I'm currently running a hotspot on a bridge (EtherNet_WiFi_EoIP_Bridge in the code below) I created between my Ethernet and Wifi interfaces. On that bridge I'm running a hotspot. There is however a second interface on my MT that I use to connect to a wug (CTWUG_Link interface in the code below)(WUG - Wireless User Group). I've added walled-garden ip rules to allow traffic within the local (192.168.0.0/24) subnet and the wug (172.16.0.0/12) subnet. These rules seem to work perfectly as they should when a user is not authenticated by the hotspot. But traffic across any one of these (mentioned above) subnets, from authenticated users adds to that users' usage. As I understand, that is exactly what the walled-garden should do. Which is great. But I would like for internal (Ie: local and wug subnets) to be completely free. Thus only traffic crossing my internet interface (Vodacom_3G in the code below) should be accounted for and billed to each user. Thereby not counting any internal (local and wug related) data.
The setup is as follows:
Code: Select all
[Jeandre@MikroTik] > interface print
Flags: D - dynamic, X - disabled, R - running, S - slave
# NAME TYPE MTU L2MTU MAX-L2MTU
0 R ;;; WiFi Network Interface
Marshal_Network_Wifi wlan 1500 2290
1 R ;;; Connection Interface to CTWUG
CTWUG_Link wlan 1500 2290
2 R ;;; Lan Network Interface
EtherNet_1 ether 1500 1526
3 R ;;; Bridge Interface - To bridge lan and wifi to one network and ip range
Ethernet_Wifi_EoIP_Bridge bridge 1500 1526
4 R ;;; WAN Network Interface - Internet - Vodacom 3G via mini-pci-e
VodaCom_3G ppp-out 1500
5 X ;;; VPN%0#PPTP Client to Connect to STB - VPN to Jeandre
JeandreSTB pptp-out
6 R ;;; EoIP Tunnel through PPTP to Jeandre STB
EoIP-JeandreSTB eoip-tunnel 1340 65535
[Jeandre@MikroTik] > interface bridge print
Flags: X - disabled, R - running
0 R ;;; Bridge Interface - To bridge lan and wifi to one network and ip range
name="Ethernet_Wifi_EoIP_Bridge" mtu=1500 l2mtu=1526 arp=enabled
mac-address=00:0C:42:49:04:6C protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:0C:42:49:04:6C max-message-age=20s
forward-delay=15s transmit-hold-count=6 ageing-time=5m
[Jeandre@MikroTik] > interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
# INTERFACE BRIDGE PRIORITY PATH-COST HORIZON
0 EtherNet_1 Ethernet_Wifi_EoI... 0x80 10 none
1 Marshal_Network_Wifi Ethernet_Wifi_EoI... 0x80 10 none
2 EoIP-JeandreSTB Ethernet_Wifi_EoI... 0x80 10 none
[Jeandre@MikroTik] > ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK INTERFACE
0 ;;; default configuration
192.168.0.100/24 192.168.0.0 Ethernet_Wifi_EoIP_Bridge
1 ;;; CTWUG Config - Note Masquarade 192.168.0.0/24 Range over CTWUG_Link
172.18.50.38/32 172.18.50.254 CTWUG_Link
2 D x.x.x.x/32 x.x.x.x VodaCom_3G
[Jeandre@MikroTik] > ip hotspot walled-garden ip print
Flags: X - disabled, I - invalid
# SERVER PROTOCOL DST-HOST DST-ADDRESS DST-PORT ACTION
0 ;;; Access for users to access the internal network - Bypass usage counters
Marshall-Ne... 192.168.0.0/24 accept
1 ;;; Access for users to access CTWUG - Bypass usage counters
Marshall-Ne... 172.16.0.0/12 accept
[Jeandre@MikroTik] > ip firewall filter print all
Flags: X - disabled, I - invalid, D - dynamic
0 D chain=forward action=jump jump-target=hs-unauth hotspot=from-client,!auth
1 D chain=forward action=jump jump-target=hs-unauth-to hotspot=to-client,!auth
2 D chain=input action=jump jump-target=hs-input hotspot=from-client
3 D chain=input action=drop protocol=tcp hotspot=!from-client dst-port=64872-64875
4 I chain=hs-input action=jump jump-target=pre-hs-input
5 D chain=hs-input action=accept protocol=udp dst-port=64872
6 D chain=hs-input action=accept protocol=tcp dst-port=64872-64875
7 D ;;; Access for users to access the internal network - Bypass usage counters
chain=hs-unauth action=return dst-address=192.168.0.0/24 in-interface=Ethernet_Wifi_EoIP_Bridge
8 D ;;; Access for users to access CTWUG - Bypass usage counters
chain=hs-unauth action=return dst-address=172.16.0.0/12 in-interface=Ethernet_Wifi_EoIP_Bridge
9 D chain=hs-input action=jump jump-target=hs-unauth hotspot=!auth
10 D chain=hs-unauth action=reject reject-with=tcp-reset protocol=tcp
11 D ;;; Access for users to access the internal network - Bypass usage counters
chain=hs-unauth-to action=return src-address=192.168.0.0/24 out-interface=Ethernet_Wifi_EoIP_Bridge
12 D ;;; Access for users to access CTWUG - Bypass usage counters
chain=hs-unauth-to action=return src-address=172.16.0.0/12 out-interface=Ethernet_Wifi_EoIP_Bridge
13 D chain=hs-unauth action=reject reject-with=icmp-net-prohibited
14 D chain=hs-unauth-to action=reject reject-with=icmp-host-prohibited
15 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough
16 X ;;; VPN-Up#vpn-ul@54345133%7059774
chain=forward action=accept out-interface=JeandreSTB
17 X ;;; VPN-Down#vpn-dl@49095379%9514034
chain=forward action=accept in-interface=JeandreSTB
18 X ;;; Jeandre-Upload
chain=forward action=accept src-address-list=Jeandre out-interface=VodaCom_3G
19 X ;;; Jeandre-Download
chain=forward action=accept dst-address-list=Jeandre in-interface=VodaCom_3G
20 X ;;; Calvin-Upload
chain=forward action=accept src-address-list=Calvin out-interface=VodaCom_3G
21 X ;;; Calvin-Download
chain=forward action=accept dst-address-list=Calvin in-interface=VodaCom_3G
22 X ;;; Elizabeth-Upload
chain=forward action=accept src-address-list=Elizabeth out-interface=VodaCom_3G
23 X ;;; Elizabeth-Download
chain=forward action=accept dst-address-list=Elizabeth in-interface=VodaCom_3G
24 X ;;; Anthony-Upload
[Jeandre@MikroTik] > ip firewall nat print all
Flags: X - disabled, I - invalid, D - dynamic
0 D chain=dstnat action=jump jump-target=hotspot hotspot=from-client
1 I chain=hotspot action=jump jump-target=pre-hotspot
2 D chain=hotspot action=redirect to-ports=64872 protocol=udp dst-port=53
3 D chain=hotspot action=redirect to-ports=64872 protocol=tcp dst-port=53
4 D chain=hotspot action=redirect to-ports=64873 protocol=tcp hotspot=local-dst dst-port=80
5 D chain=hotspot action=redirect to-ports=64875 protocol=tcp hotspot=local-dst dst-port=443
6 D chain=hotspot action=jump jump-target=hs-unauth protocol=tcp hotspot=!auth
7 D chain=hotspot action=jump jump-target=hs-auth protocol=tcp hotspot=auth
8 D ;;; Access for users to access the internal network - Bypass usage counters
chain=hs-unauth action=return dst-address=192.168.0.0/24 in-interface=Ethernet_Wifi_EoIP_Bridge
9 D ;;; Access for users to access CTWUG - Bypass usage counters
chain=hs-unauth action=return dst-address=172.16.0.0/12 in-interface=Ethernet_Wifi_EoIP_Bridge
10 D chain=hs-unauth action=redirect to-ports=64874 protocol=tcp dst-port=80
11 D chain=hs-unauth action=redirect to-ports=64874 protocol=tcp dst-port=3128
12 D chain=hs-unauth action=redirect to-ports=64874 protocol=tcp dst-port=8080
13 D chain=hs-unauth action=redirect to-ports=64875 protocol=tcp dst-port=443
14 I chain=hs-unauth action=jump jump-target=hs-smtp protocol=tcp dst-port=25
15 D chain=hs-auth action=redirect to-ports=64874 protocol=tcp hotspot=http
16 I chain=hs-auth action=jump jump-target=hs-smtp protocol=tcp dst-port=25
17 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough
18 ;;; DC++ Nat to forward all port 2222 traffic to Media-Center (192.168.0.150)
chain=dstnat action=dst-nat to-addresses=192.168.0.150 to-ports=2222 protocol=tcp in-interface=CTWUG_Link dst-port=2222
19 ;;; DC++ Nat to forward all port 2222 traffic to Media-Center (192.168.0.150)
chain=dstnat action=dst-nat to-addresses=192.168.0.150 to-ports=2222 protocol=udp in-interface=CTWUG_Link dst-port=2222
20 ;;; Masquerade for VodaCom_3G Network - Translate private ip range to public ip address
chain=srcnat action=masquerade out-interface=VodaCom_3G
21 ;;; Masquerade Private IP-Range to CTWUG
chain=srcnat action=masquerade out-interface=CTWUG_Link Any help will be greatly appreciated.
Thanks
Amazing /product/ for free!
