Page 1 of 1

alternate gateway for certain ip/sites

Posted: Sun Mar 11, 2012 12:39 pm
by neelzx
I want to configure two gateways..gateway 1st as my gateway to my another intranet..while i need to add gateway 2 for giving access to internet to some users in my lan.. Please help me how do i do this...i am new to mikrotik...in cisco i could do this by defining some access command list and forward to gateway 2 for those ips...

Regards:)

Re: alternate gateway for certain ip/sites

Posted: Sun Mar 11, 2012 2:36 pm
by boen_robot
You can specify the different gateways at "/ip route" menu. And then somewhere within the "/ip firewall" menu, you can limit access. Where exactly in "/ip firewall" depends on the way you've set up your LAN.

If your network is a NAT-ted one like mine, then you can simply add all allowed clients in a list at "/ip firewall address-list", and then create a single rule in "/ip firewall nat" that operates on that list.

In other instances, the "filter" or "mangle" sections can help.

Re: alternate gateway for certain ip/sites

Posted: Sun Mar 11, 2012 4:25 pm
by neelzx
THIS IS WHAT MY NETWORK LOOK LIKE

Re: alternate gateway for certain ip/sites

Posted: Mon Mar 12, 2012 4:29 pm
by boen_robot
Are the IPs 192.168.0.8/30 and 192.168.0.12/30 assigned to that same MikroTik device as the 192.168.252.1/22 and 192.168.253.1/29 (though on another interface I assume)? If not, assign another IP to the MikroTik device.

As for allowing them internet access, this is a NAT-ed network, so we go back to what I said: Add every allowed client in "/ip firewall address-list" and add them all under the same address list (the name is irrelevant, as long as all allowed addresses share that same name). Then, do
/ip firewall nat add chain="srcnat" dst-address="192.168.252.0/22" action="src-nat" to-addresses="192.168.252.1"
/ip firewall nat add chain="srcnat" dst-address="192.168.253.0/29" action="src-nat" to-addresses="192.168.253.1"
/ip firewall nat add chain="srcnat" dst-address="192.168.0.7/30" action="src-nat" to-addresses="192.168.0.8"
/ip firewall nat add chain="srcnat" dst-address="192.168.0.11/30" action="src-nat" to-addresses="192.168.0.12"
to connect the LANs to each other, and finally, to enable internet access to the allowed clients, do
/ip firewall nat add chain="srcnat" src-address-list="NAT1" action="src-nat" to-addresses="192.168.0.1"
replacing "NAT1" with the actual name of the address list.