guest ssid αλλα και 2 ακομα ανεξαρτητα Vpn ssid

[kostas2005]

εκανα reset.
Αφήνοντας default firewall rulles έφτιαξα άπλα και ένα ανεξάρτητο guest wifi εκτος απο το κανονικού
(κλείνοντας και την πρόσβαση στο MT απο το guest wifi)
ακολουθωντας αυτον τον οδηγο.. SETUP GUEST (VLAN) WIFI..

Spoiler:

It is a common security practice to setup a wireless guest network on a separate VLAN. This allows for complete isolation of traffic between your private and guest networks. This guide will only be covering how to implement this particular setup on MikroTik routers with built-in WiFi, such as the RB951, RB962, etc. Before going forward, I’m assuming that a private wireless network already exists and is fully functional. In addition, all screenshots and instructions in this guide are done using MikroTik’s WinBox software.



CREATE THE SECURITY PROFILE AND VIRTUAL AP





In Winbox, select Wireless on the left-hand side and navigate to the Security Profiles tab. Click the + (plus) button to create a new Security Profile. I’ve disabled WPA PSK, leaving only WPA2 PSK enabled. Also, ensure that you’ve set a secure/complex password. See screenshot for details:

Afterwards, navigate to the WiFi Interfaces tab and click the + (plus) button and select “Virtual” from the menu. Under the General tab, set the Name for the Virtual AP, something descriptive, such as WiFi-Guest. Afterwards, navigate to the Wireless tab and set the SSID, Security Profile, VLAN Mode, and VLAN ID. The VLAN ID will match the VLAN interface that we will be creating in the next step. See screenshots for further details:

CREATE THE VLAN INTERFACE





In Winbox, select Interfaces on the left-hand side and navigate to the VLAN tab. Click the + (plus) button to create a new VLAN interface. The VLAN ID is “10” and the Interface is “WiFi-Guest”, which are values that were set in the previous step, when creating the Virtual AP. See screenshot for details:
NOTE: The MikroTik may be using “Interface Lists” (Winbox: Interface > Interface List tab) in some of the firewall filter rules. If this is the case, you will want to either not use Interface Lists and use just interfaces, or make sure to add the new VLAN interface for the guest network to the existing LAN Interface List. If the MikroTik is using Interface Lists and you do not add the VLAN inteface for the guest network to the existing LAN interface list, then guests will be able to connect to the network, but will have no internet access. To be specific, the default MikroTik rule that requires the VLAN for the guest network to be added to the LAN Interface List is the following:

NOTE: The MikroTik may be using “Interface Lists” (Winbox: Interface > Interface List tab) in some of the firewall filter rules. If this is the case, you will want to either not use Interface Lists (requires firewall filter rule modifications) and use just interfaces, or make sure to add the new VLAN interface for the guest network to the existing LAN Interface List (no firewall filter rule modifications needed). If the MikroTik is using Interface Lists and you do not add the VLAN inteface for the guest network to the existing LAN interface list, then guests will be able to connect to the network, but will have no internet access. To be specific, the default MikroTik rule that requires the VLAN for the guest network to be added to the LAN Interface List is the following:












/ip firewall filter
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN











CREATE A NEW BRIDGE





In Winbox, select Bridge on the left-hand side and navigate to the Bridge tab. Click the + (plus) button to create a new Bridge. Set the bridge Name to “Bridge-VLAN10”. See screenshot for details:

Afterwards, navigate to the Ports tab and click the + (plus) button to add an interface to a bridge. This step will need to be done twice, once for each interface that is added to Bridge-VLAN10. Add interface “Wifi-Guest” and “VLAN10” to the “Bridge-VLAN10” bridge. See screenshots for further details:

ASSIGN A SUBNET TO THE NEW BRIDGE





In Winbox, select IP on the left-hand side and navigate to Addresses. Click the + (plus) button to create a Address/Interface assignment. Set Address to “10.10.10.1/24” and Interface to “Bridge-VLAN10”. See screenshot for details:

CREATE A DHCP SERVER





In Winbox, select IP on the left-hand side and navigate to DHCP Server. Under the DHCP tab, click the “DHCP Setup” button and finish the wizard to create the DHCP server for the guest WiFi. See screenshot for details:

CREATE AND PLACE THE FIREWALL FILTER RULES





In Winbox, select IP on the left-hand side and navigate to Firewall. Under the Filter Rules tab, click the + (plus) button to create a new filter rule. See screenshot below, which shows how to create a firewall filter rule to block guest VLAN traffic to the private network ONLY. After creating the new firewall filter rule, place the firewall filter rule accordingly in the firewall filters list – order matters. It is your IT department/provider’s responsibility to test the security between between the two separate networks to ensure that the guest network on VLAN10 (Bridge-VLAN10 interface) cannot communicate with devices/clients on the private network.
If needed, a second rule can be added to block traffic from the private network to the guest VLAN network. In order to do this, simply create another rule, but swap the values for the “In. Interface” and “Out. Interface”. It is up to your IT department/provider’s security policies on how to implement the firewall filter rule. This example uses the network interfaces that were create on the MikroTik to separate the two networks, but it can just as easily be done IP address with slash notation (CIDR notation) if need be. Again, it is up to your IT department/provider.

This entire guide has been GUI based, but I’ve decided to include the following commands below, which will create both firewall filter rules to block traffic from guest to private and from private to guest. The entire command can be pasted in the MirktoTik terminal. Keep in mind that after the filter rules are created that they still need to be placed accordingly within the firewall filter rules list.











/ip firewall filter
add action=drop chain=forward disabled=yes in-interface=Bridge out-interface=Bridge-VLAN10
add action=drop chain=forward disabled=yes in-interface=Bridge-VLAN10 out-interface=Bridge

Έπειτα εδωσα τροποποιημενα οσες φορες χρειαστηκε την παρακατω εντολη δημιουργωντας

/interface bridge


/interface wireless security-profiles


/interface wireless


/ip pool


/ip dhcp-server


/interface bridge port


/ip address


/ip dhcp-server network


/ip firewall mangle


/ip firewall nat


/ip route

Spoiler:

/interface bridge
add name=bridge_VPN_US
/interface pptp-client
add connect-to=usfl1.pointtoserver.com dial-on-demand=no disabled=no name=\
PureVPN_US password=yourpass user=yourusername
/interface wireless security-profiles
add authentication-types=wpa-psk,wpa2-psk eap-methods="" management-protection=\
allowed mode=dynamic-keys name=USVPN supplicant-identity="" \
wpa-pre-shared-key=yourwirelesskey wpa2-pre-shared-key=yourwirelesskey
/interface wireless
add disabled=no keepalive-frames=disabled \
master-interface=wlan1 multicast-buffering=disabled name=Tsunami_US \
security-profile=USVPN ssid=Tsunami_US wds-cost-range=0 wds-default-cost=0 \
wps-mode=disabled
/ip pool
add name=TsunamiUS_Pool ranges=192.168.89.50-192.168.89.200
/ip dhcp-server
add address-pool=TsunamiUS_Pool disabled=no interface=bridge_VPN_US lease-time=\
1d name=DHCP_VPN
/interface bridge port
add bridge=bridge_VPN_US interface=Tsunami_US
/ip address
add address=192.168.89.1/24 interface=bridge_VPN_US network=192.168.89.0
/ip dhcp-server network
add address=192.168.89.0/24 dns-server=1.1.1.1 gateway=\
192.168.89.1 netmask=24 ntp-server=192.168.89.1
/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=PureVPN_US \
passthrough=yes src-address=192.168.89.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=PureVPN_US
add action=masquerade chain=srcnat src-address=192.168.89.0/24
/ip route
add distance=1 gateway=PureVPN_US routing-mark=PureVPN

Στην τελευταια γραμμη αλλαξα το
/ip route
add distance=1 gateway=PureVPN_US routing-mark=PureVPN

σε

/ip route
add distance=1 gateway=PureVPN_US routing-mark=PureVPN_US

γιατι αλλιως δεν μου δουλευε

- - - Updated - - -

ειναι σωστο ετσι οπως το εκανα?

μηπως γινοταν και με Vlan (οπως και η δημιουργια του guest wifi) για μεγαλυτερη ασφαλεια?

Ρωταω γιατι αυτο το Μτ θα χρησιμοποιηθει σαν βασικο router στο σπιτι με Nas επανω του αλλα και ενα ακομα εξτρα guest wifi εκτος απο τα 2 vpn->ssid .

- - - Updated - - -

ΣΗΜΑΝΤΙΚΟ
και ελεγα γιατι σερνεται (στην ουσια δεν ανοιγει σχεδόν τιποτα) οταν συνδεομουν σε ενα απο τα ssid του MT που με "βγαζουν" σε Vpn ...
https://forum.mikrotik.com/viewtopic.php?t=121262
Ενω αν συνδεθω στο κανονικο ssid του MT που οδηγει στην κανονικη μου συνδεση και κανω κληση στον ιδιο server με το ιδιο πρωτοκολλο εχω καλες ταχυτητες και οι σελιδες ανοιγουν
Πως ΑΛΛΑΖΩ το mss?????????????

μια αλλη συμβουλη ειναι ..
You are requested to change the DNS of your router to 208.67.222.222 and 208.67.220.220

[macro]

Πρεπει να πεις ποιος ειναι ο στοχος σου, δλδ τι θες να επιτυχεις.

Εγω αν ηθελα ας πουμε να φτιαξω ενα virtual ssid isolated με το υπολοιπο υποδικτυο, που ετσι δουλευω, θα εφτιαχνα ενα δευτερο bridge2 που θα εβαζα το virtual, θα εδινα στο bridge2 μια non subnet ip (10.10.10.1) και θα εφτιαχνα 2 filter rules που θα εκανα drop το ενα subnet στο αλλο

π.χ

forward>src. address>dest.address>drop

Επισης εχω φτιαξει και μια queue που κανω limit το guest ssid.

Ζωάραααα.....

[kostas2005]

Ενα mt σαν βασικο router με nas κλπ συσκευές.
Παράλληλα ενα guest wifi εντελώς ανεξάρτητο .
Αυτό πιστεύω το έκανα με vlan.
(μένει να βάλω επιπλέον rules σρο firewall για περισσότερη ασφάλεια.. port scan κλπ.)

Έπειτα δημιουργήθηκαν 2 ακόμα ssid που πέφτουν επάνω σε κλήσεις Vpn.


Θελω όμως να διασφαλιστεί οσο γίνετε ότι ετσι δεν θα ανοίξω backdoor απο την άλλη πλευρά των vpn στο οικιακό δίκτυο.

Επίσης να είναι οι τοπικοί χρήστες των vpn isolated απο το τοπικό μου δίκτυο.

[kostas2005]

Πρεπει να πεις ποιος ειναι ο στοχος σου, δλδ τι θες να επιτυχεις.

Εγω αν ηθελα ας πουμε να φτιαξω ενα virtual ssid isolated με το υπολοιπο υποδικτυο, που ετσι δουλευω, θα εφτιαχνα ενα δευτερο bridge2 που θα εβαζα το virtual, θα εδινα στο bridge2 μια non subnet ip (10.10.10.1) και θα εφτιαχνα 2 filter rules που θα εκανα drop το ενα subnet στο αλλο

π.χ

forward>src. address>dest.address>drop

Επισης εχω φτιαξει και μια queue που κανω limit το guest ssid.

Ζωάραααα.....

δηλαδη στο πρωτο spoiler που εχω βαλει και φτιαχνει ενα virtual ssid isolated αλλα με vlan ποιες οι διαφορες?

[macro]

Αν εχεις το επιθυμητο αποτελεσμα και ξερεις τι θες να επιτυχεις οπως και να το κανεις δεν εχει σημασια. Ενα τροπο εδειξα.