MikroTik

bajzaadmin

Yes, you on the right track, BUT "- Currently I do not have any firewall rules set. Security of the device is done through allowing access from LAN , and a given private IPv4 network only." Security of the device should not just be from the LAN, but also from internet side, else you might...

bajzaadmin

*bump

Sorry guys, may I get a final nod on my last post, if I am correct or not?

Thanks in advance!

bajzaadmin

Now your WAN interface is (assuming) ether1 and you're running DHCP client on it to receive your public IP address and default gateway (and DHCP server address and ...). When you'll switch to fiber and PPPoE, your WAN interface will be pppoe-user-mike (or whatever you'll name it) and you will not r...

bajzaadmin

You will also need to amend firewall filter and nat rules to reference the new PPPoE WAN interface Hey There! Topology wise. there is no panned change on the LAN. The current WAN interface would stay the same (basically, a Cat6 cable that goes into the current modem will be plugged into a new devic...

bajzaadmin

Greetings Fellas! My ISP is going to upgrade their service to optical. They'll setup a device that'll be bridgeing (no double-NAT) internet queries for my network soon. I'll need to setup PPPoE on my WAN interface. Currently, the interface I use for this ISP's service is configured as a DHCP client,...

bajzaadmin

Change the address to:
Code: Select all
/ip address
add address=195.199.158.84/29 interface=ether3

Many kisses on your forehead bröder, it works like a charm now !!

I must wonder, why on earth have I given a network mask when a network id was asked..

Anyhow, case is closed, KUDOS to you!

bajzaadmin

Actually, it can be even simpler, if all traffic to KMS server address can use second WAN: /ip address add address=195.199.158.84/29 interface=ether3 /ip route add dst-address=195.199.255.195/32 gateway=195.199.158.86 If you'd want to only send specific port there, it can be done like this: /ip add...

bajzaadmin

**UPDATE: –I have failed.. can you guys have a look at my cfg? Concatenated it to the end of this post. I've ommited some irrelevant cfg. – Hey there fellas! I think you guys got all that I wanted, KUDOS ! :) I'm still waiting for some of the details from the sec contractor, but their LAN is preconf...

bajzaadmin

Hey there, thanks for the reply! You assume that I am savvy enough to translate what you said into config. :D I'll link my cfg export as well as most of the details; could you help me with an actual config pretty please? Thanks in advance! Kind regards, IBR Target telco router uses a public port wit...

bajzaadmin

... Just so understanding is clear, the requirements could be described as 1. Single Router facing the internet (WAN). 2. A single multi-use LAN for pcs, printers etc..... 3. A single security LAN for CCTV and alarms 4. Both LANS must access the Internet 5. Both LANS should not see each other 6. Th...

bajzaadmin

... In practice, what you do is known as security through obscurity. Even though packets from LAN x are normally not seen by devices from LAN y, anybody with basic networking knowledge and skills can see them and also join the other LAN with its own device without anybody's knowledge. If you really...

bajzaadmin

Hey there! I'd like to create a pseudo-intertface on my 2011UiAS routerboard's LAN facing interface! The pseudo interface would work something like it on a cisco IOS "Router On A Stick" device: packets coming from LAN x and y would be segmented from each other, but the physical interface w...

bajzaadmin

Hey there! I have a 2011UiAS routerboard, that serves as my gateway. I want to add an interface, that would only be used for Microsoft KMS server authentication of the LAN clients (since the bandwidth of the service is abysma otherwisel) ! The interface would have its own static DNS and IP settings ...

bajzaadmin

Hi The sec contractor need to access "3" net right, and you all too? Then: * define new "3" net on the router * setup vpn for sec contractor, a separate net, say "5" * deny access from "3" to anything else in forward, except ntp on firewall * grant access fro...

bajzaadmin

Hi The sec contractor need to access "3" net right, and you all too? Then: * define new "3" net on the router * setup vpn for sec contractor, a separate net, say "5" * deny access from "3" to anything else in forward, except ntp on firewall * grant access fro...

bajzaadmin

Hey there you lovely peeps! I was given the task to allow remote management and utility for our security contractor from the internet, whilst providing access from our machines, to the CCTV subnet. We have two independent LANs: 1) One is used by the CCTV/Alarm/Firealarm system. The lan resides on 19...

bajzaadmin

ok, i am back again :) tell me, what is the current status? as before, no DHCP or DNS? what happened when you disabled the rules and activated them 1-1, anything changed? Hey there! The current status can be seen in the OP, I've refreshed it with screenshots and a fresh export as well as an updated...

bajzaadmin

*bump

Could it be that this config should work, or that I am missing something very trivial?
Its sortof suspicious that I didn't get a reply since quite some time now!

bajzaadmin

Hey there again! I've made some changes based on this wiki article: https://wiki.mikrotik.com/wiki/Basic_universal_firewall_script I'll be able to test this tomorrow, but if you guys spot anything wrong here, let me know please! Here is a screenshot of my filter rules: https://imgur.com/a/U6jNd And ...

bajzaadmin

Tried the config yesterday, failed miserably.
Still unable to ping LAN address, still not forwarding DNS queries.
I wonder if its really not a faulty device now...

bajzaadmin

It's this rule add action=drop chain=forward comment=" Drop all else forward requests!" Allow icmp in forward chain without more matchers. Just rule add action=accept chain=forward protocol=icmp Dude, I think I got this; could you please check out my new filter rules? ( The filter rules: ...

bajzaadmin

It's this rule add action=drop chain=forward comment=" Drop all else forward requests!" Allow icmp in forward chain without more matchers. Just rule add action=accept chain=forward protocol=icmp Thanks! This sure explains why I couldn't ping outside clients, but why couldn't I ping the LA...

bajzaadmin

I think only with some scripting.

One more thing: do you have any idea, what could cause the ping failures on LAN?

bajzaadmin

I just saw, you need to accept ISP's DNS servers in input. You are currently allowing DNS requests only for LAN.

Thanks mate! Is there a way to do this dynamically, or shall I always strive to add static DNS servers?

bajzaadmin

*Bump

bajzaadmin

Hey fellas! i dont know if the commands in export and winbox are in the same order so i cant tell something about the current config, yet you should know that when a packet arrives in Firewall, ALL rules are checked in order so its good to see what's going on at your firewall...for example, if you h...

bajzaadmin

Sby told me that I should move the "add action=drop chain=input" filter rule behind the forward allowing rules, anyone has a take on this?

bajzaadmin

i would suggest you to disable the rules and enable them one by one, so as to see what is going on. maybe there is a problem with a param but i am currently away from my lab to reproduce your setup and check what is going on :-/ i will be back on the weekend and will search it more You are awesome ...

bajzaadmin

I do not want to bump the topic, but does anyone have any idea why this basic config fails on me?
I am thinking its filter rules, but everything seem to be fine. Maybe its faulty HW ?

bajzaadmin

I've tested the things you guys have been advising to me, but no luck still. I am posting the freshly exported config here: # oct/24/2017 18:46:40 by RouterOS 6.39.2 # software id = 5IAZ-WMI5 # /interface ethernet set [ find default-name=ether2 ] mac-address=F0:79:59:EB:9B:98 name=\ Eth2_WAN1_DIGI ...

bajzaadmin

I dont think so, i just had a idea, in a different menu or ROS if you specify 2 "states" with a comma it waits for both the states to appear (like in connection state, if you have "related,established" it waits for a connection which is related AND established. If you want to fi...

bajzaadmin

Have you tried using different rules per port on your firewall, something like add action=accept chain=input comment=" Allow DHCP and DNS UDP" dst-port=53 in-interface=Eth5_LAN protocol=udp add action=accept chain=input comment=" Allow DHCP and DNS UDP" dst-port=67 in-interface=...

bajzaadmin

Hey, good evening!
Have you figured out what was the problem or still no luck? Can you upload a recent export of the config to check it, too?

George

Hey there George!

It is essentially still the same config, and no, I had no luck

.

bajzaadmin

Hey there effndc, thanks for your reply too! I've removed the DNS from the DHCP server settings because Steveocee suggested that it will dynamically hand out the DNS settings of my ISP ( if remote-requests are enabled I guess). May also want to add add-arp to your DHCP configuration: /ip dhcp-server...

bajzaadmin

Hey there Steveocee, thanks for the reply! I've checked what you've suggested, but no luck. The device is connected directly into a cisco distribution switch; network works fine with our previous gateway. I've discovered some wierd symptoms though : DHCP clients get proper IP now, however DNS resolv...

bajzaadmin

#UPDATED OP with Final export, "case closed" ! /20180122/ Hey there everyone! The firewall rules were thrown out the window in the end. Management IPs will be handled on a service bases. I am closing the post, thank you for everyone who tried to help ! Kind regards, IBR # software id = 5IA...

bajzaadmin

So, I should add ISP/Google/whatever DNS servers in IP/DNS and let IP/DHCP-Server use the internal DNS address of the MikroTik device? That's the typical SOHO configuration, yes. IP > DNS > Settings configures how the Mikrotik itself uses DNS. IP > DHCP-Server > Networks configures what DNS server ...

bajzaadmin

This sounds like you have ARP disabled on the LAN interface. Go into the settings and make sure ARP is set to enabled, or reply-only (only use the second one if you're trying to force DHCP use, and have add-arp=yes in the DHCP server settings) As for DNS, under your settings, you've configured allo...

bajzaadmin

FORWARD chain fasttrack-connection connection-state=established,related allow connection-state=established,related allow out-interface=WAN drop This would allow other customers (within your network segment) to route traffic over your line, if not properly isolated by your provider. (Usually there i...

bajzaadmin

... EDIT: It looks like it should be working. I haven't totally read the entire config, so perhaps I've missed something. The only things I can think of right off hand are if your LAN interface is not actually Ether5, or else you have something going on with ARP (make sure the ether5 interface has ...

bajzaadmin

... Lastly, this route statement isn't necessary, because it gets added automatically as a connected route whenever you put the IP address 192.168.0.1/16 onto the interface: /ip route add distance=1 dst-address=192.168.0.0/16 gateway=Eth5_LAN pref-src=\ 192.168.0.1 Hey there, thanks for the fast re...

bajzaadmin

# jul/17/2017 10:20:09 by RouterOS 6.39.2 # software id = 5IAZ-WMI5 # /interface ethernet set [ find default-name=ether2 ] mac-address=F0:79:59:EB:9B:98 name=\ Eth2_WAN1_DIGI set [ find default-name=ether5 ] name=Eth5_LAN /ip pool add name=dhcp_pool1 ranges=192.168.100.2-192.168.255.254 /ip dhcp-ser...

bajzaadmin

All righty Lads, thank you so much for both of your replies, especially yours ZeroByte! The config does seem to work properly now, I will test it out Thursday in our live network. One more question: Is it an okey practice that I have both of my LAN and WAN ports on the same "physical" swit...

bajzaadmin

Hey there Mr. ZeroByte, thank you for the fast reply ! So I should be content with this basic setup, and not worry about SYN flood and other possible "outside" threats, correct ? I am sorry, but my network knowledge is a bit limited at the moment, me being at around the half of the first C...

bajzaadmin

Dearest, knowledgeable forum dwellers! I am completely new to Firewalls, as I've never had to configure one from scratch before. I work as a sys admin at an elementary school, where we've got a MikroTik RB2011UiAS-IN, that I wish to configure and use as our gateway router. What I wish to achieve, is...

bajzaadmin

Hi, as i remember there is an attribute, "check-gateway" to "/ip route" which takes as paramaters "ping" or "arp". An example: /ip route add dst-address=0.0.0.0/0 gateway=XXX check-gateway=ping kind regards, Hey there! And can you tell me, how can I add this ...

bajzaadmin

It would be good idea to write what exactly you tried and what didn't work as expected. Good starting point for basic load balancing is http://wiki.mikrotik.com/wiki/Manual:PCC. Hey there Sir! Thank you for your aid, I did check that page back when I was looking for solutions, but right now, I am t...

bajzaadmin

Good day ya altruistic internet peeps! I am a newbie sysadmin, and I've been given the following task: The local network of my workplace has been recently refurbished, however the management "forgot" to ask for the new system's configuration in the contract.. We got MikroTik/Cisco switche...

Search found 48 matches