Bonjour,
j'avais un EdgeRouter pour remplacer ma box, configuré avec le support de ce forum (merci !), mais j'ai eu peur de ce post
https://lafibre.info/remplacer-livebox/durcissement-du-controle-de-loption-9011-et-de-la-conformite-protocolaire/ et donc j'ai mis une Livebox 5 à la place...
Le problème est que la fonction DNS est boguée et que la Livebox perd régulièrement des serveurs
Je voudrais donc remettre mon EdgeRouter derrière ma Livebox pour gérer mon réseau et laisser ma box avec des paramètres le plus basiques possible.
Les fonctions que je voudrais que le EdgeRouter assure sont: IP statique / Mapping ; DHCP, accès à internet ! et aussi du Port forwarding pour pouvoir accéder à mes sites web (2!) depuis internet.
J'ai fait une config avec un wizard et quelques modif, mais j'ai quelques problèmes : mon EdgeRouter n'est pas visible du réseau de la Livebox et surtout le site web du réseau du EdgeRouter n'est pas accessible d'internet: il ne "passe" pas à travers la Livebox!
Ma config
firewall {
all-ping enable
broadcast-ping disable
ipv6-name WANv6_IN {
default-action drop
description "WAN inbound traffic forwarded to LAN"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
ipv6-name WANv6_LOCAL {
default-action drop
description "WAN inbound traffic to the router"
enable-default-log
rule 10 {
action accept
description "Allow established/related sessions"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
rule 30 {
action accept
description "Allow IPv6 icmp"
protocol ipv6-icmp
}
rule 40 {
action accept
description "allow dhcpv6"
destination {
port 546
}
protocol udp
source {
port 547
}
}
}
ipv6-name WANv6_OUT {
default-action accept
description "Wanv6 outbound traffic"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action reject
description "Reject invalid state"
state {
invalid enable
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name WAN_IN {
default-action drop
description "WAN to internal"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_LOCAL {
default-action drop
description "WAN to router"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action drop
description "Drop invalid state"
state {
invalid enable
}
}
}
name WAN_OUT {
default-action accept
description "WAN outbound traffic"
rule 10 {
action accept
description "Allow established/related"
state {
established enable
related enable
}
}
rule 20 {
action reject
description "Reject invalid state"
state {
invalid enable
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
}
interfaces {
ethernet eth0 {
address dhcp
description livebox
duplex auto
firewall {
in {
ipv6-name WANv6_IN
name WAN_IN
}
local {
ipv6-name WANv6_LOCAL
name WAN_LOCAL
}
out {
ipv6-name WANv6_OUT
name WAN_OUT
}
}
speed auto
}
ethernet eth1 {
description Local
duplex auto
speed auto
}
ethernet eth2 {
description Local
duplex auto
speed auto
}
ethernet eth3 {
description Local
duplex auto
speed auto
}
ethernet eth4 {
description Local
duplex auto
poe {
output off
}
speed auto
}
loopback lo {
}
switch switch0 {
address 192.168.8.1/24
description Local
mtu 1500
switch-port {
interface eth1 {
}
interface eth2 {
}
interface eth3 {
}
interface eth4 {
}
vlan-aware disable
}
}
}
port-forward {
auto-firewall enable
hairpin-nat enable
lan-interface switch0
rule 1 {
description hestia2
forward-to {
address 192.168.8.101
port 8080
}
original-port 700
protocol tcp_udp
}
wan-interface eth0
}
protocols {
igmp-proxy {
interface eth0 {
alt-subnet 0.0.0.0/0
role upstream
threshold 1
}
interface switch0 {
role downstream
threshold 1
}
}
}
service {
dhcp-server {
disabled false
hostfile-update enable
shared-network-name LAN {
authoritative enable
subnet 192.168.8.0/24 {
default-router 192.168.8.1
dns-server 192.168.8.1
domain-name home
lease 86400
start 192.168.8.38 {
stop 192.168.8.243
}
static-mapping hestia2 {
ip-address 192.168.8.101
mac-address b8:27:eb:1a:ad:65
}
}
}
static-arp disable
use-dnsmasq disable
}
dns {
forwarding {
cache-size 200
listen-on switch0
}
}
gui {
http-port 80
https-port 443
older-ciphers enable
}
nat {
rule 5010 {
description "masquerade for WAN"
outbound-interface eth0
type masquerade
}
}
ssh {
port 22
protocol-version v2
}
unms {
disable
}
}
system {
analytics-handler {
send-analytics-report false
}
crash-handler {
send-crash-report false
}
host-name ERX
login {
user ubnt {
authentication {
encrypted-password $5$.q6iVhnInicX4qye$vF/FAtgxtZh5BF3uazyEUgXF6g4AhUHfQxOPvi1VCR.
}
level admin
}
}
ntp {
server 0.ubnt.pool.ntp.org {
}
server 1.ubnt.pool.ntp.org {
}
server 2.ubnt.pool.ntp.org {
}
server 3.ubnt.pool.ntp.org {
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone Europe/Paris
}
/* Warning: Do not remove the following line. */
/* === vyatta-config-version: "config-management@1:conntrack@1:cron@1:dhcp-relay@1:dhcp-server@4:firewall@5:ipsec@5:nat@3:qos@1:quagga@2:suspend@1:system@5:ubnt-l2tp@1:ubnt-pptp@1:ubnt-udapi-server@1:ubnt-unms@2:ubnt-util@1:vrrp@1:vyatta-netflow@1:webgui@1:webproxy@1:zone-policy@1" === */
/* Release version: v2.0.9-hotfix.7.5622731.230615.0857 */
et la log
Oct 19 10:05:42 ERX dhcpd3: WARNING: Host declarations are global. They are not limited to the scope you declared them in.
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for eth4 (no IPv4 addresses).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on eth4. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface eth4 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for eth3 (no IPv4 addresses).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on eth3. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface eth3 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for eth2 (no IPv4 addresses).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on eth2. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface eth2 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for eth1 (no IPv4 addresses).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on eth1. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface eth1 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for eth0 (192.168.9.100).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on eth0. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface eth0 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:42 ERX dhcpd3: No subnet declaration for itf0 (no IPv4 addresses).
Oct 19 10:05:42 ERX dhcpd3: ** Ignoring requests on itf0. If this is not what
Oct 19 10:05:42 ERX dhcpd3: you want, please write a subnet declaration
Oct 19 10:05:42 ERX dhcpd3: in your dhcpd.conf file for the network segment
Oct 19 10:05:42 ERX dhcpd3: to which interface itf0 is attached. **
Oct 19 10:05:42 ERX dhcpd3:
Oct 19 10:05:49 ERX netplugd: Starting network plug daemon: netplugd.
Oct 19 10:05:50 ERX ssh-recovery[739]: terminating the SSH recovery service :: pid=(699)
Oct 19 10:05:56 ERX dhcpd3: data: host_decl_name: not available
Oct 19 10:06:28 ERX dhcpd3: uid lease 192.168.8.39 for client b8:27:eb:1a:ad:65 is duplicate on LAN
Oct 19 10:06:28 ERX dhcpd3: uid lease 192.168.8.39 for client b8:27:eb:1a:ad:65 is duplicate on LANQuestion: cette config est-elle la bonne approche ? et si oui comment la modifier pour obtenir le fonctionnement du Port forwarding?
Merci d'avance pour les conseils
Routeur