From tasic at academ.kiev.ua Fri Dec 14 12:35:53 2018 From: tasic at academ.kiev.ua (Taras Heichenko) Date: Fri, 14 Dec 2018 12:35:53 +0200 Subject: [uanog] =?utf-8?b?RE5TINC4INC60L7RgdGC0YvQu9C4?= Message-ID: <55717898-873E-4BA3-A795-BD718C00E93C@academ.kiev.ua> Hi! ????? ???????? ???????? ???, ? ???? ? ????????? ???? NS'? ??? ?????-???? ?????? ????? ??????. 1 ??????? 2019 ???? ???????????? ???????????? ??????????? ??? DNS (BIND, KNOT ? ?.?.) ? ??????? ?????????? DNS ?????????? ???????????? ????????????? ????????? ???????, ?????????????? backward compatibility ??? ????? ???????. ???????? ??????????? ? ?????????, ??????? ???????? ? ???????????? ??? ?????? ????? ?? ????? https://dnsflagday.net/ -- Taras Heichenko tasic at academ.kiev.ua From doka.ua at gmail.com Sat Dec 15 01:00:37 2018 From: doka.ua at gmail.com (Volodymyr Litovka) Date: Sat, 15 Dec 2018 01:00:37 +0200 Subject: [uanog] mikrotik enough firewall rules Message-ID: <913a9d4a-9889-a5a0-84f0-5a9719c9f61c@gmail.com> ??????, ??????????, ??????????, ???? best practices ??? ?????? ????????? ???? ?? _???????? ??????_. ???? ??????, ???????????? ? ?????, ??????? ?????? ????????? VPN-?????? ? ????????? ?????????. ????????? ???? ????? ? ???????? ????? WAN (ether1) ? ?? ????????? ???????? - ????? VPN-?????. NAT ???????? ?? out-interface:ether1, ?????? ?? VPN-?????? ?? ???????. ?? ??????? ???? ??? ????? ??????? ???????? (??????? ?? ????? - default rules, ? ??????? ?????? ??????? 4,5,6) ? ? ???? ?????? - ??????????-?? ?????, ????? ???? ?????-????? ????????? ???????????? ???????? ???????????? ????????? ????? ?? ????, ??????????: input ?????????? ????????? ?????? ICMP ? SSH, ???????????? winbox ??????????? ???????, ????????? - ???????. ??????? ?? WAN-?????????? - ?????? ??? ??????????, ?????????????? ???????. ??????? ? VPN-?????? ?? ????????????. ???????????, ?????-?? ?, ???? ??, ?? ??? ??? ??????? ????? ??????????? :) ??? ??? ???????? ????? ???????????, ?? ? ??????? ?????????? :) ???????. ?0? D ;;; special dummy rule to show fasttrack counters ????? chain=forward action=passthrough ?1??? ;;; defconf: accept established,related,untracked ????? chain=input action=accept connection-state=established,related,untracked ?2??? ;;; defconf: drop invalid ????? chain=input action=drop connection-state=invalid ?3??? ;;; defconf: accept ICMP ????? chain=input action=accept protocol=icmp ?4??? ;;; Allow SSH from everywhere ????? chain=input action=accept protocol=tcp dst-port=[...] log=no log-prefix="" ?5??? ;;; Allow OSPF on VPN links only ????? chain=input action=accept protocol=ospf in-interface-list=VPN log=no log-prefix="" ?6??? ;;; Allow Winbox on LAN/VPN only ????? chain=input action=accept protocol=tcp in-interface-list=LAN dst-port=[...] log=no log-prefix="" ?7??? ;;; defconf: drop all ????? chain=input action=drop log=no log-prefix="" ?8??? ;;; defconf: fasttrack ????? chain=forward action=fasttrack-connection connection-state=established,related ?9??? ;;; defconf: accept established,related, untracked ????? chain=forward action=accept connection-state=established,related,untracked 10??? ;;; defconf: drop invalid ????? chain=forward action=drop connection-state=invalid 11??? ;;; defconf:? drop all from WAN not DSTNATed ????? chain=forward action=drop connection-state=new connection-nat-state=!dstnat in-interface-list=WAN -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison From doka.ua at gmail.com Mon Dec 17 15:26:58 2018 From: doka.ua at gmail.com (Volodymyr Litovka) Date: Mon, 17 Dec 2018 15:26:58 +0200 Subject: [uanog] mikrotik enough firewall rules In-Reply-To: <913a9d4a-9889-a5a0-84f0-5a9719c9f61c@gmail.com> References: <913a9d4a-9889-a5a0-84f0-5a9719c9f61c@gmail.com> Message-ID: ??????, ??, ????? best practices? On Sat, Dec 15, 2018, 01:00 Volodymyr Litovka ??????, > > ??????????, ??????????, ???? best practices ??? ?????? ????????? ???? ?? > _???????? ??????_. ???? ??????, ???????????? ? ?????, ??????? ?????? > ????????? VPN-?????? ? ????????? ?????????. ????????? ???? ????? ? > ???????? ????? WAN (ether1) ? ?? ????????? ???????? - ????? VPN-?????. > NAT ???????? ?? out-interface:ether1, ?????? ?? VPN-?????? ?? ???????. > > ?? ??????? ???? ??? ????? ??????? ???????? (??????? ?? ????? - default > rules, ? ??????? ?????? ??????? 4,5,6) ? ? ???? ?????? - ??????????-?? > ?????, ????? ???? ?????-????? ????????? ???????????? ???????? > ???????????? ????????? ????? ?? ????, ??????????: input ?????????? > ????????? ?????? ICMP ? SSH, ???????????? winbox ??????????? ???????, > ????????? - ???????. ??????? ?? WAN-?????????? - ?????? ??? ??????????, > ?????????????? ???????. ??????? ? VPN-?????? ?? ????????????. > ???????????, ?????-?? ?, ???? ??, ?? ??? ??? ??????? ????? ??????????? > :) ??? ??? ???????? ????? ???????????, ?? ? ??????? ?????????? :) > > ???????. > > 0 D ;;; special dummy rule to show fasttrack counters > chain=forward action=passthrough > > 1 ;;; defconf: accept established,related,untracked > chain=input action=accept > connection-state=established,related,untracked > > 2 ;;; defconf: drop invalid > chain=input action=drop connection-state=invalid > > 3 ;;; defconf: accept ICMP > chain=input action=accept protocol=icmp > > 4 ;;; Allow SSH from everywhere > chain=input action=accept protocol=tcp dst-port=[...] log=no > log-prefix="" > > 5 ;;; Allow OSPF on VPN links only > chain=input action=accept protocol=ospf in-interface-list=VPN > log=no log-prefix="" > > 6 ;;; Allow Winbox on LAN/VPN only > chain=input action=accept protocol=tcp in-interface-list=LAN > dst-port=[...] log=no log-prefix="" > > 7 ;;; defconf: drop all > chain=input action=drop log=no log-prefix="" > > 8 ;;; defconf: fasttrack > chain=forward action=fasttrack-connection > connection-state=established,related > > 9 ;;; defconf: accept established,related, untracked > chain=forward action=accept > connection-state=established,related,untracked > > 10 ;;; defconf: drop invalid > chain=forward action=drop connection-state=invalid > > 11 ;;; defconf: drop all from WAN not DSTNATed > chain=forward action=drop connection-state=new > connection-nat-state=!dstnat in-interface-list=WAN > > > -- > Volodymyr Litovka > "Vision without Execution is Hallucination." -- Thomas Edison > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From vc at vc.org.ua Mon Dec 17 17:30:39 2018 From: vc at vc.org.ua (Victor Cheburkin) Date: Mon, 17 Dec 2018 17:30:39 +0200 Subject: [uanog] mikrotik enough firewall rules In-Reply-To: References: <913a9d4a-9889-a5a0-84f0-5a9719c9f61c@gmail.com> Message-ID: Hi! ??? ??? ????? best practice ????? ??? ??????????, ?? ????, ?????? ???? openvpn (??????? ?? mikrotik ???????????), ????? ??? ? ?? ?????. ????? best practice, ??-????? (???? ? ?? ????? ??????????) - ?????????? ?????? + ????? ??????????? ?????? ? ?????-?????? ? ???, ????????? ????????? ????????? 7 ? 11. ?????, ????????? ? ????? ??????, ????????, ????? ????? ???? ??? 5 ???????. ???, ????????, ????? ?????????? ? ?????????? IP ?? ???? RP Filter, accept redirect, tcp syn cookies. ? ????, ??? ????????? ????? ? fasttrack ????????????, ? ??????? -- ??????????? ????????. ?????, ?? ? ??? ??? ??? ??? ??????, ?? ??? ????? ???????, ?? ??? ;-) > 17 ???. 2018 ?., ? 15:26, Volodymyr Litovka ???????(?): > > ??????, > > ??, ????? best practices? > > On Sat, Dec 15, 2018, 01:00 Volodymyr Litovka wrote: > ??????, > > ??????????, ??????????, ???? best practices ??? ?????? ????????? ???? ?? > _???????? ??????_. ???? ??????, ???????????? ? ?????, ??????? ?????? > ????????? VPN-?????? ? ????????? ?????????. ????????? ???? ????? ? > ???????? ????? WAN (ether1) ? ?? ????????? ???????? - ????? VPN-?????. > NAT ???????? ?? out-interface:ether1, ?????? ?? VPN-?????? ?? ???????. > > ?? ??????? ???? ??? ????? ??????? ???????? (??????? ?? ????? - default > rules, ? ??????? ?????? ??????? 4,5,6) ? ? ???? ?????? - ??????????-?? > ?????, ????? ???? ?????-????? ????????? ???????????? ???????? > ???????????? ????????? ????? ?? ????, ??????????: input ?????????? > ????????? ?????? ICMP ? SSH, ???????????? winbox ??????????? ???????, > ????????? - ???????. ??????? ?? WAN-?????????? - ?????? ??? ??????????, > ?????????????? ???????. ??????? ? VPN-?????? ?? ????????????. > ???????????, ?????-?? ?, ???? ??, ?? ??? ??? ??????? ????? ??????????? > :) ??? ??? ???????? ????? ???????????, ?? ? ??????? ?????????? :) > > ???????. > > 0 D ;;; special dummy rule to show fasttrack counters > chain=forward action=passthrough > > 1 ;;; defconf: accept established,related,untracked > chain=input action=accept > connection-state=established,related,untracked > > 2 ;;; defconf: drop invalid > chain=input action=drop connection-state=invalid > > 3 ;;; defconf: accept ICMP > chain=input action=accept protocol=icmp > > 4 ;;; Allow SSH from everywhere > chain=input action=accept protocol=tcp dst-port=[...] log=no > log-prefix="" > > 5 ;;; Allow OSPF on VPN links only > chain=input action=accept protocol=ospf in-interface-list=VPN > log=no log-prefix="" > > 6 ;;; Allow Winbox on LAN/VPN only > chain=input action=accept protocol=tcp in-interface-list=LAN > dst-port=[...] log=no log-prefix="" > > 7 ;;; defconf: drop all > chain=input action=drop log=no log-prefix="" > > 8 ;;; defconf: fasttrack > chain=forward action=fasttrack-connection > connection-state=established,related > > 9 ;;; defconf: accept established,related, untracked > chain=forward action=accept > connection-state=established,related,untracked > > 10 ;;; defconf: drop invalid > chain=forward action=drop connection-state=invalid > > 11 ;;; defconf: drop all from WAN not DSTNATed > chain=forward action=drop connection-state=new > connection-nat-state=!dstnat in-interface-list=WAN > > > -- > Volodymyr Litovka > "Vision without Execution is Hallucination." -- Thomas Edison > > _______________________________________________ > uanog mailing list > uanog at uanog.kiev.ua > https://mailman.uanog.kiev.ua/mailman/listinfo/uanog -- Victor Cheburkin VC319-RIPE, VC1-UANIC -------------- next part -------------- An HTML attachment was scrubbed... URL: From maxtul at netassist.kiev.ua Thu Dec 20 20:46:33 2018 From: maxtul at netassist.kiev.ua (Max Tulyev) Date: Thu, 20 Dec 2018 20:46:33 +0200 Subject: [uanog] =?utf-8?b?VkxBTiDQsiBVQS1JWCDRgdC+0LfQtNCw0Y7RgtGB0Y8g?= =?utf-8?b?0LDQstGC0L7QvNCw0YLQuNGH0LXRgdC60Lg=?= Message-ID: <684a4632-cac3-3f5e-5b88-47b756726de5@netassist.kiev.ua> ?????? ????! ????? ??? ??? ?? ?????: UA-IX ??? ????? ?????????? ???? ?????? ???????? ?????????? VLAN ? ????????? ?????????????? ??????, ??? ??????? ????????. ???????? ???????? ????? VLAN ?? ????????? ? ? ?????? ????????? ???? VLAN, ?????? ???????? ???????????? - ????? ?????? ????????????? ???????????? ? ????????? ? ???? ?????? ???????? ????? ???? ?????. ??? ???????? ???? ? 3 ???? ???? ? ?????????? ???? ;) ??? ?? ???, ??????? ???????????? ?????????? ????????????. From doka.ua at gmail.com Fri Dec 21 09:38:30 2018 From: doka.ua at gmail.com (Volodymyr Litovka) Date: Fri, 21 Dec 2018 09:38:30 +0200 Subject: [uanog] =?utf-8?b?VkxBTiDQsiBVQS1JWCDRgdC+0LfQtNCw0Y7RgtGB0Y8g?= =?utf-8?b?0LDQstGC0L7QvNCw0YLQuNGH0LXRgdC60Lg=?= In-Reply-To: <684a4632-cac3-3f5e-5b88-47b756726de5@netassist.kiev.ua> References: <684a4632-cac3-3f5e-5b88-47b756726de5@netassist.kiev.ua> Message-ID: ????? ?????? ????????. On 12/20/18 8:46 PM, Max Tulyev wrote: > ?????? ????! > > ????? ??? ??? ?? ?????: UA-IX ??? ????? ?????????? ???? ?????? ???????? > ?????????? VLAN ? ????????? ?????????????? ??????, ??? ??????? ????????. > > ???????? ???????? ????? VLAN ?? ????????? ? ? ?????? ????????? ???? > VLAN, ?????? ???????? ???????????? - ????? ?????? ????????????? > ???????????? ? ????????? ? ???? ?????? ???????? ????? ???? ?????. ??? > ???????? ???? ? 3 ???? ???? ? ?????????? ???? ;) > > ??? ?? ???, ??????? ???????????? ?????????? ????????????. > > _______________________________________________ > uanog mailing list > uanog at uanog.kiev.ua > https://mailman.uanog.kiev.ua/mailman/listinfo/uanog -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison From basil at vpm.net.ua Fri Dec 21 23:33:14 2018 From: basil at vpm.net.ua (Vasiliy P. Melnik) Date: Fri, 21 Dec 2018 23:33:14 +0200 Subject: [uanog] =?utf-8?b?c3RhY2sg0LjQtyDRgNCw0LfQvdGL0YUg0LLQtdGA0YE=?= =?utf-8?b?0LjQuQ==?= Message-ID: ?? ???? ????? ??????????????? ??????, ? ????????? ????????? ?? ?????? ????? ?? ????? ???????. ????: Switch Ports Model SW Version SW Image ------ ----- ----- ---------- ---------- * 1 52 WS-C3750G-48PS 12.2(55)SE12 C3750-IPBASEK9-M 2 12 WS-C3750G-12S 12.2(55)SE12 C3750-IPBASEK9-M ????? ? WS-C3750G-48PS ?????? c3750-ipbasek9-mz.150-2.SE11.bin, ? ? WS-C3750G-12S ???????? c3750-ipbasek9-mz.122-55.SE12.bin ? -------------- next part -------------- An HTML attachment was scrubbed... URL: From doka.ua at gmail.com Sat Dec 22 09:15:35 2018 From: doka.ua at gmail.com (Volodymyr Litovka) Date: Sat, 22 Dec 2018 09:15:35 +0200 Subject: [uanog] =?utf-8?b?c3RhY2sg0LjQtyDRgNCw0LfQvdGL0YUg0LLQtdGA0YE=?= =?utf-8?b?0LjQuQ==?= In-Reply-To: References: Message-ID: ????????? ??????? ?? ????, ??? ? ? ??? ?? ?????. On Fri, Dec 21, 2018, 23:33 Vasiliy P. Melnik ?? ???? ????? ??????????????? ??????, ? ????????? ????????? ?? ?????? > ????? ?? ????? ???????. > > ????: > Switch Ports Model SW Version SW Image > > ------ ----- ----- ---------- ---------- > > * 1 52 WS-C3750G-48PS 12.2(55)SE12 C3750-IPBASEK9-M > > 2 12 WS-C3750G-12S 12.2(55)SE12 C3750-IPBASEK9-M > > ????? ? WS-C3750G-48PS ?????? c3750-ipbasek9-mz.150-2.SE11.bin, ? ? > WS-C3750G-12S ???????? c3750-ipbasek9-mz.122-55.SE12.bin ? > _______________________________________________ > uanog mailing list > uanog at uanog.kiev.ua > https://mailman.uanog.kiev.ua/mailman/listinfo/uanog -------------- next part -------------- An HTML attachment was scrubbed... URL: From basil at vpm.net.ua Sat Dec 22 09:51:48 2018 From: basil at vpm.net.ua (Vasiliy P. Melnik) Date: Sat, 22 Dec 2018 09:51:48 +0200 Subject: [uanog] =?utf-8?b?c3RhY2sg0LjQtyDRgNCw0LfQvdGL0YUg0LLQtdGA0YE=?= =?utf-8?b?0LjQuQ==?= In-Reply-To: References: Message-ID: > 22 ???. 2018 ?., ? 09:15, Volodymyr Litovka ???????(?): > > ????????? ??????? ?? ????, ??? ? ? ??? ?? ?????. > ??????? ? ????????? :) ?????? ??????? ? ???-???????? ??????????? ??? ?????? ? ??????? - ??? ?? ???????? ??????, ????? ???? ??????? ?????? ???????? ?? ????? ?? ?? ??????? ??????? ??? ??????? >> On Fri, Dec 21, 2018, 23:33 Vasiliy P. Melnik > ?? ???? ????? ??????????????? ??????, ? ????????? ????????? ?? ?????? ????? ?? ????? ???????. >> >> ????: >> Switch Ports Model SW Version SW Image >> ------ ----- ----- ---------- ---------- >> * 1 52 WS-C3750G-48PS 12.2(55)SE12 C3750-IPBASEK9-M >> 2 12 WS-C3750G-12S 12.2(55)SE12 C3750-IPBASEK9-M >> >> ????? ? WS-C3750G-48PS ?????? c3750-ipbasek9-mz.150-2.SE11.bin, ? ? WS-C3750G-12S ???????? c3750-ipbasek9-mz.122-55.SE12.bin ? >> _______________________________________________ >> uanog mailing list >> uanog at uanog.kiev.ua >> https://mailman.uanog.kiev.ua/mailman/listinfo/uanog -------------- next part -------------- An HTML attachment was scrubbed... URL: From violent at death.kiev.ua Sat Dec 22 11:45:31 2018 From: violent at death.kiev.ua (Igor Grabin) Date: Sat, 22 Dec 2018 11:45:31 +0200 Subject: [uanog] =?koi8-r?b?c3RhY2sgydog0sHaztnIINfF0tPJyg==?= In-Reply-To: References: Message-ID: <20181222094531.GE4259@death.kiev.ua> On Sat, Dec 22, 2018 at 09:51:48AM +0200, Vasiliy P. Melnik wrote: > > ????????? ??????? ?? ????, ??? ? ? ??? ?? ?????. > ??????? ? ????????? :) 99% ??? ?? ???????. ? ???? ????? ?? ?????????? ? ??? ??????? ????????? ? ??????. mbr, -- Igor "CacoDem0n" Grabin From doka.ua at gmail.com Sat Dec 22 15:46:20 2018 From: doka.ua at gmail.com (Volodymyr Litovka) Date: Sat, 22 Dec 2018 15:46:20 +0200 Subject: [uanog] =?utf-8?b?c3RhY2sg0LjQtyDRgNCw0LfQvdGL0YUg0LLQtdGA0YE=?= =?utf-8?b?0LjQuQ==?= In-Reply-To: References: Message-ID: ???? ???????, ?? ???? ?? ????? ??????????? ? ?????????, ?? ????????? ?????? ? ssh ????? ????????? ? ?????? :-)) On Sat, Dec 22, 2018, 09:51 Vasiliy P. Melnik > > 22 ???. 2018 ?., ? 09:15, Volodymyr Litovka > ???????(?): > > ????????? ??????? ?? ????, ??? ? ? ??? ?? ?????. > > > > ??????? ? ????????? :) > > ?????? ??????? ? ???-???????? ??????????? ??? ?????? ? ??????? - ??? ?? > ???????? ??????, ????? ???? ??????? ?????? ???????? ?? ????? ?? ?? ??????? > ??????? ??? ??????? > > On Fri, Dec 21, 2018, 23:33 Vasiliy P. Melnik >> ?? ???? ????? ??????????????? ??????, ? ????????? ????????? ?? ?????? >> ????? ?? ????? ???????. >> >> ????: >> Switch Ports Model SW Version SW Image >> >> ------ ----- ----- ---------- ---------- >> >> * 1 52 WS-C3750G-48PS 12.2(55)SE12 C3750-IPBASEK9-M >> >> 2 12 WS-C3750G-12S 12.2(55)SE12 C3750-IPBASEK9-M >> >> ????? ? WS-C3750G-48PS ?????? c3750-ipbasek9-mz.150-2.SE11.bin, ? ? >> WS-C3750G-12S ???????? c3750-ipbasek9-mz.122-55.SE12.bin ? >> _______________________________________________ >> uanog mailing list >> uanog at uanog.kiev.ua >> https://mailman.uanog.kiev.ua/mailman/listinfo/uanog > > -------------- next part -------------- An HTML attachment was scrubbed... URL: From basil at vpm.net.ua Sat Dec 22 19:20:22 2018 From: basil at vpm.net.ua (Vasiliy P. Melnik) Date: Sat, 22 Dec 2018 19:20:22 +0200 Subject: [uanog] =?utf-8?b?c3RhY2sg0LjQtyDRgNCw0LfQvdGL0YUg0LLQtdGA0YE=?= =?utf-8?b?0LjQuQ==?= In-Reply-To: References: Message-ID: ?? ? ???????? ??? ? ?????, ??????? ? ?? ????? ????? ? ??????. ??? ? ???? ??? ????????????, ????? ?????? ?? ???????? - ?????? ??? ? ???????????, ?????? ?? ?????? ??????? ??? ?????. ?? ????? ?????????? ????? ????? ?????? ????? ?? ??????? ? ??????????? ???????. ???? ???????, ?????? ????????. ??, 22 ???. 2018 ?. ? 15:46, Volodymyr Litovka : > ???? ???????, ?? ???? ?? ????? ??????????? ? ?????????, ?? ????????? > ?????? ? ssh ????? ????????? ? ?????? :-)) > > On Sat, Dec 22, 2018, 09:51 Vasiliy P. Melnik >> >> >> 22 ???. 2018 ?., ? 09:15, Volodymyr Litovka >> ???????(?): >> >> ????????? ??????? ?? ????, ??? ? ? ??? ?? ?????. >> >> >> >> ??????? ? ????????? :) >> >> ?????? ??????? ? ???-???????? ??????????? ??? ?????? ? ??????? - ??? ?? >> ???????? ??????, ????? ???? ??????? ?????? ???????? ?? ????? ?? ?? ??????? >> ??????? ??? ??????? >> >> On Fri, Dec 21, 2018, 23:33 Vasiliy P. Melnik > >>> ?? ???? ????? ??????????????? ??????, ? ????????? ????????? ?? ?????? >>> ????? ?? ????? ???????. >>> >>> ????: >>> Switch Ports Model SW Version SW Image >>> >>> ------ ----- ----- ---------- ---------- >>> >>> * 1 52 WS-C3750G-48PS 12.2(55)SE12 C3750-IPBASEK9-M >>> >>> 2 12 WS-C3750G-12S 12.2(55)SE12 C3750-IPBASEK9-M >>> >>> >>> ????? ? WS-C3750G-48PS ?????? c3750-ipbasek9-mz.150-2.SE11.bin, ? ? >>> WS-C3750G-12S ???????? c3750-ipbasek9-mz.122-55.SE12.bin ? >>> _______________________________________________ >>> uanog mailing list >>> uanog at uanog.kiev.ua >>> https://mailman.uanog.kiev.ua/mailman/listinfo/uanog >> >> -------------- next part -------------- An HTML attachment was scrubbed... URL: