5. 配置IP Service，限定远程管理RouerOS 的地址和方式

/ ip service set telnet port=23 address=0.0.0.0/0 disabled=no set ftp port=21 address=0.0.0.0/0 disabled=no set www port=80 address=0.0.0.0/0 disabled=no set hotspot port=8088 address=0.0.0.0/0 disabled=no / ip policy-routing add name="jitong"

6. 配置Hotspot（WEB 认证）

/ ip hotspot

set hotspot-address=(ip_addr) status-autorefresh=1m auth-mac=no
auth-mac-password=no auth-http-cookie=no http-cookie-lifetime=1d
/ ip hotspot profile
set default name="default" session-timeout=0s idle-timeout=0s only-one=yes
tx-bit-rate=0 incoming-filter="" outgoing-filter=""
/ ip hotspot radius-client
set enabled=no accou=yes primary-serv=(ip_addr) secondary-serv=(ip_addr)
shared-secret="" authentication-port=1812 accounting-port=1813
interim-update=0s

7. 配置IP Pool

/ ip pool add name="jitong" ranges=172.16.1.3-172.16.1.254 add name="dianxin" ranges=172.16.2.3-172.16.2.254

8. 启用NAT 后的策略路由配置

应用拓扑见下面的示意图。某校园网络有教育和电信两个出口，网关分别是：202.10.68.1 和

211.99.52.129。首先按正常情况配置好IP 地址、基本路由、防火墙、NAT 等。基本路由配置如下（即主路由表main）：[admin@RouerOS] ip route> pr Flags:X -disabled,I -invalid,D -dynamic,J -rejected,C -connect,S -static, r - rip, o - ospf, b -bgp

#
DST-ADDRESS
G GATEWAY
DISTANCE
INTERFACE

0
S 0.0.0.0/0
r 211.99.52.129
1
eth0

1
S 10.10.4.0/24
r 10.10.1.2
1
cdjw

2
DC 211.96.0.0/14
r 0.0.0.0
0
eth0

3
DC 202.116.68.0/22
r 0.0.0.0
0
eth1

4
DC 10.255.254.0/29
r 0.0.0.0
0
eth3

5
DC 10.10.1.0/24
r 0.0.0.0
0
cdjw

6
DC 10.5.4.0/22
r 0.0.0.0
0
v12

一个策略路由配置实例

8.1 在/ip policy-routing 下建多个路由表

其中“main”表为系统根据在/ip route 中配置的路由自动生成的。

[leitcomm@RouerOS] ip policy-routing> add ?

Creates new item with specified property values. copy-from Item number name The name of the routing table

[leitcomm@RouerOS] ip policy-routing> pri

Flags: D - dynamic
# NAME
0

jiaoyu 1 D main 这里“jiaoyu”表的配置如下：

[leitcomm@RouerOS] ip policy-routing> tab jiao [leitcomm@RouerOS] ip policy-routing table jiaoyu> pri

Flags: X - disabled, I - invalid, D - dynamic, R - rejected

# TYPE DST-ADDRESS G GATEWAY DISTANCE INTERFACE

0 static 0.0.0.0/0 r 202.116.68.1 1 eth1

8.2 建立策略路由规则

[leitcomm@RouerOS] ip policy-routing rule> add ？

Creates new item with specified property values.

action Rule action

comment Set comment for items

copy-from Item number

disabled Defines whether the rule is disabled or not

dst-address Destination address

dst-netmask Destination mask

flow Flow mask of the packet to be mached by this rule

interface The name of the interface

place-before Item number

src-address Source address

src-netmask Source mask

table Routing table

[leitcomm@RouerOS] ip policy-routing rule> pri

Flags: X - disabled, I - invalid

# SRC-ADDRESS DST-ADDRESS INTERFACE FLOW ACTION
TABLE

0 0.0.0.0/0 202.10.68.49/32 all lookup
main

1 0.0.0.0/0 0.0.0.0/0 all jiaoyu lookup
jiaoyu

2 0.0.0.0/0 0.0.0.0/0 all lookup
main

注意为使用指定的路由表打上flow 标记。

8.3 在防火墙src-nat 中配置相应规则

[leitcomm@RouerOS] ip firewall src-nat> pri

Flags: X - disabled, I - invalid, D - dynamic

0 src-address=172.16.0.0/22:0-65535 dst-address=0.0.0.0/0:0-65535 out-interface=eth0 protocol=all icmp-options=any:any flow="" connection="" content="" limit-count=0 limit-burst=0 limit-time=0s action=nat to-src-address=211.96.14.194 to-src-port=0-65535 1src-address=0.0.0.0/0:0-65535dst-address=0.0.0.0/0:0-65535out-interface=eth1 protocol=all icmp-options=any:any flow=jiaoyu connection="" content="" limit-count=0 limit-burst=0 limit-time=0s action=nat to-src-address=202.116.68.49 to-src-port=0-65535 注：action 选nat，到非缺省目的地的路由flow 要标记。并定义to-src-address。

2 ;; masquerade hotspot temporary network src-address=192.168.0.0/22:0-65535 dst-address=0.0.0.0/0:0-65535 out-interface=all protocol=all icmp-options=any:anyflow=""connection=""content=""limit-count=0limit-burst=0 limit-time=0s action=nat to-src-address=211.96.14.194 to-src-port=0-65535 3 ;; masquerade hotspot network src-address=10.5.4.0/22:0-65535 dst-address=0.0.0.0/0:0-65535 out-interface=all protocol=all icmp-options=any:anyflow=""connection=""content=""limit-count=0limit-burst=0 limit-time=0s action=nat to-src-address=211.96.14.194 to-src-port=0-65535

8.4 配置防火墙mangle

[leitcomm@RouerOS] ip firewall mangle> pri Flags: X - disabled, I - invalid, D - dynamic 0 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=202.116.68.49/32:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow="" tcp-mss=dont-change mark-connection="" 1 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=202.112.0.0/16:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow=jiaoyu tcp-mss=dont-change mark-connection="" 2 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=116.111.0.0/16:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow=jiaoyu tcp-mss=dont-change mark-connection="" 3 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=202.117.0.0/16:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow=jiaoyu tcp-mss=dont-change mark-connection="" 4 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=202.116.0.0/16:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow=jiaoyu tcp-mss=dont-change mark-connection="" 5 src-address=0.0.0.0/0:0-65535 in-interface=all dst-address=162.105.0.0/16:0-65535 protocol=all tcp-options=any icmp-options=any:any flow="" connection="" content="" src-mac-address=00:00:00:00:00:00 limit-count=0 limit-burst=0 limit-time=0s action=accept mark-flow=jiaoyu tcp-mss=dont-change mark-connection=""

注：必须针对每一目的地址段做mangle 策略。

ITPub博客

RouterOS中文使用手册（第三部分）（转）

最新文章