Page 1 of 1

Problem I think with firewall ???? Maybe you can help

Posted: Fri Oct 14, 2005 5:29 pm
by krybabie
Hi

I have a Mikrotik setup to use IP addresses provided by my DSL ISP.

The Ip's are passed through a Cisco 837 router and have a /29 netmask.
The Ip's i think are passed via a VPN tunnel from the ISP.
The IP's are Static and thus provided over the VPN.

I have a problem thus

I have assign x.x.x.130 to the mikrotik
The Cisco is x.x.x.129
The netblock is x.x.x.128/29 thus x.x.x.128 - x.x.x.135

The IP address i have bound onto a server is x.x.x.131. It also has another live IP of y.y.y.220.

I have added a static route for x.x.x.131/32 to point to the server on y.y.y.220.


This is the problem .... the mikrotik has an address y.y.y.221

I can not allow traffic on the y.y.y.216/29 network to not flow

When i set the server's default gateway to the mikrotik and not to the y.y.y.217 I can ping the server but not ssh or telnet to ports 25 110 3389 and 80

Any idea's - when it runs with the other network of y.y.y.217 as the default gateway thus bypassing the mikrotik everything works.

When i set the Mikrotik as default everything dies..


Any ideas.....


Regards

Malcolm

Posted: Fri Oct 14, 2005 5:53 pm
by wildbill442
Are you using masquerading or are the y.y.y.y/29 addresses public IP's? if so are there routes to them in the cisco router and the mikrotik? (if the mikrotik is just being bridged then it just needs a default route to be managed outside the local segment.

What are you trying to accomplish with the mikrotk? Transparent firewalling, routing, bandwidth shaping?

also, what is y.y.y.217?

Posted: Mon Oct 17, 2005 12:26 pm
by krybabie
Hi

The mikrotik must Run the whole system

the y.y.y.217 is a Cisco router 1601 that brings a serial line in.


The mikrotik will be the core router for the site

If i make it the defaut route the x.x.x network can browse

but if i try hit x.x.x.131 or y.y.y.220 on ports 80,25,110 or 3389 it does not go through.

I have setup the mikrotik with a route to x.x.x.131 via y.y.y.220 i suspect the ping will go through but TCP traffic might not be able to route correctly

Any ideas

Regards

Malcolm