Remote networks can be easily bridged using WDS feature of MikroTik RouterOS™. We will show it for the case when the networks are connected through Atheros wireless interface. Using EoIP, this can be extended to any other type of interfaces, like PPTP and CISCO/Aironet. WDS works only on Prism and Atheros based cards.
Let us assume the following network setup:
Follow the steps below to create transparent bridge using WDS:
1. Create a bridge interface on AP and add ether1 interface to the bridge in WinBox
or in console
[admin@AP]> interface bridge add name=wds-bridge
[admin@AP]> interface bridge port add interface=ether1 bridge=wds-bridge
Do the same on the Station, and add ether1, wlan1 interfaces to the bridge in Winbox
or in console
[admin@Station]> interface bridge add name=wds-bridge
[admin@Station]> interface bridge port add interface=ether1 bridge=wds-bridge
[admin@Station]> interface bridge port add interface=wlan1 bridge=wds-bridge
2. Make sure you have communication between MikroTik routers, i.e., one router is configured as server (AP), the other one as client (station). Configure wireless interface wlan1 on AP in WinBox
or in conslole
[admin@AP]> interface wireless set wlan1 ssid=MikroTik frequency=5805 mode=bridge disabled=no
Do the same configuration on Client wireless interface (wlan1) in Winbox
or in console
[admin@Station] interface wireless set wlan1 mode=station-wds ssid=MikroTik disabled=no
3. Create wds interface on AP and add the interface to the bridge in WinBox
or in console
[admin@AP] interface wireless set wlan1 wds-mode=dynamic wds-default-bridge=wds-bridge
4. Check whether the WDS link is established in WinBox
or in console
[admin@AP] interface wireless wds> print
Flags: X - disabled, R - running, D - dynamic
0 RD name="wds1" mtu=1500 mac-address=00:0B:6B:30:B4:A4 arp=enabled
disable-running-check=yes master-interface=wlan1
wds-address=00:0B:6B:35:E5:5C
4. Add IP address on AP in WinBox
or in console
[admin@AP]> ip address add address=10.1.0.215/24 interface=wds-bridge
And on Station:
[admin@Station]> ip address add address=10.1.0.216/24 interface=wds-bridge
5. Test the bridge by pinging from 10.0.0.215 to 10.0.0.216. Note, that the bridge needs 10...30s to learn addresses and start passing through traffic.
NOTE: If not using NAT/MANGLE nor anything doing with conntrack, remember to turn of it at both link ends.
In the console:
[admin@xx]> ip firewall connection tracking set enabled=no
This will help you get the full bandwidth the wireless link can achive freeing the CPU load.
Showing posts with label Mikrotik Router. Show all posts
Showing posts with label Mikrotik Router. Show all posts
Saturday, April 19, 2008
How WMM works
WMM works by dividing traffic into 4 access categories: background, best effort, video, voice. QoS policy (different handling of access categories) is applied on transmitted packets, therefore it is transmitting device is treating different packets differently - that is - e.g. AP does not have control over how clients are transmitting packets, and clients do not have control over how AP transmits packets.
Mikrotik AP and client classifies packets based on priority assigned to them, according to table (as per WMM spec): 1,2 - background 0,3 - best effort 4,5 - video 6,7 - voice
To be able to use multiple WMM access categories, not just best effort where all packets with default priority 0 go, priority must be set for those packets. By default all packets (incoming and locally generated) inside router have priority 0.
"Better" access category for packet does not necessarily mean that it will be sent over the air before all other packets with "worse" access category. WMM works by executing DCF method for medium access with different settings for each access category (EDCF), which basically means that "better" access category has higher probability of getting access to medium - WMM enabled station can be considered to be 4 stations, one per access category, and the ones with "better" access category use settings that make them more likely to get chance to transmit (by using shorter backoff timeouts) when all are contending for medium. Details can be studied in 802.11e and WMM specification
How to set priority
Priority of packets can be set using "set priority" action of ip firewall mangle rules and/or bridge firewall filter rules. Priority can be set to specific value or to "ingress priority". Ingress priority is priority value that was detected on incoming packet, if available. Currently there are 2 sources of ingress priority - priority in VLAN header and priority from WMM packets received over wireless interface. For all other packets ingress priority is 0.
Note that ingress priority value is not automatically copied to priority value, correct rule needs to be set up to do this!
So there are basically 2 ways to control/set priority (remember, that both require setting up correct rule(s)!): - assign priority with rules with particular matchers (protocol, addresses, etc), - set it from ingress priority.
This essentialy means that if it is not possible or wanted to classify packets by rules, configuration of network must be such that router can extract ingress priority from incoming frames. Remember there are currently 2 sources for this - VLAN tag in packets and received WMM packets.
Do not mix priority of queues with priority assigned to packets. Priorities of queues work separately and specify "importance" of queue and has meaning only within particular queue setup. Think of packet priority as of some kind of mark, that gets attached to packet by rules. Also take into account that this mark currently is only used for outgoing packets when going over WMM enabled link, and in case VLAN tagged packet is sent out (no matter if that packet is tagged locally or bridged).
Example
For example, in setup
PPPoE server -> WMM AP -> client,
if AP is just forwarding PPPoE traffic (therefore inspecting encapsulated IP packets to match e.g. by protocol is not possible, as packets can be encrypted and compressed), priority must come to AP from PPPoE server in VLAN tag, so you have to use VLAN (between PPPoE server and AP) for this, just to communicate priority information.
Note that you do not have to forward VLAN encapsulated traffic to client - VLAN can be terminated at AP, VLAN tag is needed only when entering AP.
In case AP is PPPoE server itself, there is no need to use VLAN - priority can be set by rules before it is encapsulated in PPPoE.
Priority from DSCP
Another way of setting priority is by using DSCP field in IP header, this can only be done by firewall mange rule "set priority" action. Note that DSCP in IP header can have values 0-63, but priority only 0-7. Effective priority after set from DSCP value will be 3 low bits of DSCP value which is the same as reminder of division by 8. So for example, priority from DSCP values 0,8,16,etc will be 0, from DSCP values 7,15,...,63 - 7.
Remember that DSCP can only be accessed on IP packets!
Note, that to use this feature, DSCP value in IP header should be set somewhere.
It is best to set DSCP value in IP header of packets on some border router (e.g. main router used for connection to internet), based on traffic type. E.g. set DSCP value for packets coming from internet belonging to sip connections to 7, and 0 for the rest. This way packets must be marked only at one place. Then all APs in network set packet priority from DSCP value with just one rule.
In setup:
- border router - - WMM AP - client
border router sets DSCP value for sip traffic, and WMM AP sets priority from DSCP value. Note that in this setup DSCP is set only for traffic _to_ client. Sometimes it can be useful to set also DSCP on traffic coming _from_ client (e.g. if 2 clients connected to different APs are talking between themselves) - this can be done on APs.
Combining priority setting and handling solutions
Complex networks and different situations can be handled by combining different approaches of carrying priority information to ensure QoS and optimize use of resources, based on "building blocks" described above. Several suggestions:
- the less number of filter rules in whole network, the better (faster) - try to classify packets only when necessary, prefer to do that on fast routers as most probably connection tracking will be required.
- use DSCP to carry priority information in IP packets forwarded in your network, this way you can use it when needed.
- use VLANs where necessary, as they also carry priority information, make sure ethernet bridges and switches in the way, if any, are not clearing priority information in VLAN tag. In MT bridges you have to setup bridge firewall rule to set priority from ingress priority for this!
- remember that QoS does not improve throughput of links, it just treats different packets differently, and also that WMM traffic over wireless link will discriminate regular traffic in the air.
Mikrotik AP and client classifies packets based on priority assigned to them, according to table (as per WMM spec): 1,2 - background 0,3 - best effort 4,5 - video 6,7 - voice
To be able to use multiple WMM access categories, not just best effort where all packets with default priority 0 go, priority must be set for those packets. By default all packets (incoming and locally generated) inside router have priority 0.
"Better" access category for packet does not necessarily mean that it will be sent over the air before all other packets with "worse" access category. WMM works by executing DCF method for medium access with different settings for each access category (EDCF), which basically means that "better" access category has higher probability of getting access to medium - WMM enabled station can be considered to be 4 stations, one per access category, and the ones with "better" access category use settings that make them more likely to get chance to transmit (by using shorter backoff timeouts) when all are contending for medium. Details can be studied in 802.11e and WMM specification
How to set priority
Priority of packets can be set using "set priority" action of ip firewall mangle rules and/or bridge firewall filter rules. Priority can be set to specific value or to "ingress priority". Ingress priority is priority value that was detected on incoming packet, if available. Currently there are 2 sources of ingress priority - priority in VLAN header and priority from WMM packets received over wireless interface. For all other packets ingress priority is 0.
Note that ingress priority value is not automatically copied to priority value, correct rule needs to be set up to do this!
So there are basically 2 ways to control/set priority (remember, that both require setting up correct rule(s)!): - assign priority with rules with particular matchers (protocol, addresses, etc), - set it from ingress priority.
This essentialy means that if it is not possible or wanted to classify packets by rules, configuration of network must be such that router can extract ingress priority from incoming frames. Remember there are currently 2 sources for this - VLAN tag in packets and received WMM packets.
Do not mix priority of queues with priority assigned to packets. Priorities of queues work separately and specify "importance" of queue and has meaning only within particular queue setup. Think of packet priority as of some kind of mark, that gets attached to packet by rules. Also take into account that this mark currently is only used for outgoing packets when going over WMM enabled link, and in case VLAN tagged packet is sent out (no matter if that packet is tagged locally or bridged).
Example
For example, in setup
PPPoE server -> WMM AP -> client,
if AP is just forwarding PPPoE traffic (therefore inspecting encapsulated IP packets to match e.g. by protocol is not possible, as packets can be encrypted and compressed), priority must come to AP from PPPoE server in VLAN tag, so you have to use VLAN (between PPPoE server and AP) for this, just to communicate priority information.
Note that you do not have to forward VLAN encapsulated traffic to client - VLAN can be terminated at AP, VLAN tag is needed only when entering AP.
In case AP is PPPoE server itself, there is no need to use VLAN - priority can be set by rules before it is encapsulated in PPPoE.
Priority from DSCP
Another way of setting priority is by using DSCP field in IP header, this can only be done by firewall mange rule "set priority" action. Note that DSCP in IP header can have values 0-63, but priority only 0-7. Effective priority after set from DSCP value will be 3 low bits of DSCP value which is the same as reminder of division by 8. So for example, priority from DSCP values 0,8,16,etc will be 0, from DSCP values 7,15,...,63 - 7.
Remember that DSCP can only be accessed on IP packets!
Note, that to use this feature, DSCP value in IP header should be set somewhere.
It is best to set DSCP value in IP header of packets on some border router (e.g. main router used for connection to internet), based on traffic type. E.g. set DSCP value for packets coming from internet belonging to sip connections to 7, and 0 for the rest. This way packets must be marked only at one place. Then all APs in network set packet priority from DSCP value with just one rule.
In setup:
border router sets DSCP value for sip traffic, and WMM AP sets priority from DSCP value. Note that in this setup DSCP is set only for traffic _to_ client. Sometimes it can be useful to set also DSCP on traffic coming _from_ client (e.g. if 2 clients connected to different APs are talking between themselves) - this can be done on APs.
Combining priority setting and handling solutions
Complex networks and different situations can be handled by combining different approaches of carrying priority information to ensure QoS and optimize use of resources, based on "building blocks" described above. Several suggestions:
- the less number of filter rules in whole network, the better (faster) - try to classify packets only when necessary, prefer to do that on fast routers as most probably connection tracking will be required.
- use DSCP to carry priority information in IP packets forwarded in your network, this way you can use it when needed.
- use VLANs where necessary, as they also carry priority information, make sure ethernet bridges and switches in the way, if any, are not clearing priority information in VLAN tag. In MT bridges you have to setup bridge firewall rule to set priority from ingress priority for this!
- remember that QoS does not improve throughput of links, it just treats different packets differently, and also that WMM traffic over wireless link will discriminate regular traffic in the air.
Monday, April 7, 2008
IPSec VPN with Dynamic Routing / Mikrotik and Cisco
This example shows how to setup an IPSec VPN using dynamic routing protocol (RIP), it can be use also another protocol. In this exaple you can find setup between Mikrotik and Cisco routers, but it can be done also just between Mikrotik routers, but to be more colorfull I decided to use Mikrotik and Cisco. Below are the steps to complete the configuration of IPSec VPN with Dynamic Routing.
[edit] Mikrotik RouterOS
If you are using ROS v3.0 or above, be sure to check the end of this list to see a list of necessary mod.
First should configure a Tunnel Interface:
/ interface ipip
add name="Tunnel1" mtu=1480 local-address=10.10.1.100 remote-address=10.10.1.200 comment="" disabled=no
After that all interfaces are configured, than should asign IP addresses for interfaces:
/ ip address
add address=10.10.1.100/24 network=10.10.1.0 broadcast=10.10.1.255 interface=WAN comment="" disabled=no
add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=LAN comment="" disabled=no
add address=172.16.0.1/30 network=172.16.0.0 broadcast=192.168.0.3 interface=Tunnel1 comment="" disabled=no
Enable Routing in Mikrotik Router, in this case RIP:
/ routing rip
set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1 \
metric-connected=1 metric-ospf=1 metric-bgp=1 update-timer=30s timeout-timer=3m garbage-timer=2m
/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" prefix-list-in="" prefix-list-out=""
/ routing rip neighbor
add address=172.16.0.2
/ routing rip network
add address=192.168.1.0/24
add address=172.16.0.0/30
IPSec setup, here should be defined the ipsec policy, peer and proposal. Make sure that policy should not have enabled option tunnel, in this case tunel should be set to NO, because it will be used the transport mode of IPSec not the tunnel mode:
/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
/ ip ipsec policy
add src-address=10.10.1.100/32:any dst-address=10.10.1.200/32:any protocol=all action=encrypt level=require \
ipsec-protocols=esp tunnel=no sa-src-address=10.10.1.100 sa-dst-address=10.10.1.200 \
proposal=IPSec manual-sa=none dont-fragment=clear disabled=no
In V3.0 the bolded line will change on:
/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" in-prefix-list="" out-prefix-list=""
/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200/32:500 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
[edit] Cisco IOS
Cisco Interfaces and addresses:
FastEthernet 0/0
description *** WAN ***
ip address 10.10.1.200 255.255.255.0
crypto map vpn
FastEthernet 0/1
description *** LAN ***
ip address 192.168.2.1 255.255.255.0
Cisco Tunnel Interface:
interface Tunnel1
description **Cisco Peer**
ip address 172.16.0.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1480
ip rip v2-broadcast
ip tcp adjust-mss 1400
load-interval 30
tunnel source 10.10.1.200
tunnel destination 10.10.1.100
tunnel mode ipip
hold-queue 1024 in
hold-queue 1024 out
Routing in Cisco:
router rip
version 2
timers basic 30 60 90 90
redistribute connected metric 1 route-map connected-to-rip
redistribute static metric 5 route-map static-to-rip
network 172.16.0.2
network 192.168.2.0
distribute-list prefix LAN out
no auto-summary
Setup the prefix-list to match the Local subnet:
ip prefix-list LAN seq 10 permit 192.168.2.0/24
Setup route-maps to match interfaces to be advertised by RIP:
route-map connected-to-rip permit 10
match interface FastEthernet0/0
!
route-map static-to-rip permit 10
match ip address prefix-list LAN
IPSec and Crypto setup in Cisco, also here trasnport mode of IPSec should be setup:
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key ipsec address 0.0.0.0 0.0.0.0
!
crypto ipsec security-association idle-time 600
!
crypto ipsec transform-set vpn esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 1 ipsec-isakmp
description **To Mikrotik Peer**
set peer 10.10.1.100
set transform-set vpn
set pfs group2
match address mikrotik_peer
!
Setup access-list to match the IPSec peer:
ip access-list extended mikrotik_peer
permit ipinip host 10.10.1.200 host 10.10.1.100
Type this in "enable" mode to view your routing table (after succesfull RIP update):
sh ip route
or
sh ip rip database
This example can be implemented also with another routing protocol like OSPF, and also very simply we can setup here a failover connection. Regarding the failover, the setup is very easy, all that we need is to create another set of tunnels via another ISP or gateway, but again the remote peer is the same router. Instead of the routing protocol for the second set of tunnels, it needs static routes to be configured, only that the static routes should have higher distance than the dynamic protocol. The idea is that, when the primary link will go down (dynamic routing distance=120) than the backup link becomes active (static routes distance=200), as soon as the primary link will come up, it will put the failover link in inactive mode.Titolo del collegamento
[edit] Mikrotik RouterOS
If you are using ROS v3.0 or above, be sure to check the end of this list to see a list of necessary mod.
First should configure a Tunnel Interface:
/ interface ipip
add name="Tunnel1" mtu=1480 local-address=10.10.1.100 remote-address=10.10.1.200 comment="" disabled=no
After that all interfaces are configured, than should asign IP addresses for interfaces:
/ ip address
add address=10.10.1.100/24 network=10.10.1.0 broadcast=10.10.1.255 interface=WAN comment="" disabled=no
add address=192.168.1.1/24 network=192.168.1.0 broadcast=192.168.1.255 interface=LAN comment="" disabled=no
add address=172.16.0.1/30 network=172.16.0.0 broadcast=192.168.0.3 interface=Tunnel1 comment="" disabled=no
Enable Routing in Mikrotik Router, in this case RIP:
/ routing rip
set redistribute-static=no redistribute-connected=no redistribute-ospf=no redistribute-bgp=no metric-static=1 \
metric-connected=1 metric-ospf=1 metric-bgp=1 update-timer=30s timeout-timer=3m garbage-timer=2m
/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" prefix-list-in="" prefix-list-out=""
/ routing rip neighbor
add address=172.16.0.2
/ routing rip network
add address=192.168.1.0/24
add address=172.16.0.0/30
IPSec setup, here should be defined the ipsec policy, peer and proposal. Make sure that policy should not have enabled option tunnel, in this case tunel should be set to NO, because it will be used the transport mode of IPSec not the tunnel mode:
/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m lifebytes=0 pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
/ ip ipsec policy
add src-address=10.10.1.100/32:any dst-address=10.10.1.200/32:any protocol=all action=encrypt level=require \
ipsec-protocols=esp tunnel=no sa-src-address=10.10.1.100 sa-dst-address=10.10.1.200 \
proposal=IPSec manual-sa=none dont-fragment=clear disabled=no
In V3.0 the bolded line will change on:
/ routing rip interface
add interface=Tunnel1 receive=v2 send=v2 authentication=none authentication-key="" in-prefix-list="" out-prefix-list=""
/ ip ipsec proposal
add name="IPSec" auth-algorithms=md5 enc-algorithms=3des lifetime=30m pfs-group=modp1024 disabled=no
/ ip ipsec peer
add address=10.10.1.200/32:500 secret="ipsec" generate-policy=no exchange-mode=main send-initial-contact=yes \
proposal-check=obey hash-algorithm=md5 enc-algorithm=3des dh-group=modp1024 lifetime=1d lifebytes=0 disabled=no
[edit] Cisco IOS
Cisco Interfaces and addresses:
FastEthernet 0/0
description *** WAN ***
ip address 10.10.1.200 255.255.255.0
crypto map vpn
FastEthernet 0/1
description *** LAN ***
ip address 192.168.2.1 255.255.255.0
Cisco Tunnel Interface:
interface Tunnel1
description **Cisco Peer**
ip address 172.16.0.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1480
ip rip v2-broadcast
ip tcp adjust-mss 1400
load-interval 30
tunnel source 10.10.1.200
tunnel destination 10.10.1.100
tunnel mode ipip
hold-queue 1024 in
hold-queue 1024 out
Routing in Cisco:
router rip
version 2
timers basic 30 60 90 90
redistribute connected metric 1 route-map connected-to-rip
redistribute static metric 5 route-map static-to-rip
network 172.16.0.2
network 192.168.2.0
distribute-list prefix LAN out
no auto-summary
Setup the prefix-list to match the Local subnet:
ip prefix-list LAN seq 10 permit 192.168.2.0/24
Setup route-maps to match interfaces to be advertised by RIP:
route-map connected-to-rip permit 10
match interface FastEthernet0/0
!
route-map static-to-rip permit 10
match ip address prefix-list LAN
IPSec and Crypto setup in Cisco, also here trasnport mode of IPSec should be setup:
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key ipsec address 0.0.0.0 0.0.0.0
!
crypto ipsec security-association idle-time 600
!
crypto ipsec transform-set vpn esp-3des esp-md5-hmac
mode transport
!
crypto map vpn 1 ipsec-isakmp
description **To Mikrotik Peer**
set peer 10.10.1.100
set transform-set vpn
set pfs group2
match address mikrotik_peer
!
Setup access-list to match the IPSec peer:
ip access-list extended mikrotik_peer
permit ipinip host 10.10.1.200 host 10.10.1.100
Type this in "enable" mode to view your routing table (after succesfull RIP update):
sh ip route
or
sh ip rip database
This example can be implemented also with another routing protocol like OSPF, and also very simply we can setup here a failover connection. Regarding the failover, the setup is very easy, all that we need is to create another set of tunnels via another ISP or gateway, but again the remote peer is the same router. Instead of the routing protocol for the second set of tunnels, it needs static routes to be configured, only that the static routes should have higher distance than the dynamic protocol. The idea is that, when the primary link will go down (dynamic routing distance=120) than the backup link becomes active (static routes distance=200), as soon as the primary link will come up, it will put the failover link in inactive mode.Titolo del collegamento
PPTPClient
PPtp Client / VPN
Now lets configure the remote client to connect to the above VPN
/interface pptp-client
add name="vpn-to-server" connect-to: 192.168.x.x user="user-1" password="********" allow=mschap1,mschap2
>print
Flags: X - disabled, R - running
0 X name="vpn-to-server" max-mtu=1460 max-mru=1460 connect-to=192.168.x.x
user="user-1" password="*******" profile=default-encryption
add-default-route=no allow=mschap1,mschap2
>enable 0
Now lets configure the remote client to connect to the above VPN
/interface pptp-client
add name="vpn-to-server" connect-to: 192.168.x.x user="user-1" password="********" allow=mschap1,mschap2
Flags: X - disabled, R - running
0 X name="vpn-to-server" max-mtu=1460 max-mru=1460 connect-to=192.168.x.x
user="user-1" password="*******" profile=default-encryption
add-default-route=no allow=mschap1,mschap2
>enable 0
PPTPServer
A minimalistic HowTo for using a MT Router OS as PPTP-Server, based on 2.9.x. Use it on your own risk.
I prefer bridge-groups as they are always up and one can add physical interfaces later. The arp=proxy-arp is important.
N.B. 8 Oct 2007: "set gre disabled=no" is not active on RouterOS 3.0rc5
/ interface ethernet
set ether1 name="ether1"
/ interface bridge
add name="lan" arp=proxy-arp
/ interface bridge port
add interface=ether1 bridge=lan
/ ip address
add address=192.168.0.1/24 interface=lan
/ ip dns
allow-remote-requests=yes
/ ip firewall service-port
set gre disabled=no
set pptp disabled=no
/ ip pool
add name="pptp" ranges=192.168.0.200-192.168.0.229
/ ppp profile
add name="pptp-in" local-address=192.168.0.1 remote-address=pptp use-encryption=required only-one=yes change-tcp-mss=yes dns-server=192.168.0.1
/ interface pptp-server server
set enabled=yes max-mtu=1460 max-mru=1460 authentication=chap,mschap1,mschap2 default-profile=pptp-in
/ ppp secret
add name="user-1" service=pptp password="******" profile=pptp-in
add name="user-2" service=pptp password="******" profile=pptp-in
I prefer bridge-groups as they are always up and one can add physical interfaces later. The arp=proxy-arp is important.
N.B. 8 Oct 2007: "set gre disabled=no" is not active on RouterOS 3.0rc5
/ interface ethernet
set ether1 name="ether1"
/ interface bridge
add name="lan" arp=proxy-arp
/ interface bridge port
add interface=ether1 bridge=lan
/ ip address
add address=192.168.0.1/24 interface=lan
/ ip dns
allow-remote-requests=yes
/ ip firewall service-port
set gre disabled=no
set pptp disabled=no
/ ip pool
add name="pptp" ranges=192.168.0.200-192.168.0.229
/ ppp profile
add name="pptp-in" local-address=192.168.0.1 remote-address=pptp use-encryption=required only-one=yes change-tcp-mss=yes dns-server=192.168.0.1
/ interface pptp-server server
set enabled=yes max-mtu=1460 max-mru=1460 authentication=chap,mschap1,mschap2 default-profile=pptp-in
/ ppp secret
add name="user-1" service=pptp password="******" profile=pptp-in
add name="user-2" service=pptp password="******" profile=pptp-in
Tuesday, February 26, 2008
Securing your router
Set up packet filtering
All packets with destination to the router are processed against the ip firewall filter's input chain. Note, that the input chain does not affect packets which are being transferred through the router!
You can add following rules to the input chain under /ip firewall filter (just 'copy and paste' to the router using Terminal Console or configure the relevant arguments in WinBox):
/ ip firewall filter
add chain=input connection-state=established comment="Accept established connections"
add chain=input connection-state=related comment="Accept related connections"
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
add chain=input protocol=udp action=accept comment="UDP" disabled=no
add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings"
add chain=input protocol=icmp action=drop comment="Drop excess pings"
add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell"
add chain=input protocol=tcp dst-port=8291 comment="winbox"
# Edit these rules to reflect your actual IP addresses! #
add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network"
add chain=input src-address=10.0.0.0/8 comment="From our private LAN"
# End of Edit #
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else"
add chain=input action=drop comment="Drop everything else"
Use /ip firewall filter print input stats command to see how many packets have been processed against these rules. Use reset-counters-all command to reset the counters. Examine the system log file /log print to see the packets which have been dropped.
You may need to include additional rules to allow access from certain hosts, etc. Remember that firewall rules are processed in the order they appear on the list! After a rule matches the packet, no more rules are processed for it. After adding new rules, move them up using the move command.
Note, if you mis-configured the firewall and have locked yourselves out from the router, you may use MAC telnet from another router or workstation on the same LAN to connect to your router and correct the problem.
All packets with destination to the router are processed against the ip firewall filter's input chain. Note, that the input chain does not affect packets which are being transferred through the router!
You can add following rules to the input chain under /ip firewall filter (just 'copy and paste' to the router using Terminal Console or configure the relevant arguments in WinBox):
/ ip firewall filter
add chain=input connection-state=established comment="Accept established connections"
add chain=input connection-state=related comment="Accept related connections"
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
add chain=input protocol=udp action=accept comment="UDP" disabled=no
add chain=input protocol=icmp limit=50/5s,2 comment="Allow limited pings"
add chain=input protocol=icmp action=drop comment="Drop excess pings"
add chain=input protocol=tcp dst-port=22 comment="SSH for secure shell"
add chain=input protocol=tcp dst-port=8291 comment="winbox"
# Edit these rules to reflect your actual IP addresses! #
add chain=input src-address=159.148.172.192/28 comment="From Mikrotikls network"
add chain=input src-address=10.0.0.0/8 comment="From our private LAN"
# End of Edit #
add chain=input action=log log-prefix="DROP INPUT" comment="Log everything else"
add chain=input action=drop comment="Drop everything else"
Use /ip firewall filter print input stats command to see how many packets have been processed against these rules. Use reset-counters-all command to reset the counters. Examine the system log file /log print to see the packets which have been dropped.
You may need to include additional rules to allow access from certain hosts, etc. Remember that firewall rules are processed in the order they appear on the list! After a rule matches the packet, no more rules are processed for it. After adding new rules, move them up using the move command.
Note, if you mis-configured the firewall and have locked yourselves out from the router, you may use MAC telnet from another router or workstation on the same LAN to connect to your router and correct the problem.
Saturday, January 26, 2008
14 Step Configuration of mikrotik using ADSL speedy internet
This articel i explain how to configuration mikrotik using pc for router.
1. Configuration position of ADSL connection
modem —Mikrotik—-Switch —– Client
|
Client
a. Modem IP –>> 192.168.1.1
b. Mikrotik Using 2 Interface - Ether1 —->> 192.168.1.2
- Ether2 —->> 192.168.0.254
c. Switch — Client ip 192.168.0.1-253
2. Configuration step router pc mikrotik
a. add ip address to interface 1
/ip address add interface=ether1 address = 192.168.1.1 netmask= 255.255.255.0
b. add ip address to interface2
/ip address add interface=ether2 address = 192.168.0.1 netmask= 255.255.255.0
c. to see input of interface
/interface print
d. Set Value name off interface
/inteface set 0 name=”Public” –>> For Modem
/inteface set 1 name=”Lan” –>> For Lan
e. set routing for net ( modem )
/ip route add gateway=192.168.0.1
f. set dns server ISP
/ip dns set primary-dns=203.130.193.74 secondary-dns=202.134.0.155
/ip dns set allow-remote-requests=yes
g. set of nat the router pc to sharing bw to lan
/ip firewall nat add chain=srcnat out-inteface=Public action=masquerade
Sunday, January 20, 2008
MikroTik RouterOS™
MikroTik RouterOS™ turns a standard PC computer into a powerful network router. Just add standard network PC interfaces to expand the router capabilities.
Mikrotik Web Proxy Setting for Transparant proxy
setting transparant web proxy server
1. first se t web proxy
/ ip web-proxy
set enabled=yes –>> to make ip web proxy enable
set src-address=0.0.0.0 –>> to make source address to access web proxy will allow
set port=8080 –>> to make port for web proxy
set hostname=”proxy.war.net.id” –>> setting for visble hostname web proxy
set transparent-proxy=yes –>> make transparant proxy enable
set parent-proxy=0.0.0.0:0–>> if we used parent proxy x
set cache-administrator=”support@somethink.org” –>> make set administrator info support
set max-object-size=4096KiB –>> maximal object can cacth with the proxy server
set cache-drive=system –>> where drive position that cache wil be saved
set max-cache-size=unlimited –>> maximal harddrive we used for cache
set max-ram-cache-size=unlimited –>> maximal ram we used for cache
2. add nat for redirect port for squid to make transparant
/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 –>> setting can redirect port 80 to 8080 for proxy server
/ip firewall nat add chain=dstnat protocol=tcp dst-port=3128 action=redirect to-ports=8080 –>> setting can redirect port 3128 to 8080 for proxy server
/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 action=redirect to-ports=8080 –>> setting can redirect port 8080 to 8080 for proxy server
1. first se t web proxy
/ ip web-proxy
set enabled=yes –>> to make ip web proxy enable
set src-address=0.0.0.0 –>> to make source address to access web proxy will allow
set port=8080 –>> to make port for web proxy
set hostname=”proxy.war.net.id” –>> setting for visble hostname web proxy
set transparent-proxy=yes –>> make transparant proxy enable
set parent-proxy=0.0.0.0:0–>> if we used parent proxy x
set cache-administrator=”support@somethink.org” –>> make set administrator info support
set max-object-size=4096KiB –>> maximal object can cacth with the proxy server
set cache-drive=system –>> where drive position that cache wil be saved
set max-cache-size=unlimited –>> maximal harddrive we used for cache
set max-ram-cache-size=unlimited –>> maximal ram we used for cache
2. add nat for redirect port for squid to make transparant
/ip firewall nat add chain=dstnat protocol=tcp dst-port=80 action=redirect to-ports=8080 –>> setting can redirect port 80 to 8080 for proxy server
/ip firewall nat add chain=dstnat protocol=tcp dst-port=3128 action=redirect to-ports=8080 –>> setting can redirect port 3128 to 8080 for proxy server
/ip firewall nat add chain=dstnat protocol=tcp dst-port=8080 action=redirect to-ports=8080 –>> setting can redirect port 8080 to 8080 for proxy server
MikroTik Wireless Configuration
Setup uses Safe Mode. It means that all changes that are made during setup
are reverted in case of error, or if Ctrl-C is used to abort setup. To keep
changes exit setup using the ‘x’ key.
[Safe Mode taken]
Choose options by pressing one of the letters in the left column, before
dash. Pressing ‘x’ will exit current menu, pressing Enter key will select the
entry that is marked by an ‘*’. You can abort setup at any time by pressing
Ctrl-C.
Entries marked by ‘+’ are already configured.
Entries marked by ‘-’ cannot be used yet.
Entries marked by ‘X’ cannot be used without installing additional packages.
r - reset all router configuration
+ l - load interface driver
+ a - configure ip address and gateway
d - setup dhcp client
+ s - setup dhcp server
p - setup pppoe client
t - setup pptp client
* x - exit menu
your choice:
OR
[admin@MikroTik] > ip address
[admin@MikroTik] ip address> add address=192.168.1.1/24 interface=ether1
[admin@MikroTik] ip address> pr
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.1.1/24 192.168.1.0 192.168.1.255 ether1
admin@MikroTik] ip address> /
[admin@MikroTik] >
[admin@MikroTik] >interface
[admin@MikroTik] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 X ether1 ether 0 0 1500
1 X wlan1 wlan 0 0 1500
[admin@MikroTik] interface> enable 0
[admin@MikroTik] interface> enable 1
[admin@MikroTik] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether1 ether 0 0 1500
1 X wlan1 wlan 0 0 1500
[admin@MikroTik] ip address>add address=172.1.2.1/30 interface=wlan1
[admin@MikroTik] interface eoip>
[admin@MikroTik] interface eoip>add name=eoip-tunnel1 remote-address=172.1.2.2 tunnel-id=1 disabled=no arp=enabled
[admin@MikroTik] interface eoip>pr
Flags: X - disabled, R - running
0 R name=”eoip-tunnel1″ mtu=1500 mac-address=FE:FD:00:00:00:00 arp=enabled remote-address=172.1.2.2 tunnel-id=1
[admin@MikroTik] interface eoip>..
[admin@MikroTik] interface>
[admin@MikroTik] interface> bridge
[admin@MikroTik] interface bridge> add name=bridge1
[admin@MikroTik] interface bridge>pr
Flags: X - disabled, R - running
0 R name=”bridge1″ mtu=1500 arp=enabled mac-address=00:00:00:00:00:0 forward-protocols=ip,arp,appletalk,ipx,ipv6,other stp=no priority=32768 ageing-time=5m forward-delay=15s garbage-collection-interval=4s hello-time=2s max-message-age=20s
[admin@MikroTik] interface bridge>port
[admin@MikroTik] interface bridge port>pr
# INTERFACE BRIDGE PRIORITY PATH-COST
0 ether1 none 128 10
1 eoip-tunnel1 none 128 10
2 wlan1 none 128 10
[admin@MikroTik] interface bridge port>set eoip-tunnel1 bridge=bridge1
[admin@MikroTik] interface bridge port>set ether1 bridge=bridge1
[admin@MikroTik] interface bridge port>pr
# INTERFACE BRIDGE PRIORITY PATH-COST
0 ether1 bridge1 128 10
1 eoip-tunnel1 bridge1 128 10
3 wlan1 none 128 10
[admin@MikroTik] interface bridge port>.. ..
[admin@MikroTik] interface>wireless
[admin@MikroTik] interface wireless>set wlan1 mode=bridge disable-running-check=no band=5ghz frequency=5180 ssid=test1
Configurration For Mikrotik Station / Client
[admin@MikroTik] interface eoip>add name=eoip-tunnel1 remote-address=172.1.2.1 tunnel-id=1 disabled=no arp=enabled
[admin@MikroTik] interface wireless>set wlan1 mode=station disable-running-check=no band=5ghz frequency=5180 ssid=test1
[admin@MikroTik] interface>pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether1 ether 0 0 1500
1 R bridge1 bridge 0 0 1500
2 R eoip-tunnel1 eoip-tunnel 0 0 1500
3 R wlan1 wlan 0 0 1500
are reverted in case of error, or if Ctrl-C is used to abort setup. To keep
changes exit setup using the ‘x’ key.
[Safe Mode taken]
Choose options by pressing one of the letters in the left column, before
dash. Pressing ‘x’ will exit current menu, pressing Enter key will select the
entry that is marked by an ‘*’. You can abort setup at any time by pressing
Ctrl-C.
Entries marked by ‘+’ are already configured.
Entries marked by ‘-’ cannot be used yet.
Entries marked by ‘X’ cannot be used without installing additional packages.
r - reset all router configuration
+ l - load interface driver
+ a - configure ip address and gateway
d - setup dhcp client
+ s - setup dhcp server
p - setup pppoe client
t - setup pptp client
* x - exit menu
your choice:
OR
[admin@MikroTik] > ip address
[admin@MikroTik] ip address> add address=192.168.1.1/24 interface=ether1
[admin@MikroTik] ip address> pr
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.1.1/24 192.168.1.0 192.168.1.255 ether1
admin@MikroTik] ip address> /
[admin@MikroTik] >
[admin@MikroTik] >interface
[admin@MikroTik] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 X ether1 ether 0 0 1500
1 X wlan1 wlan 0 0 1500
[admin@MikroTik] interface> enable 0
[admin@MikroTik] interface> enable 1
[admin@MikroTik] interface> pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether1 ether 0 0 1500
1 X wlan1 wlan 0 0 1500
[admin@MikroTik] ip address>add address=172.1.2.1/30 interface=wlan1
[admin@MikroTik] interface eoip>
[admin@MikroTik] interface eoip>add name=eoip-tunnel1 remote-address=172.1.2.2 tunnel-id=1 disabled=no arp=enabled
[admin@MikroTik] interface eoip>pr
Flags: X - disabled, R - running
0 R name=”eoip-tunnel1″ mtu=1500 mac-address=FE:FD:00:00:00:00 arp=enabled remote-address=172.1.2.2 tunnel-id=1
[admin@MikroTik] interface eoip>..
[admin@MikroTik] interface>
[admin@MikroTik] interface> bridge
[admin@MikroTik] interface bridge> add name=bridge1
[admin@MikroTik] interface bridge>pr
Flags: X - disabled, R - running
0 R name=”bridge1″ mtu=1500 arp=enabled mac-address=00:00:00:00:00:0 forward-protocols=ip,arp,appletalk,ipx,ipv6,other stp=no priority=32768 ageing-time=5m forward-delay=15s garbage-collection-interval=4s hello-time=2s max-message-age=20s
[admin@MikroTik] interface bridge>port
[admin@MikroTik] interface bridge port>pr
# INTERFACE BRIDGE PRIORITY PATH-COST
0 ether1 none 128 10
1 eoip-tunnel1 none 128 10
2 wlan1 none 128 10
[admin@MikroTik] interface bridge port>set eoip-tunnel1 bridge=bridge1
[admin@MikroTik] interface bridge port>set ether1 bridge=bridge1
[admin@MikroTik] interface bridge port>pr
# INTERFACE BRIDGE PRIORITY PATH-COST
0 ether1 bridge1 128 10
1 eoip-tunnel1 bridge1 128 10
3 wlan1 none 128 10
[admin@MikroTik] interface bridge port>.. ..
[admin@MikroTik] interface>wireless
[admin@MikroTik] interface wireless>set wlan1 mode=bridge disable-running-check=no band=5ghz frequency=5180 ssid=test1
Configurration For Mikrotik Station / Client
[admin@MikroTik] interface eoip>add name=eoip-tunnel1 remote-address=172.1.2.1 tunnel-id=1 disabled=no arp=enabled
[admin@MikroTik] interface wireless>set wlan1 mode=station disable-running-check=no band=5ghz frequency=5180 ssid=test1
[admin@MikroTik] interface>pr
Flags: X - disabled, D - dynamic, R - running
# NAME TYPE RX-RATE TX-RATE MTU
0 R ether1 ether 0 0 1500
1 R bridge1 bridge 0 0 1500
2 R eoip-tunnel1 eoip-tunnel 0 0 1500
3 R wlan1 wlan 0 0 1500
Subscribe to:
Posts (Atom)
