Cloud Hosted Routerの設定を行う(2)
こんにちは。あやかです。
今回は、検証環境の構成に合わせてCHRの設定を行っていきたいと思います。
1.PPPoE Clientの設定
今回の検証環境ではCHRをPPPoE Clientとして使用します。
そのため、PPPoE Client Interfaceの追加を行います。
|
1 2 3 4 5 6 7 8 9 10 11 12 |
[ayaka@CORERB01] > /interface pppoe-client add name=pppoe-out_plala interface=ether1 user=xxxxx@plala.or.jp password=xxxxxxxx use-peer-dns=yes add-default-route=yes default-route-distance=1 keepalive-timeout=10 disabled=no [ayaka@CORERB01] > /interface pppoe-client print Flags: X - disabled, I - invalid, R - running 0 R name="pppoe-out_plala" max-mtu=auto max-mru=auto mrru=disabled interface=ether1 user="[email protected]" password="xxxxxxxx" profile=default keepalive-timeout=10 service-name="" ac-name="" add-default-route=yes default-route-distance=1 dial-on-demand=no use-peer-dns=yes allow=pap,chap,mschap1,mschap2 [ayaka@CORERB01] > [ayaka@CORERB01] > /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 192.168.1.161/24 192.168.1.0 ether1 1 D 114.xxx.xxx.152/32 125.xxx.xxx.129 pppoe-plala1 [ayaka@CORERB01] > |
2.Firewallの設定
初期構築時点でのFirewallの設定を行います。
ルールについては、みなさまの環境に合わせて適宜見直してください。
このルールのポイントは以下の3点です。
・PPPoE ClientのInterface Nameが運用中に変更になる可能性を考慮してInterface Listを使用していること。
・Address Listを利用してまとめられるルールをまとめていること。
・establishedとrelatedにfasttrackを適用していること。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 |
[ayaka@CORERB01] > /interface list add comment="PPPoE client" name=pppoe-out-all [ayaka@CORERB01] > /interface list member add interface=pppoe-out_plala list=pppoe-out-all [ayaka@CORERB01] > [ayaka@CORERB01] > /ip firewall address-list add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=224.0.0.0/4 comment=Multicast list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=not_in_internet [ayaka@CORERB01] > /ip firewall address-list add address=[お行儀の悪いIPアドレス] list=deny_from_accsess [ayaka@CORERB01] > [ayaka@CORERB01] > /ip firewall filter add action=fasttrack-connection chain=forward comment="Established, Related(fasttrack)" connection-state=established,related [ayaka@CORERB01] > /ip firewall filter add action=drop chain=input comment="Deny aggressive communications" src-address-list=deny_from_accsess [ayaka@CORERB01] > /ip firewall filter add action=accept chain=forward comment="Established, Related" connection-state=established,related [ayaka@CORERB01] > /ip firewall filter add action=accept chain=input comment="Established, Related" connection-state=established,related [ayaka@CORERB01] > /ip firewall filter add action=drop chain=forward comment=Invalid connection-state=invalid [ayaka@CORERB01] > /ip firewall filter add action=accept chain=input comment="accept ICMP" in-interface-list=pppoe-out-all protocol=icmp [ayaka@CORERB01] > /ip firewall filter add action=drop chain=forward comment="Drop incoming from internet which is not public IP" in-interface-list=pppoe-out-all src-address-list=not_in_internet [ayaka@CORERB01] > /ip firewall filter add action=drop chain=input comment="all drop from internet" in-interface-list=pppoe-out-all [ayaka@CORERB01] > |
3.VRRPの有効化
今回の検証環境では、CORERB01/02のルーター2台構成としています。
CHRにはルーターの冗長化方式としてVRRPが搭載されていますので、それを利用します。
RouteOSでVRRPを有効化するには、各物理Interfaeに対応するVRRP Interfaceを追加して共有IPアドレスを付与します。
CORERB01をActiveとしたいためVRRPのPriorityを200としました。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
[ayaka@CORERB01] > /interface vrrp add interface=ether2 name=vrrp_ether2 priority=200 vrid=2 [ayaka@CORERB01] > /interface vrrp add interface=ether3 name=vrrp_ether3 priority=200 vrid=3 [ayaka@CORERB01] > /interface vrrp add interface=ether4 name=vrrp_ether4 priority=200 vrid=4 [ayaka@CORERB01] > /interface vrrp add interface=ether5 name=vrrp_ether5 priority=200 vrid=5 [ayaka@CORERB01] > [ayaka@CORERB01] > /ip address add address=192.168.2.254/24 interface=vrrp_ether2 network=192.168.2.0 [ayaka@CORERB01] > /ip address add address=172.16.10.254/24 interface=vrrp_ether3 network=172.16.10.0 [ayaka@CORERB01] > /ip address add address=172.16.20.254/24 interface=vrrp_ether4 network=172.16.20.0 [ayaka@CORERB01] > /ip address add address=172.16.30.254/24 interface=vrrp_ether5 network=172.16.30.0 [ayaka@CORERB01] > /ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 192.168.1.161/24 192.168.1.0 ether1 1 192.168.2.253/24 192.168.2.0 ether2 2 172.16.10.253/24 172.16.10.0 ether3 3 172.16.20.253/24 172.16.20.0 ether4 4 172.16.30.253/24 172.16.30.0 ether5 5 D 114.xxx.xxx.94/32 125.xxx.xxx.129 pppoe-out_plala 6 192.168.2.254/24 192.168.2.0 vrrp_ether2 7 172.16.10.254/24 172.16.10.0 vrrp_ether3 8 172.16.20.254/24 172.16.20.0 vrrp_ether4 9 172.16.30.254/24 172.16.30.0 vrrp_ether5 [ayaka@CORERB01] > |
CORERB02側は次の設定を投入しました。
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
[ayaka@CORERB02] > /interface vrrp add interface=ether2 name=vrrp_ether2 vrid=2 [ayaka@CORERB02] > /interface vrrp add interface=ether3 name=vrrp_ether3 vrid=3 [ayaka@CORERB02] > /interface vrrp add interface=ether4 name=vrrp_ether4 vrid=4 [ayaka@CORERB02] > /interface vrrp add interface=ether5 name=vrrp_ether5 vrid=5 [ayaka@CORERB02] > [ayaka@CORERB02] > /ip address add address=192.168.1.162/24 interface=ether1 network=192.168.1.0 [ayaka@CORERB02] > /ip address add address=192.168.2.252/24 interface=ether2 network=192.168.2.0 [ayaka@CORERB02] > /ip address add address=172.16.10.252/24 interface=ether3 network=172.16.10.0 [ayaka@CORERB02] > /ip address add address=172.16.20.252/24 interface=ether4 network=172.16.20.0 [ayaka@CORERB02] > /ip address add address=172.16.30.252/24 interface=ether5 network=172.16.30.0 [ayaka@CORERB02] > /ip address add address=192.168.2.254/24 interface=vrrp_ether2 network=192.168.2.0 [ayaka@CORERB02] > /ip address add address=172.16.10.254/24 interface=vrrp_ether3 network=172.16.10.0 [ayaka@CORERB02] > /ip address add address=172.16.20.254/24 interface=vrrp_ether4 network=172.16.20.0 [ayaka@CORERB02] > /ip address add address=172.16.30.254/24 interface=vrrp_ether5 network=172.16.30.0 [ayaka@CORERB02] > |
しかし、ここでちょっとハマったことが。うまくVRRPが動いてくれません。
ESXiの仮想スイッチで無差別モードを構成していないことが原因でした。
無差別モードを許可したところ、以下の通りVRRPが動き出しました。
|
1 2 3 4 5 6 7 8 |
[ayaka@CORERB01] > /interface vrrp print Flags: X - disabled, I - invalid, R - running, M - master, B - backup # NAME INTERFACE MAC-ADDRESS VRID PRIORITY INTERVAL VERSION V3-PROTOCOL 0 RM vrrp_ether2 ether2 00:00:5E:00:01:02 2 100 1s 3 ipv4 1 RM vrrp_ether3 ether3 00:00:5E:00:01:03 3 100 1s 3 ipv4 2 RM vrrp_ether4 ether4 00:00:5E:00:01:04 4 100 1s 3 ipv4 3 RM vrrp_ether5 ether5 00:00:5E:00:01:05 5 100 1s 3 ipv4 [ayaka@CORERB01] > |
4.IP Masquerade(NAPT)の有効化
特定のセグメントからインターネットへ向けての通信に対してIP Masqueradeを適用します。
|
1 2 3 |
[ayaka@CORERB01] > /ip firewall nat add action=masquerade chain=srcnat out-interface-list=pppoe-out-all src-address=192.168.64.0/24 [ayaka@CORERB01] > /ip firewall nat add action=masquerade chain=srcnat out-interface-list=pppoe-out-all src-address=172.16.30.0/24 [ayaka@CORERB01] > |
5.Port Forwardの有効化
DMZ Networkの先にSSTPを受け付けるルーターがいるため、必要なポートをそちらにForwardするように設定します。
|
1 2 |
[ayaka@CORERB01] > /ip firewall nat add action=dst-nat chain=dstnat dst-port=20443 in-interface-list=pppoe-out-all protocol=tcp to-addresses=192.168.2.1 to-ports=20443 [ayaka@CORERB01] > |
以上で今の時点で必要な設定はおわりました。
今後は構築の都度、必要な設定を行っていきたいと思います。
