internet restriction from time A till time B

petrushka · August 1, 2010, 9:32pm

Can you advice please in how-to realize the time restriction on MTA. I have an NTP time server and Client, address list, predefined rule in firewall (which allows only internal ftp and homepage conection). I need to enable at 18:00 and disable at 08:00 this rule in scheduler, to restrict access outside the router by time.

fewi · August 2, 2010, 3:14pm

That kind of depends on the firewall rule you have (are you whitelisting or blacklisting traffic?)

Here a general approach. First we accept all already established and related traffic, then we accept all traffic going out to the WAN, then we drop traffic from the WAN to FTP and HTTP ports (tcp/20,21,80) between 8am and 6pm, then we permit traffic on those ports (between 6pm and 8am the rule above won’t match, so now it is permitted), then we drop all other traffic initiated from the WAN:

/ip firewall filter
add chain=forward connection-state=established action=accept
add chain=forward connection-state=related action=accept
add chain=forward in-interface=LAN out-interface=WAN action=accept
add chain=forward in-interface=WAN protocol=tcp dst-ports=20,21,80 time=8h-18h,sun,mon,tue,wed,thu,fri,sat action=drop
add chain=forward in-interface=WAN protocol=tcp dst-ports=20,21,80 action=accept
add chain=forward in-interface=WAN action=drop

petrushka · August 2, 2010, 4:42pm

Web page and FTP is internal address space. So as I understand, to filter traffic only for users in adress list I need to do :

/ip firewall address-list add address=10.10.10.x list=time_restricted - Users whom need to be restricted
/ip firewall address-list add address=10.10.10.x1 list=local-addr - simple users, whom has all access

/ip firewall filter
add action=accept chain=forward comment=“Allow traffic forward”
disabled=no in-interface=LAN1 out-interface=Public
add action=accept chain=forward comment=“Allow traffic forward”
disabled=no in-interface=LAN2 out-interface=Public
add action=accept chain=forward comment=“Allow traffic forward”
disabled=no in-interface=LAN3 out-interface=Public

After those I put rules

add action=drop chain=forward comment=time_restricted_drop disabled=no in-interface=Public
src-address-list=!local-addr
add action=accept chain=forward disabled=no in-interface=Public
src-address-list=time_restricted time=8h-22h,sun,mon,tue,wed,thu,fri,sat

I’am right ?

fewi · August 2, 2010, 4:47pm

I guess I completely misunderstood you.

To summarize: you have three LAN interfaces (LAN1, LAN2, LAN3) and a WAN interface (Public). You also have two address lists: one for all legitimate users on your network that should have Internet access at all times, and one for children that are only to be granted Internet access between 8am and 10pm on all days of the week. It is OK for all users on LAN1 to have access to all users on LAN2 at all times.

Is that correct?

petrushka · August 2, 2010, 4:51pm

Yes you right, all local services are permitted to time_restricted users.
I allready have a rules :

add action=accept chain=forward comment=“Allow traffic between clients”
disabled=no in-interface=LAN1 out-interface=LAN1
add action=accept chain=forward comment=“Allow traffic between clients”
disabled=no in-interface=LAN2 out-interface=LAN2
add action=accept chain=forward comment=“Allow traffic between clients”
disabled=no in-interface=LAN3 out-interface=LAN3

fewi · August 2, 2010, 4:57pm

Tto block users on the time_restricted address list from going to the Internet between 10pm and 8am, just add the following at the top of the forward chain:

/ip firewall filter add action=accept chain=forward disabled=no src-address-list=time_restricted time=8h-22h,sun,mon,tue,wed,thu,fri,sat out-interface=Public
/ip firewall filter add action=drop chain=forward src-address-list=time_restricted out-interface=Public

petrushka · August 2, 2010, 5:11pm

It is so logic ! Thank you for help !
Also I have a 3 DHCP subnets on LAN1 LAN2 LAN3, working with arp reply only, how can I redirect all other users, who have a problems, or not have a static entry - to my web page local?

I need to create 3-rd address list which contains all exepted adresses
mark them with mangle (example new packet mark zombies)
and redirect ? How ?

fewi · August 2, 2010, 5:21pm

If your router interfaces are in reply-only ARP mode the router can’t talk back to clients that don’t have a static ARP entry on the router, so you cannot redirect them anywhere.

petrushka · August 2, 2010, 5:28pm

hmm, so I need to pass them thrue, add to list “specified” for looking homepage, and do 1-2-3-steps ? I’m sory for the stupid questions, alittle can’t understand the policy (as I think it is inverted than in linux iptables )

fewi · August 2, 2010, 5:30pm

Sorry, I don’t understand that comment.

Dealing with anyone that isn’t added statically to the ARP table either directly or by the DHCP server is impossible on an interface set to ‘reply-only’ for ARP. There is no workaround for that, other than setting the ARP mode to dynamic.

petrushka · August 2, 2010, 5:35pm

“to pass them thrue” I mean, just as you say - dynamic ARP table.

petrushka · August 2, 2010, 9:50pm

anyway Thank you ! Tomorrow I will change those ISP MTA’S, I hope Mikrotik will be the best

fewi · August 2, 2010, 9:54pm

If you reset the ARP mode then yes, you could redirect clients.

The DHCP server has an address list option that dynamically adds everyone that has a DHCP lease to an address list. You could redirect everyone that is not on that address list to a web server.

http://wiki.mikrotik.com/wiki/Payment_Reminders

Assuming you’re dynamically (or statically) populating an address list named ‘known_users’, you could use something like this:

/ip firewall nat
add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 src-address-list=!known_users
/ip firewall filter
add chain=forward src-address-list=!known_users protocol=udp dst-port=53 action=accept
add chain=forward dst-address-list=!known_users protocol=udp src-port=53 action=accept
add chain=forward src-address-list=!known_users action=drop
/ip proxy set enabled=yes
/ip proxy access
add action=allow disabled=no dst-address=[IP of server that hosts reminder]
add action=deny disabled=no redirect-to="http://my.server.com/payment-reminder.html"

petrushka · August 3, 2010, 2:31pm

Good day,
All works perfect !!! Thanks for the helping

petrushka · August 10, 2010, 10:15pm

there is another problem, it redirects Also torrents, and different type of traffic most interesting, from outside the router

fewi · August 10, 2010, 10:18pm

Add more parameters to the NAT rule to limit it to traffic you’re interested in redirecting. You could either use src-address=a.b.c.d/n and replace the subnet of your inside network, or you could go by in-interface. That way the other traffic you don’t want to match will not match the rules, and won’t be redirected.

If you’re just interested in all traffic coming in from the outside not matching, you could also add ‘in-interface=!NAME_OF_WAN_INTERFACE’.

petrushka · August 10, 2010, 10:31pm

Now chain contains : I will check it !

chain=dstnat action=redirect to-ports=8080 protocol=tcp
src-address-list=!known_users in-interface=!public dst-port=80
connection-mark=http

But I think I need to restrict forward rules, I don’t need to traffic comes from outside Public. In access log on webserver I see connections directly from my gateway (PUB interface), it means that packets are dstnatted ?!

Thanks !

fewi · August 10, 2010, 10:39pm

Can you show examples of the logs and post all your NAT and filter rules?

petrushka · August 10, 2010, 10:47pm

/ip firewall filter
add action=accept chain=input comment=“Allow limited pings” disabled=no
limit=50/5s,2 protocol=icmp
add action=log chain=input disabled=yes log-prefix=PINGS protocol=icmp
add action=drop chain=input comment=“Drop excess pings” disabled=no protocol=
icmp
add action=accept chain=input comment=“Accept established connections”
connection-state=established disabled=no
add action=accept chain=input comment=“Accept related connections”
connection-state=related disabled=no
add action=accept chain=input comment=UDP disabled=no protocol=udp
add action=log chain=input connection-state=invalid disabled=no log-prefix=
INVALID
add action=drop chain=input comment=“Drop invalid connections”
connection-state=invalid disabled=no
add action=jump chain=forward comment=
“Drop all traffic that goes to multicast or broadcast addresses”
disabled=no dst-address-type=broadcast,multicast jump-target=drop
add action=jump chain=forward comment=
“Drop all traffic that comes from multicast or broadcast addresses”
disabled=no jump-target=drop src-address-type=broadcast,multicast
add action=jump chain=forward comment=“Drop potential scanners” disabled=no
jump-target=drop protocol=tcp src-address-list=blocked-addr
add action=jump chain=forward comment=“Deny illegal NAT traversal” disabled=
no jump-target=drop packet-mark=nat-traversal
add action=jump chain=forward comment=“Drop illegal destination addresses”
disabled=no dst-address-list=BOGONS dst-address-type=!local in-interface=
ether2 jump-target=drop
add action=jump chain=forward comment=“Drop illegal destination addresses”
disabled=no dst-address-list=BOGONS dst-address-type=!local in-interface=
ether3 jump-target=drop
add action=jump chain=forward comment=“Drop illegal destination addresses”
disabled=no dst-address-list=BOGONS dst-address-type=!local in-interface=
ether4 jump-target=drop
add action=jump chain=forward comment=“Drop illegal source addresses”
disabled=no in-interface=Public jump-target=drop src-address-list=BOGONS
add action=jump chain=forward comment=“Known virus ports DELETE” disabled=no
jump-target=known_viruses
add action=add-src-to-address-list address-list=blocked-addr
address-list-timeout=1d chain=forward comment=“Block port scans check to s
ee if this is too agressive and blocks legit hosts” disabled=yes
protocol=tcp psd=20,3s,3,1
add action=add-src-to-address-list address-list=blocked-addr
address-list-timeout=1d chain=forward comment=“Block TCP Null scan”
disabled=no protocol=tcp tcp-flags=fin,psh,urg,!syn,!rst,!ack
add action=add-src-to-address-list address-list=blocked-addr
address-list-timeout=1d chain=forward comment=“Block TCP Xmas scan”
disabled=no protocol=tcp tcp-flags=!fin,!syn,!rst,!psh,!ack,!urg
add action=jump chain=forward comment=“Drop TCP RST” disabled=no jump-target=
drop protocol=tcp tcp-flags=rst
add action=jump chain=forward comment=“Drop TCP SYN+FIN” disabled=no
jump-target=drop protocol=tcp tcp-flags=fin,syn
add action=log chain=forward comment=“Invalid connections” connection-state=
invalid disabled=yes log-prefix=Invalid
add action=jump chain=forward comment=“Dropping invalid connections at once”
connection-state=invalid disabled=no jump-target=drop
add action=accept chain=forward comment=“Vremennoy kontinuum 8:00-22:00”
disabled=no out-interface=Public src-address-list=time_restricted time=
8h-22h,sun,mon,tue,wed,thu,fri,sat
add action=drop chain=forward disabled=no out-interface=Public
src-address-list=time_restricted
add action=accept chain=forward comment=
“Accepting already established connections” connection-state=established
disabled=no src-address-list=known_users
add action=accept chain=forward comment=“Also accepting related connections”
connection-state=related disabled=no src-address-list=known_users
add action=accept chain=forward disabled=yes dst-port=53 protocol=udp
src-address-list=known_users
add action=accept chain=forward disabled=yes dst-address-list=known_users
protocol=udp src-port=53
add action=accept chain=forward comment=“1-e redirect” disabled=no
out-interface=Public src-address-list=known_users
add action=drop chain=forward disabled=no out-interface=Public
src-address-list=!known_users
add action=accept chain=forward comment=“Allow All” disabled=no
src-address-list=known_users
add action=drop chain=known_viruses comment=“windows - not EXACTLY a virus”
disabled=no dst-port=135-139 protocol=tcp
add action=drop chain=known_viruses comment=“windows - not EXACTLY a virus”
disabled=no dst-port=135-139 protocol=udp
add action=drop chain=known_viruses comment=
“winXP netbios not EXACTLY a virus” disabled=no dst-port=445 protocol=udp
add action=drop chain=known_viruses comment=
“winXP netbios not EXACTLY a virus” disabled=no dst-port=445 protocol=tcp
add action=drop chain=known_viruses comment=“msblast worm” disabled=no
dst-port=593 protocol=tcp
add action=drop chain=known_viruses comment=“msblast worm” disabled=no
dst-port=4444 protocol=tcp
add action=drop chain=known_viruses comment=“WITTY worm” disabled=no
dst-port=4000 protocol=tcp
add action=drop chain=known_viruses comment=“SoBig.f worm” disabled=no
dst-port=995-999 protocol=tcp
add action=drop chain=known_viruses comment=“SoBig.f worm” disabled=no
dst-port=8998 protocol=tcp
add action=drop chain=known_viruses comment=“beagle worm” disabled=no
dst-port=2745 protocol=tcp
add action=drop chain=known_viruses comment=“beagle worm” disabled=no
dst-port=4751 protocol=tcp
add action=drop chain=known_viruses comment=“SQL Slammer” disabled=no
dst-port=1434 protocol=tcp
add action=log chain=drop comment=“Log Everything that we drop” disabled=yes
log-prefix=“”
add action=drop chain=drop disabled=no

This rule was edited, just now, as you adwise. Now I checking logs.
/ip firewall nat
add action=redirect chain=dstnat comment=2-redirect connection-mark=http
disabled=no dst-port=80 in-interface=!Public protocol=tcp
src-address-list=!known_users to-ports=8080

access log from WEB:
MY_PUB_IP - - [11/Aug/2010:01:03:55 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:03:57 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:04:07 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:04:07 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:04:07 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:43:48 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”

petrushka · August 10, 2010, 10:56pm

now it still

MY_PUB_IP- - [11/Aug/2010:01:46:37 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP - - [11/Aug/2010:01:46:34 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP- - [11/Aug/2010:01:46:35 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP- - [11/Aug/2010:01:46:34 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP- - [11/Aug/2010:01:46:33 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”
MY_PUB_IP- - [11/Aug/2010:01:46:39 +0300] “GET /lv_LV/reminder.html HTTP/1.1” 200 12771 “-” “uTorrent/2020(19648)”