I want to configure two gateways..gateway 1st as my gateway to my another intranet..while i need to add gateway 2 for giving access to internet to some users in my lan.. Please help me how do i do this...i am new to mikrotik...in cisco i could do this by defining some access command list and forward to gateway 2 for those ips...
Regards:)
-
-
boen_robot
Forum Guru
- Posts: 2400
- Joined:
- Location: europe://Bulgaria/Plovdiv
Re: alternate gateway for certain ip/sites
You can specify the different gateways at "/ip route" menu. And then somewhere within the "/ip firewall" menu, you can limit access. Where exactly in "/ip firewall" depends on the way you've set up your LAN.
If your network is a NAT-ted one like mine, then you can simply add all allowed clients in a list at "/ip firewall address-list", and then create a single rule in "/ip firewall nat" that operates on that list.
In other instances, the "filter" or "mangle" sections can help.
If your network is a NAT-ted one like mine, then you can simply add all allowed clients in a list at "/ip firewall address-list", and then create a single rule in "/ip firewall nat" that operates on that list.
In other instances, the "filter" or "mangle" sections can help.
Re: alternate gateway for certain ip/sites
THIS IS WHAT MY NETWORK LOOK LIKE
You do not have the required permissions to view the files attached to this post.
-
-
boen_robot
Forum Guru
- Posts: 2400
- Joined:
- Location: europe://Bulgaria/Plovdiv
Re: alternate gateway for certain ip/sites
Are the IPs 192.168.0.8/30 and 192.168.0.12/30 assigned to that same MikroTik device as the 192.168.252.1/22 and 192.168.253.1/29 (though on another interface I assume)? If not, assign another IP to the MikroTik device.
As for allowing them internet access, this is a NAT-ed network, so we go back to what I said: Add every allowed client in "/ip firewall address-list" and add them all under the same address list (the name is irrelevant, as long as all allowed addresses share that same name). Then, do
to connect the LANs to each other, and finally, to enable internet access to the allowed clients, do
replacing "NAT1" with the actual name of the address list.
As for allowing them internet access, this is a NAT-ed network, so we go back to what I said: Add every allowed client in "/ip firewall address-list" and add them all under the same address list (the name is irrelevant, as long as all allowed addresses share that same name). Then, do
Code: Select all
/ip firewall nat add chain="srcnat" dst-address="192.168.252.0/22" action="src-nat" to-addresses="192.168.252.1"
/ip firewall nat add chain="srcnat" dst-address="192.168.253.0/29" action="src-nat" to-addresses="192.168.253.1"
/ip firewall nat add chain="srcnat" dst-address="192.168.0.7/30" action="src-nat" to-addresses="192.168.0.8"
/ip firewall nat add chain="srcnat" dst-address="192.168.0.11/30" action="src-nat" to-addresses="192.168.0.12"Code: Select all
/ip firewall nat add chain="srcnat" src-address-list="NAT1" action="src-nat" to-addresses="192.168.0.1"