ssid=MikroTikA
/interface ethernet
set [ find default-name=ether1 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full comment=WAN \
name=ether1-WAN
set [ find default-name=ether2 ] advertise=\
10M-half,10M-full,100M-half,100M-full,1000M-half,1000M-full loop-protect=\
on
set [ find default-name=ether3 ] comment="Siec klient"
# 2023.03.28-12:29:19: received loop protect packet originated from Dc:XX:B7 (ether4)
set [ find default-name=ether4 ] loop-protect=on
/caps-man datapath
add bridge=bridgeADMIN client-to-client-forwarding=yes local-forwarding=yes \
name=datapath1aadm
add bridge=bridgeKLIENT client-to-client-forwarding=yes name="datapath2 kli"
/caps-man configuration
add channel=channel11 channel.band=2ghz-b/g/n channel.control-channel-width=\
20mhz country=poland datapath="datapath2 kli" \
datapath.client-to-client-forwarding=no datapath.local-forwarding=no \
name=cfg2GOPOGO rates.basic=1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps \
rates.supported=1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps,12Mbps \
security.authentication-types=wpa2-psk security.encryption=aes-ccm \
security.passphrase=DOLCE123 ssid=GOPOGO
/caps-man security
add authentication-types=wpa2-psk name="sec adm" passphrase=789467894657xx
add authentication-types=wpa2-psk name="sec GOPOGO" passphrase=DOLCE123
/caps-man configuration
add channel=3kanaly1_6_11 channel.band=2ghz-b/g/n \
channel.control-channel-width=20mhz country=poland datapath=datapath1aadm \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=no \
name=cfg2admin rates.basic="1Mbps,2Mbps,5.5Mbps,11Mbps,6Mbps,9Mbps,12Mbps,\
18Mbps,24Mbps,36Mbps,48Mbps,54Mbps" rates.supported="1Mbps,2Mbps,5.5Mbps,1\
1Mbps,6Mbps,9Mbps,12Mbps,18Mbps,24Mbps,36Mbps,48Mbps,54Mbps" rx-chains="" \
security="sec adm" ssid=DOLCE tx-chains=""
add channel.band=5ghz-n/ac channel.control-channel-width=20mhz \
channel.extension-channel=XXXX country=poland \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \
name=cfg-5ghz-ac security="sec adm" ssid=""
add channel.band=5ghz-onlyn channel.control-channel-width=20mhz \
channel.extension-channel=XX country=poland \
datapath.client-to-client-forwarding=yes datapath.local-forwarding=yes \
name=cfg-5ghz-an security="sec adm" ssid=""
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip dhcp-server
add authoritative=after-2sec-delay interface=ether1-WAN name=server3
/ip ipsec profile
add dh-group=modp2048 enc-algorithm=aes-256,aes-128,3des name=profile_1
/ip ipsec peer
add disabled=yes name=peer1 passive=yes profile=profile_1
/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha256,sha1 enc-algorithms=\
aes-256-cbc,aes-128-cbc lifetime=0s pfs-group=none
/ip pool
add name=pool1-ADMIN ranges=192.168.1.50-192.168.1.150
add name=pool2-KLIENT ranges=192.168.2.50-192.168.2.199
add name=pool3_VPN ranges=10.10.10.10-10.10.10.200
add name=dhcp ranges=192.168.1.50-192.168.1.150
/ip dhcp-server
add add-arp=yes address-pool=pool1-ADMIN authoritative=after-2sec-delay \
disabled=no interface=bridgeADMIN lease-time=1h name=server1ADMIN
add address-pool=pool2-KLIENT authoritative=after-2sec-delay disabled=no \
interface=bridgeKLIENT lease-time=1d name=server2-KLIENT
/ppp profile
add dns-server=8.8.8.8,8.8.4.4 local-address=10.10.10.1 name=VPN-L2TP \
remote-address=pool3_VPN use-encryption=required
/queue simple
add burst-limit=6M/9M burst-time=30s/30s disabled=yes max-limit=4M/8M name=\
LimitowanieKlientow queue=default/default target=192.168.2.0/24
add burst-limit=6M/9M burst-time=30s/30s disabled=yes max-limit=4M/8M name=\
queue1 queue=default/default target=55.10.55.132/32
/snmp community
set [ find default=yes ] addresses=0.0.0.0/0
/system logging action
set 0 memory-lines=1500
/caps-man access-list
add action=accept allow-signal-out-of-range=10s comment=accept disabled=yes \
signal-range=-80..120 ssid-regexp=""
add action=reject allow-signal-out-of-range=10s comment=reject disabled=yes \
signal-range=-120..-81 ssid-regexp=""
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled master-configuration=cfg2admin name-format=\
identity slave-configurations=cfg2GOPOGO
add action=create-dynamic-enabled hw-supported-modes=gn master-configuration=\
cfg2GOPOGO name-format=identity
/interface bridge port
add bridge=bridgeADMIN interface=ether4
add bridge=bridgeADMIN interface=ether2
add bridge=bridgeADMIN interface=ether3
add bridge=bridgeADMIN interface=wlan1
/ip firewall connection tracking
set tcp-established-timeout=5s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add interface=ether1-WAN list=WAN
add interface=bridgeKLIENT list=LAN
add interface=bridgeADMIN list=LAN
/interface wireless cap
#
set certificate=CAPsMAN-CA-DBB4 discovery-interfaces=ether4 enabled=\
yes interfaces=wlan1
/ip address
add address=55.10.55.132/24 interface=ether1-WAN network=55.10.55.0
add address=192.168.1.1/24 interface=ether2 network=192.168.1.0
add address=192.168.1.1/24 interface=bridgeADMIN network=192.168.1.0
add address=192.168.2.1/24 interface=bridgeKLIENT network=192.168.2.0
add address=55.10.55.131/24 interface=ether1-WAN network=55.10.55.0
add address=192.168.103.1/24 disabled=yes interface=bridgeADMIN network=\
192.168.103.0
/ip dhcp-server network
add address=192.168.1.0/24 dns-server=192.168.1.1 gateway=192.168.1.1 \
netmask=24
add address=192.168.2.0/24 dns-server=192.168.2.1 gateway=192.168.1.1 \
netmask=24
/ip dns
set allow-remote-requests=yes cache-max-ttl=1d cache-size=512KiB servers=\
83.238.216.22
/ip dns static
add address=192.168.1.1 name=router.lan
/ip firewall address-list
add address=192.168.1.0/24 list=SiecAdmin
add address=192.168.2.0/24 list=SiecKLIENT
/ip firewall filter
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface=ether1-WAN
add action=accept chain=input dst-port=5246,5247 protocol=udp
/ip firewall mangle
add action=mark-connection chain=input disabled=yes dst-address=55.10.55.132 \
log=yes new-connection-mark=klient2 passthrough=yes
/ip route
add check-gateway=ping disabled=yes distance=1 gateway=192.168.4.10 \
routing-mark=do_WAN1
add check-gateway=ping disabled=yes distance=1 gateway=192.168.116.1 \
pref-src=192.168.2.1 routing-mark=do_WAN2
/ip service
set telnet disabled=yes
set ftp address=192.168.1.0/24 disabled=yes
set www address=192.168.1.0/24,192.168.103.0/24
set ssh address=192.168.1.0/24 disabled=yes
set api disabled=yes
set winbox address=\
192.168.1.0/24,192.168.103.0/24,192.168.2.0/24,55.10.55.0/24
set api-ssl disabled=yes
/ip socks
set enabled=yes port=4145
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name=nowenowe
/system logging
set 0 action=echo
set 2 action=echo
set 3 action=memory
add topics=firewall
add action=echo topics=wireless
Razem z publicznym IP.
