Привет, это меня полностью сбило с толку. Я не могу зайти на свой сайт corsa-c.ro. Все работало годами, пока недавно не перестало. В моей локальной сети сайт не открывается, но на телефоне через 3G всё нормально, значит сайт в целом работает. На телефоне по WiFi тоже нет подключения, поэтому можно исключить ПК. В роутере у меня Mikrotik RB493G, он выполняет функции маршрутизатора, файрвола, точки доступа и capsman для wAP ac. Версия ПО у обоих устройств 6.41. В браузере появляется сообщение «The Connection has timed out». Traceroute с ПК в конечном итоге доходит до сайта по IP 37.251.143.31, но на прыжках (hop) 7, 8, 9, 11, 12 и 13 идёт таймаут. В Mikrotik, в IP → Firewall → Connections для 37.251.143.31:80 я вижу статус syn sent, и всё, ничего больше. Что я пробовал: напрямую с ПК выйти в WAN — сайт работает нормально. Отключал все правила файрвола, перезагружал Mikrotik — не помогает. Больше ничего не знаю. Пробовал MTU 1500, но фактический MTU автоматически меняется обратно на 1480. Есть идеи?
/ip firewall filter
add action=drop chain=forward comment=“drop invalid connections” connection-state=invalid
add action=drop chain=input comment=“Drop DNS open resolver” dst-port=53 in-interface=KPN protocol=udp
add action=drop chain=input comment=“Drop DNS open resolver” dst-port=53 in-interface=KPN protocol=tcp
add action=drop chain=input comment=“Allow internal LAN winbox access to router and deny anything else” dst-port=8291 protocol=tcp src-address=!192.168.1.0/24
add action=tarpit chain=input comment=“Tarpit traffic from DOS list” log-prefix=“""” protocol=tcp src-address-list=DOS
add action=add-src-to-address-list address-list=DOS address-list-timeout=1d chain=input comment=“Put address on DOS list” connection-limit=100,32 log-prefix=“""” protocol=tcp src-address=!192.168.1.0/24
add action=add-src-to-address-list address-list=DOS address-list-timeout=1d chain=input comment=“Put address on DOS list” connection-limit=100,32 log-prefix=“""” protocol=tcp src-address=!10.1.0.0/24
add action=drop chain=input comment=“dropping port scanners” src-address-list=“port scanners”
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“Port scanners to list” protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“NMAP FIN Stealth scan” protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“SYN/FIN scan” protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“SYN/RST scan” protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“FIN/PSH/URG scan” protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“ALL/ALL scan” protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“NMAP NULL scan” protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=accept chain=forward comment=“allow related connections” connection-state=related
add action=accept chain=forward comment=“allow established connections” connection-state=established
/ip firewall nat
add action=masquerade chain=srcnat out-interface=KPN
add action=src-nat chain=srcnat comment=“exit to adsl modem” out-interface=ether1 src-address=192.168.1.0/24 to-addresses=10.0.0.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
IP Route print details
0 ADS dst-address=0.0.0.0/0 gateway=KPN gateway-status=KPN reachable distance=1 scope=30 target-scope=10
1 ADC dst-address=10.0.0.0/24 pref-src=10.0.0.2 gateway=ether1 gateway-status=ether1 reachable distance=0 scope=10
2 ADC dst-address=192.168.1.0/24 pref-src=192.168.1.1 gateway=bridge1 gateway-status=bridge1 reachable distance=0 scope=10
3 ADC dst-address=y.y.y.y/32 pref-src=x.x.x.x gateway=KPN gateway-status=KPN reachable distance=0 scope=10
Спасибо за уделённое время.
/ip firewall filter
add action=drop chain=forward comment=“drop invalid connections” connection-state=invalid
add action=drop chain=input comment=“Drop DNS open resolver” dst-port=53 in-interface=KPN protocol=udp
add action=drop chain=input comment=“Drop DNS open resolver” dst-port=53 in-interface=KPN protocol=tcp
add action=drop chain=input comment=“Allow internal LAN winbox access to router and deny anything else” dst-port=8291 protocol=tcp src-address=!192.168.1.0/24
add action=tarpit chain=input comment=“Tarpit traffic from DOS list” log-prefix=“""” protocol=tcp src-address-list=DOS
add action=add-src-to-address-list address-list=DOS address-list-timeout=1d chain=input comment=“Put address on DOS list” connection-limit=100,32 log-prefix=“""” protocol=tcp src-address=!192.168.1.0/24
add action=add-src-to-address-list address-list=DOS address-list-timeout=1d chain=input comment=“Put address on DOS list” connection-limit=100,32 log-prefix=“""” protocol=tcp src-address=!10.1.0.0/24
add action=drop chain=input comment=“dropping port scanners” src-address-list=“port scanners”
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“Port scanners to list” protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“NMAP FIN Stealth scan” protocol=tcp tcp-flags=fin,!syn,!rst,!psh,!ack,!urg
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“SYN/FIN scan” protocol=tcp tcp-flags=fin,syn
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“SYN/RST scan” protocol=tcp tcp-flags=syn,rst
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“FIN/PSH/URG scan” protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“ALL/ALL scan” protocol=tcp tcp-flags=fin,syn,rst,psh,ack,urg
add action=add-src-to-address-list address-list=“port scanners” address-list-timeout=2w chain=input comment=“NMAP NULL scan” protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=accept chain=forward comment=“allow related connections” connection-state=related
add action=accept chain=forward comment=“allow established connections” connection-state=established
/ip firewall nat
add action=masquerade chain=srcnat out-interface=KPN
add action=src-nat chain=srcnat comment=“exit to adsl modem” out-interface=ether1 src-address=192.168.1.0/24 to-addresses=10.0.0.0/24
/ip firewall service-port
set ftp disabled=yes
set tftp disabled=yes
set irc disabled=yes
set h323 disabled=yes
set sip disabled=yes
set pptp disabled=yes
IP Route print details
0 ADS dst-address=0.0.0.0/0 gateway=KPN gateway-status=KPN reachable distance=1 scope=30 target-scope=10
1 ADC dst-address=10.0.0.0/24 pref-src=10.0.0.2 gateway=ether1 gateway-status=ether1 reachable distance=0 scope=10
2 ADC dst-address=192.168.1.0/24 pref-src=192.168.1.1 gateway=bridge1 gateway-status=bridge1 reachable distance=0 scope=10
3 ADC dst-address=y.y.y.y/32 pref-src=x.x.x.x gateway=KPN gateway-status=KPN reachable distance=0 scope=10
Спасибо за уделённое время.
