MikroTik

Can someone please post documentation on how to use Proxy-ARP so that we can operate a "station" and "AP" as a repeater in a proxy-arp bridging scenerio?

For example:
Wlan1 - 5Ghz Station, linked to 5Ghz AP
Wlan2 - 2.4Ghz AP, linked to clients
Ether1 - General Ethernet client access (should also be proxy-arp)

We want to use 10.50.51.102/24 as the IP on wlan1, and gw of 10.50.51.1.

Clients would use 10.50.51.x/24 (except .1 or .102) with a gw of 10.50.51.1.

We had this working temporarly, but it broke, by setting up multiple IP's on interfaces and then adding static routes with a distance of zero, pointed to the IP of each interface. This worked for about an hour, then after coming back after roaming to another AP, I was unable to use any of the IP's that had previously worked and nothing was working at all via proxy-arp.

Here is the setup I was using that was kind-of working, but broke later, (possibly due to ARP issues).

---

Wlan1: 10.50.51.102/24, arp=proxy-arp
Wlan2: 10.50.52.1/24, arp=proxy-arp

Set default route properly:
0.0.0.0/0 gw 10.50.51.1 and distance=1 (default distance)
Add a route for 0.0.0.0/0 with gw 10.50.51.102 and distance=0
Add a route for 0.0.0.0/0 with gw 10.50.52.1 and distance=0

Routes show that they are pointed to the right interface and appear to learn fine.

Then, reboot (without a reboot, things don't appear to work exactly
right, or it may take a little while for ARP tables to update properly).

I've tested this and had it working for a long time. I was bridging
IP's such as 10.x.x.x as well as 209.x.x.x, while wlan1 was a station
adapter associated to a 5Ghz link.

But, I drove around, roamed with those IP's to other AP's, all was
working great. I came back to the original place where I set this up
and was unable to browse. I was unable to get past the router, but I
could contact the router if I used a backup subnet address for management.

I believe I may be missing part of the configuration, because it seems
like the config was working, but stopped, possibly due to ARP update issues.
---

What am I doing wrong? How do I get proxy-arp (aka proxy-arp bridging) to work as it does in other software router packages or similar to what a CB3 bridge does?

I've tried dozens of different configuration options, setting proxy-arp only on one interface, internal OR external, or both, turned bridging on, off, etc. I'm just not having any luck with it.

Any help is greatly appreciated.

Thanks,
Judd

Have you read the manual?

http://www.mikrotik.com/docs/ros/2.9/ip ... 4496330887

Of Course I've read the manual, about 20 times. The proxy-arp example in the manual refers to use of PPPoE. I'm not using PPPoE.

I know of others who are very technical and cannot understand exactly how to configure these settings.

Please write some specific documentation to this issue. Its very simple to turn on proxy-arp bridging in another OS, but so far, its been impossible to set it up and keep it working under Mikrotik.

I've spent 2 weeks trying various settings and reading manuals, including reading manuals on referred to in other threads related to this issue. I've read various firewall manuals as well as manuals pertaining specifically to proxy-arp.

I've duplicated the configuration as documented, but without using PPPoE (as this is the goal) and it doesn't work.

Have you actually read the manual and tried it?

well, this example is not for pppoe, have you tried this:
http://www.mikrotik.com/docs/ros/2.9/ip ... 5832968955

That example does not work as true proxy-arp should.

By looking at that example, it makes the lower half of your subnet unusable. This does not allow for roaming IP's from AP to AP, it requires that upper IP's are always used.

Correct or incorrect?

Rather than doing that, its easier to split a /24 into a /25 and route it normally. But that still doesn't achieve the solution that is already supported by low cost devices such as the CB3, or other router OS's.

I believe its just that someone has to properly document how to set this up, so that customers with any IP can roam from AP to AP while using proxy-ARP.

The example you pointed out, also only allows the use of a single subnet, it doesn't allow the use of other public and private IP addresses without specifically configuring the router for each subnet and each subnet is still broken into smaller pieces than it should be.

Judd

You are trying to pound a nail with a screwdriver, you may have some limited success, but it's the wrong tool.

What the CB3 (and almost all other "bridging" 802.11 station adaptors) do is not Proxy-ARP, it's MAC-NAT. These are distinct concepts, even though they may appear superfically similar.

Enabling a Proxy-ARP interface will cause that interface to answer ARP requests on behalf of IPs that it can deliver packets to. This causes the device that made the request learn an ARP association between the MAC address of the Proxy-ARP device, and the IP address that was arped for.

The Proxy-ARP device does not keep any special mapping tables, and simply routes the packets according to it's routing tables, decrementing the TTL and everything. It doesn't really try to look like bridging, but can have some similar effects.

In a MAC-NAT setup (such as what is used by 802.11 stations to fake out bridging), the MAC-NAT device does keep an internal translation table, much like conventional NAT. The MAC-NAT device will replace the source MAC address inside the ethernet frame, with it's own MAC (or the MAC address it used to register with the AP). On the return trip, the packet is referanced against the device's translation table, and the appropriate "true" destination MAC replaces the device's own. This method does often look like bridging.

MT does now have a MAC-NAT system in 2.9, but I haven't played around with it yet.

IMHO, Proxy-ARP is dangerous unless used very carefully, and under specific circumstances (i.e. making a PPP tunnel appear to exist within a subnet).

Also, MAC-NAT is a rather dirty-hack way of overcoming a limitation in 802.11, but if you must "bridge" onto a regular 802.11 network, it's often the only way.

All in all, I try to avoid bridging like the plague (even true 802.1d). Layer 3 networks are much easier to debug, are much more flexable, and are less prone to problems.

Ok then, can anyone describe how to setup a MAC-NAT configuration on Mikrotik?

No need to try to talk me out of bridging, we're doing it anyway.

Judd