Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest
The Mikrotik RouterOS config, tips and tricks thread
Comments
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
-
-
-
-
Thanks for that, have made those necessary changes. Below is my export compact output. Went a bit made on the firewall filters!!!
Still no luck with the WOL over the internet. Think I'm using the tool sniffer correctly, but see nothing coming in for udp port 9? I'm sure I've something wrong.
Also had to disable the hairpin rule, should that be expected?
Forgive all the queries, but is a bit of a learning curve
# nov/27/2013 00:13:47 by RouterOS 6.6 # software id = 4X3Q-QATT # /interface bridge add admin-mac=00:0C:42:B7:XX:XX auto-mac=no l2mtu=1598 name=bridge-local \ protocol-mode=rstp /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=\ 20/40mhz-ht-above disabled=no distance=indoors frequency=2437 \ ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 mode=ap-bridge ssid=\ SSID wireless-protocol=802.11 /interface ethernet set [ find default-name=ether1 ] name=ether1-gateway set [ find default-name=ether2 ] name=ether2-master-local set [ find default-name=ether3 ] master-port=ether2-master-local name=\ ether3-slave-local set [ find default-name=ether4 ] master-port=ether2-master-local name=\ ether4-slave-local set [ find default-name=ether5 ] master-port=ether2-master-local name=\ ether5-slave-local /ip neighbor discovery set wlan1 discover=no /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=\ dynamic-keys wpa-pre-shared-key=XXX wpa2-pre-shared-key=\ XXX /ip hotspot user profile set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \ mac-cookie-timeout=3d /ip pool add name=dhcp ranges=192.168.61.9-192.168.61.254 /ip dhcp-server add address-pool=dhcp disabled=no interface=bridge-local name=default /system logging action set 0 memory-lines=100 set 1 disk-lines-per-file=100 /interface bridge port add bridge=bridge-local interface=ether2-master-local add bridge=bridge-local interface=wlan1 /ip address add address=192.168.61.1/24 comment="default configuration" interface=\ bridge-local network=192.168.61.0 /ip dhcp-client add comment="default configuration" dhcp-options=hostname,clientid disabled=\ no interface=ether1-gateway /ip dhcp-server lease add address=192.168.61.9 client-id=1:0:25:90:c:53:1c mac-address=\ 00:25:90:0C:XX:XX server=default add address=192.168.61.10 client-id=1:0:f:b5:db:84:17 mac-address=\ 00:0F:B5:DB:XX:XX server=default /ip dhcp-server network add address=192.168.61.0/24 comment="default configuration" dns-server=\ 192.168.61.1 gateway=192.168.61.1 netmask=24 /ip dns set allow-remote-requests=yes cache-size=4096KiB max-udp-packet-size=512 \ servers=89.101.160.5,89.101.160.4 /ip dns static add address=192.168.61.1 name=router /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=input comment="default configuration" disabled=yes \ in-interface=ether1-gateway add chain=forward comment="default configuration" connection-state=\ established add chain=forward comment="default configuration" connection-state=related add action=drop chain=forward comment="default configuration" \ connection-state=invalid add chain=input comment="allow ICMP" protocol=icmp add chain=input comment="allow winbox" dst-port=8291 protocol=tcp add chain=input comment="allow api" dst-port=8728 protocol=tcp add action=add-src-to-address-list address-list=trying_to_login \ address-list-timeout=1d chain=input comment=\ "list IP's who try remote login" dst-port=20-23 protocol=tcp add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp add chain=input comment="allow ssh" dst-port=22 protocol=tcp add chain=input comment="accept vpn" dst-port=1723 in-interface=\ ether1-gateway protocol=tcp add chain=input comment="accept vpn gre" in-interface=ether1-gateway \ protocol=gre add action=drop chain=input comment="drop ftp" dst-port=21 protocol=tcp add action=drop chain=forward comment="drop invalid connections" \ connection-state=invalid add chain=forward comment="allow already established connections" \ connection-state=established add chain=forward comment="allow related connections" connection-state=\ related add action=drop chain=input comment="drop Invalid connections" \ connection-state=invalid add chain=input comment="allow established connections" connection-state=\ established add chain=input comment="acccept lan" in-interface=!ether1-gateway \ src-address=192.168.61.0/24 add action=drop chain=input comment="drop everything else" /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" \ out-interface=ether1-gateway add action=dst-nat chain=dstnat comment=\ "tcp from port 443 to 443 (lan ip 192.168.61.9)" dst-port=443 \ in-interface=ether1-gateway protocol=tcp to-addresses=192.168.61.9 \ to-ports=443 add action=dst-nat chain=dstnat comment="WOL WHS" \ dst-port=9 port="" protocol=udp to-addresses=\ 192.168.61.255 to-ports=9 add action=masquerade chain=srcnat comment="hairpin nat rule" disabled=yes \ dst-address=192.168.61.9 src-address=192.168.61.0/24 to-addresses=0.0.0.0 /ip service set www disabled=yes set api disabled=yes /ip upnp set allow-disable-external-interface=no enabled=yes show-dummy-rule=no /ip upnp interfaces add interface=bridge-local type=internal add interface=ether1-gateway type=external /system leds set 0 interface=wlan1 /system ntp client set enabled=yes mode=unicast primary-ntp=140.203.204.77 /system scheduler add interval=4w2d name="backup config" on-event=\ "/system script run backup\r\ \n" policy=\ ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \ start-time=startup /system script add name=backup policy=\ ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \ source="/export file=([/system identity get name] . \"-\" . \\\ \n[:pick [/system clock get date] 7 11] . [:pick [/system clock get date] \ 0 3] . [:pick [/system clock get date] 4 6]); \\\ \n/tool e-mail send to=\"address@email.com\" subject=([/system identity g\ et name] . \" Backup \" . \\\ \n[/system clock get date]) file=([/system identity get name] . \"-\" . [:\ pick [/system clock get date] 7 11] . \\\ \n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4\ \_6] . \".rsc\"); :delay 10; \\\ \n/file rem [/file find name=([/system identity get name] . \"-\" . [:pick\ \_[/system clock get date] 7 11] . \\\ \n[:pick [/system clock get date] 0 3] . [:pick [/system clock get date] 4\ \_6] . \".rsc\")]; \\\ \n:log info (\"System Backup emailed at \" . [/sys cl get time] . \" \" . \ [/sys cl get date])" /tool e-mail set address=173.194.66.108 from=<>MikroTik@gmail.com.com password=\ pwd port=465 start-tls=yes user=address@email.com /tool mac-server set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local /tool mac-server mac-winbox set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local0 -
Advertisement
-
-
-
-
-
-
-
-
-
-
Advertisement
-
-
-
-
-
-
-
Advertisement
-
-
Hey guys. been lurking in this thread a while and finally picked up my first mikrotik, an RB2011UAS-2HnD.
anyway, as i suspected, ive no idea what im doing. ive fiddled with some DD-WRT, but i'd say im still a novice.
I followed the thread and set it up the best i can.
can any of yea check over my setup and spot any problems?
compact export:[admin@MikroTik] > export compact # feb/03/2014 12:12:01 by RouterOS 6.7 # software id = RB2011U # /interface bridge add admin-mac=D4:CA:6D:D8:48:E5 auto-mac=no l2mtu=1598 name=bridge-local \ protocol-mode=rstp /interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=\ 20/40mhz-ht-above country=ireland disabled=no distance=indoors frequency=\ 2447 l2mtu=2290 mode=ap-bridge ssid=Temp wireless-protocol=802.11 /interface ethernet set [ find default-name=ether1 ] name=ether1-gateway set [ find default-name=ether6 ] name=ether6-master-local set [ find default-name=ether7 ] master-port=ether6-master-local name=\ ether7-slave-local set [ find default-name=ether8 ] master-port=ether6-master-local name=\ ether8-slave-local set [ find default-name=ether9 ] master-port=ether6-master-local name=\ ether9-slave-local set [ find default-name=ether10 ] master-port=ether6-master-local name=\ ether10-slave-local set [ find default-name=sfp1 ] name=sfp1-gateway /ip neighbor discovery set ether1-gateway discover=no set sfp1-gateway discover=no /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa2-psk mode=dynamic-keys \ wpa-pre-shared-key=yourealeech wpa2-pre-shared-key=yourealeech /ip hotspot profile add dns-name=google hotspot-address=10.5.50.1 name=hsprof1 /ip hotspot user profile set [ find default=yes ] idle-timeout=none keepalive-timeout=2m \ mac-cookie-timeout=3d /ip ipsec proposal set [ find default=yes ] enc-algorithms=3des /ip pool add name=default-dhcp ranges=192.168.88.10-192.168.88.254 add name=hs-pool-1 ranges=10.5.50.2-10.5.50.254 /ip dhcp-server add address-pool=default-dhcp disabled=no interface=bridge-local name=default /port set 0 name=serial0 /system logging action set 0 memory-lines=100 set 1 disk-lines-per-file=100 /interface bridge port add bridge=bridge-local interface=ether2 add bridge=bridge-local interface=ether3 add bridge=bridge-local interface=ether4 add bridge=bridge-local interface=ether5 add bridge=bridge-local interface=ether6-master-local add bridge=bridge-local interface=wlan1 /ip address add address=192.168.88.1/24 comment="default configuration" interface=wlan1 \ network=192.168.88.0 add address=10.5.50.1/24 comment="hotspot network" interface=sfp1-gateway \ network=10.5.50.0 /ip dhcp-client add comment="default configuration" dhcp-options=hostname,clientid disabled=\ no interface=sfp1-gateway add comment="default configuration" dhcp-options=hostname,clientid disabled=\ no interface=ether1-gateway /ip dhcp-server network add address=192.168.88.0/24 comment="default configuration" dns-server=\ 192.168.88.1 gateway=192.168.88.1 netmask=24 /ip dns set allow-remote-requests=yes cache-size=4096KiB max-udp-packet-size=512 \ servers=8.8.8.8,8.8.4.4 /ip dns static add address=192.168.88.1 name=router /ip firewall filter add action=passthrough chain=unused-hs-chain comment=\ "place hotspot rules here" disabled=yes add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=input comment="default configuration" in-interface=\ sfp1-gateway add action=drop chain=input comment="default configuration" in-interface=\ ether1-gateway add chain=forward comment="default configuration" connection-state=\ established add chain=forward comment="default configuration" connection-state=related add action=drop chain=forward comment="default configuration" \ connection-state=invalid add chain=input comment="allow ICMP" protocol=icmp add chain=input comment="allow winbox" dst-port=8291 protocol=tcp add chain=input comment="allow api" dst-port=8728 protocol=tcp add action=add-src-to-address-list address-list=trying_to_login \ address-list-timeout=1d chain=input comment=\ "list IP's who try remote login" dst-port=20-23 protocol=tcp add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp add chain=input comment="allow ssh" dst-port=22 protocol=tcp add chain=input comment="accept vpn" dst-port=1723 in-interface=\ ether1-gateway protocol=tcp add chain=input comment="accept vpn gre" in-interface=ether1-gateway \ protocol=gre add action=drop chain=input comment="drop ftp" dst-port=21 protocol=tcp add action=drop chain=forward comment="drop invalid connections" \ connection-state=invalid add chain=forward comment="allow already established connections" \ connection-state=established add chain=forward comment="allow related connections" connection-state=\ related add action=drop chain=input comment="drop Invalid connections" \ connection-state=invalid add chain=input comment="allow established connections" connection-state=\ established add chain=input comment="acccept lan" in-interface=!ether1-gateway \ src-address=192.168.88.0/24 add action=drop chain=input comment="drop everything else" /ip firewall nat add action=passthrough chain=unused-hs-chain comment=\ "place hotspot rules here" disabled=yes to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment="default configuration" \ out-interface=sfp1-gateway add action=masquerade chain=srcnat comment="default configuration" \ out-interface=ether1-gateway to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment=masquerade out-interface=\ ether1-gateway add action=masquerade chain=srcnat comment="hairpin nat rule" dst-address=\ 192.168.88.252 src-address=192.168.88.0/24 to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment="masquerade hotspot network" \ src-address=10.5.50.0/24 /ip hotspot user add name=user password=guest /ip upnp set allow-disable-external-interface=no enabled=yes show-dummy-rule=no /ip upnp interfaces add interface=bridge-local type=internal add interface=ether1-gateway type=external /lcd interface set sfp1-gateway interface=sfp1-gateway set ether1-gateway interface=ether1-gateway set ether2 interface=ether2 set ether3 interface=ether3 set ether4 interface=ether4 set ether5 interface=ether5 set ether6-master-local interface=ether6-master-local set ether7-slave-local interface=ether7-slave-local set ether8-slave-local interface=ether8-slave-local set ether9-slave-local interface=ether9-slave-local set ether10-slave-local interface=ether10-slave-local set wlan1 interface=wlan1 /lcd interface pages set 0 interfaces="sfp1-gateway,ether1-gateway,ether2,ether3,ether4,ether5,ethe\ r6-master-local,ether7-slave-local,ether8-slave-local,ether9-slave-local,e\ ther10-slave-local" /system clock set time-zone-name=Europe/Dublin /system ntp client set enabled=yes mode=unicast primary-ntp=140.203.204.77 /tool mac-server set [ find default=yes ] disabled=yes add interface=ether2 add interface=ether3 add interface=ether4 add interface=ether5 add interface=ether6-master-local add interface=ether7-slave-local add interface=ether8-slave-local add interface=ether9-slave-local add interface=wlan1 add interface=bridge-local /tool mac-server mac-winbox set [ find default=yes ] disabled=yes add interface=ether2 add interface=ether3 add interface=ether4 add interface=ether5 add interface=ether6-master-local add interface=ether7-slave-local add interface=ether8-slave-local add interface=ether9-slave-local add interface=wlan1 add interface=bridge-local [admin@MikroTik] >
firewall:[admin@MikroTik] > ip firewall export # feb/03/2014 01:03:47 by RouterOS 6.7 # software id = LPZD-ULH5 # /ip firewall filter add action=passthrough chain=unused-hs-chain comment=\ "place hotspot rules here" disabled=yes add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=input comment="default configuration" in-interface=\ sfp1-gateway add action=drop chain=input comment="default configuration" in-interface=\ ether1-gateway add chain=forward comment="default configuration" connection-state=\ established add chain=forward comment="default configuration" connection-state=related add action=drop chain=forward comment="default configuration" \ connection-state=invalid add chain=input comment="allow ICMP" protocol=icmp add chain=input comment="allow winbox" dst-port=8291 protocol=tcp add chain=input comment="allow api" dst-port=8728 protocol=tcp add action=add-src-to-address-list address-list=trying_to_login \ address-list-timeout=1d chain=input comment=\ "list IP's who try remote login" dst-port=20-23 protocol=tcp add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 \ protocol=tcp src-address-list=ssh_blacklist add action=add-src-to-address-list address-list=ssh_blacklist \ address-list-timeout=1w3d chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage3 add action=add-src-to-address-list address-list=ssh_stage3 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage2 add action=add-src-to-address-list address-list=ssh_stage2 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp src-address-list=ssh_stage1 add action=add-src-to-address-list address-list=ssh_stage1 \ address-list-timeout=1h chain=input connection-state=new dst-port=22 \ protocol=tcp add chain=input comment="allow ssh" dst-port=22 protocol=tcp add chain=input comment="accept vpn" dst-port=1723 in-interface=\ ether1-gateway protocol=tcp add chain=input comment="accept vpn gre" in-interface=ether1-gateway \ protocol=gre add action=drop chain=input comment="drop ftp" dst-port=21 protocol=tcp add action=drop chain=forward comment="drop invalid connections" \ connection-state=invalid add chain=forward comment="allow already established connections" \ connection-state=established add chain=forward comment="allow related connections" connection-state=\ related add action=drop chain=input comment="drop Invalid connections" \ connection-state=invalid add chain=input comment="allow established connections" connection-state=\ established add chain=input comment="acccept lan" in-interface=!ether1-gateway \ src-address=192.168.88.0/24 add action=drop chain=input comment="drop everything else" /ip firewall nat add action=passthrough chain=unused-hs-chain comment=\ "place hotspot rules here" disabled=yes to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment="default configuration" \ out-interface=sfp1-gateway add action=masquerade chain=srcnat comment="default configuration" \ out-interface=ether1-gateway to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment=masquerade out-interface=\ ether1-gateway add action=masquerade chain=srcnat comment="hairpin nat rule" dst-address=\ 192.168.88.252 src-address=192.168.88.0/24 to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment="masquerade hotspot network" \ src-address=10.5.50.0/24
ip firewall nat export[admin@MikroTik] > ip firewall nat export # jan/28/2014 08:35:15 by RouterOS 6.7 # software id = LPZD-ULH5 # /ip firewall nat add action=passthrough chain=unused-hs-chain comment=\ "place hotspot rules here" disabled=yes add action=masquerade chain=srcnat comment="default configuration" \ out-interface=sfp1-gateway add action=masquerade chain=srcnat comment="default configuration" \ out-interface=ether1-gateway to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment=masquerade out-interface=\ ether1-gateway add action=masquerade chain=srcnat comment="hairpin nat rule" dst-address=\ 192.168.88.252 src-address=192.168.88.0/24 to-addresses=0.0.0.0 add action=masquerade chain=srcnat comment="masquerade hotspot network" \ src-address=10.5.50.0/24 [admin@MikroTik] >
my setup is as follows:
questions:
1) is my firewall sufficient?
2) i assume im double NAT'd. can i fix that with the limited access i have to my Thompson UPC router?
3) suggest me a DNS server? does all my traffic flow through 2 DNS's technically due to passing through UPC's DNS on the Thompson router? (which cant be modified:mad:) can that be fixed?
4) I want to monitor bandwidth passing through the router, or technically Ether1 port, on a monthly basis. ive worked out its in "queues" but that's as far as i get. I don't care for individual mac address monitoring or anything, just overall usage. help? any scripts to run? I can find my way around winbox/terminals.
5) I want to set up a second WLAN, a guest network. i want this network limited to around 5MB down/3MB up. if its not too complex, i want the guest network to not have access to the internal WLAN1 or LAN1. can i monitor the guest network "WLAN2" bandwidth separately?
i tried my hand at the hotspot setup but i made a hash of it so i think i deleted it but its popping up in some of that code some im not sure?
thanks for even reading this far. if you have ANY tips/tricks/MUST-DO's/etc that you think a noob wouldn't know, any comments appreciated.:o
OT: its been a while since ive been on boards, and im sorry to see Pog has closed his account. thanks for all the help here and elsewhere buddy
0 -
-
Wow, just discovered the new Routerboard CRS125-24G-1S-2HnD-IN, what a beast, check this:
24Gigabit ports, SFP and Micro Usb port and 802.11n AP
http://www.interprojekt.com.pl/mikrotik-routerboard-crs12524g1s2hndin-p-1473.html
http://www.ebay.ie/itm/MikroTik-RouterBoard-CRS125-24G-1S-2HnD-IN-Cloud-Router-Switch-/181284411756?pt=US_Network_Switches&hash=item2a3564996c0 -
-
Advertisement
-
-
-
-
-
-
-
-
-
-
-
Advertisement
Advertisement