Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
The Mikrotik RouterOS config, tips and tricks thread
Options
Comments
-
-
-
smee again wrote: »PPPoE is the protocol being used to get your public IP on the Eircom modem, you need to add it on the Mikrotik so it gets your public IP, not the Eircom modem
Caching what? To cache web pages you'll need a pc and a lot of configuring and transparent redirecting, it's probably not worth the hassle. Enable the DNS cache to cache DNS requests so regular domains are not looked up each time, but returned from the router. Also, make sure the DHCP server is giving out the routers IP address as DNS in it's leases
Thanks again for you time and patience Smee, I really appreciate it!
Added PPPoE, was not sure about DNS Cache? When I checked IP->DNS it looked like caching was happening?
Also is there a test I can do to confirm double NAT is not happening?
Here's my current config from using 'export compact' does it look ok? Where should I look to improve things now?
# oct/13/2013 10:03:32 by RouterOS 6.4 # software id = CCB8-P1HX # /interface bridge add admin-mac=D4:CA:6D:BE:8D:FD auto-mac=no l2mtu=1598 name=bridge-local protocol-mode=rstp /interface wireless set 0 band=2ghz-b/g/n channel-width=20/40mhz-ht-above disabled=no distance=indoors frequency=2427 ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 mode=ap-bridge ssid=MikroTik-BE8E01 /interface ethernet set 0 name=ether1-gateway set 1 name=ether2-master-local set 2 master-port=ether2-master-local name=ether3-slave-local set 3 master-port=ether2-master-local name=ether4-slave-local set 4 master-port=ether2-master-local name=ether5-slave-local /interface pppoe-client add add-default-route=yes disabled=no interface=ether1-gateway max-mru=1484 max-mtu=1484 name=eircom-pppoe-out1 password=broadband1 use-peer-dns=yes user=eircom@eircom.net /ip neighbor discovery set wlan1 discover=no /interface wireless security-profiles set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk mode=dynamic-keys wpa-pre-shared-key=REMOVED wpa2-pre-shared-key=REMOVED /ip hotspot user profile set [ find default=yes ] idle-timeout=none keepalive-timeout=2m mac-cookie-timeout=3d /ip pool add name=default-dhcp ranges=192.168.88.10-192.168.88.254 /ip dhcp-server add address-pool=default-dhcp disabled=no interface=bridge-local name=default /system logging action set 0 memory-lines=100 set 1 disk-lines-per-file=100 /interface bridge port add bridge=bridge-local interface=ether2-master-local add bridge=bridge-local interface=wlan1 /ip address add address=192.168.88.1/24 comment="default configuration" interface=wlan1 network=192.168.88.0 /ip dhcp-client add comment="default configuration" dhcp-options=hostname,clientid disabled=no interface=ether1-gateway /ip dhcp-server network add address=192.168.88.0/24 comment="default configuration" dns-server=192.168.88.1 gateway=192.168.88.1 /ip dns set allow-remote-requests=yes /ip dns static add address=192.168.88.1 name=router /ip firewall filter add chain=input comment="default configuration" protocol=icmp add chain=input comment="default configuration" connection-state=established add chain=input comment="default configuration" connection-state=related add action=drop chain=input comment="default configuration" in-interface=ether1-gateway add chain=forward comment="default configuration" connection-state=established add chain=forward comment="default configuration" connection-state=related add action=drop chain=forward comment="default configuration" connection-state=invalid /ip firewall nat add action=masquerade chain=srcnat comment="default configuration" out-interface=eircom-pppoe-out1 to-addresses=0.0.0.0 /ip service set api disabled=yes /system clock set time-zone-name=Europe/Dublin /system leds set 0 interface=wlan1 /tool mac-server set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local /tool mac-server mac-winbox set [ find default=yes ] disabled=yes add interface=ether2-master-local add interface=ether3-slave-local add interface=ether4-slave-local add interface=ether5-slave-local add interface=wlan1 add interface=bridge-local
0 -
-
-
Advertisement
-
smee again wrote: »That looks good, to test you don't have double Nat do "ip address print" and you should see a public ip address marked D (dynamic) assigned to the eircom-pppoe-out1 interface, (a public ip is one that doesn't start with 192.168.x.x). Also if you do a traceroute (tracert on windows) to www.boards.ie on your pc it will show you the hops. Be sure to disable wireless and pppoe on the Eircom modem.
The DNS cache is enabled and DHCP is giving out the router ip as DNS.
I think we are good?[admin@MikroTik] > ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 ;;; default configuration 192.168.88.1/24 192.168.88.0 wlan1 1 D 95.45.108.211/32 95.45.108.1 eircom-pppoe-out
0 -
-
-
-
-
Advertisement
-
-
-
-
-
-
-
-
-
-
-
Advertisement
-
-
-
-
-
Difficulty setting up VPN. I tried to follow the instructions in this thread but am failing.
Right, I just figured this so I'll share. There are a few things missing from what was posted earlier in the thread. My router is 192.168.80.1, change the subnet below to suit your own router
You need a pool of addresses and a single local address.
I used 192.168.80.90 as local and set the pool to 192.168.80.91-192.168.80.99 which is outside the DHCP pool and not used as static. I'm using the profile default-encryption, which may be already created but not set (this may be the difficulty you were having snipe). Set the DNS server as the routers IP/ip pool
add name=VPN-Pool ranges=192.168.80.91-192.168.80.99
/ppp profile
add name="default-encryption" local-address=192.168.80.90 remote-address=VPN-Pool use-mpls=default use-compression=default use-vj-compression=default use-encryption=yes only-one=default change-tcp-mss=yes address-list="" dns-server=192.168.80.1
Next you enable the server and add the interface/interface pptp-server server
set authentication=mschap1,mschap2 default-profile=default-encryption enabled=yes keepalive-timeout=30 max-mru=1460 max-mtu=1460 mrru=disabled
/interface pptp-server
add disabled=no name=pptp-vpn-server user=""
Then all that you need to do is create users/ppp secret
add caller-id="" disabled=no limit-bytes-in=0 limit-bytes-out=0 name=vpnuser1 password=vpnpass1 profile=default-encryption routes="" service=pptp
add caller-id="" disabled=no limit-bytes-in=0 limit-bytes-out=0 name=vpnuser2 password=vpnpass2 profile=default-encryption routes="" service=pptp
add caller-id="" disabled=no limit-bytes-in=0 limit-bytes-out=0 name=vpnuser3 password=vpnpass3 profile=default-encryption routes="" service=pptp0 -
I have HP PSC 1510 All In One printer beside the Mikrotik which I normally connect to a laptop via USB cable to print. I am just wondering would plugging the printer USB into the USB slot on the Mikrotik allow me to then share the printer around the home network or is that not supported?
Let me know, thanks!smee again wrote: »Best Google that one
So I asked over on the MikroTik RouterOS forum and was told the RB951G-2HND does not support printers.
I was looking at the manual for my Zyxel Eircom F1000 and on page 181 it states you can connect a printer via its usb port for sharing over the network.
Given my Eircom router is now in bridge mode and I am using the RB951G-2HND as my main router is there any way I can take advantage of the Eircom USB printer sharing option still or? 0 -
So I asked over on the MikroTik RouterOS forum and was told the RB951G-2HND does not support printers.
I was looking at the manual for my Zyxel Eircom F1000 and on page 181 it states you can connect a printer via its usb port for sharing over the network.
Given my Eircom router is now in bridge mode and I am using the RB951G-2HND as my main router is there any way I can take advantage of the Eircom USB printer sharing option still or?
Not if it's a bridge and being tunneled through (PPPoE is a layer 2 tunnel) it is not routable to on your network. That modem manual is very vague about print server, you sure it would work? Also, the disadvantage of setting a print server is that the scanner will not work unless directly connected to a pc.0 -
-
Noticed this in my logs this morning.
From a google of the IP address looks like a spammer from China?
Anything I should do about it.
Yeah, it's just random spambots trying to login to your ssh server, you see this once you have ssh enabled on the router. I have a few rules added to my config which makes a nice honeypot to tackle this.
1st line logs IPs trying to remote desktop/ip firewall filter
add action=add-src-to-address-list address-list=trying_to_rdp address-list-timeout=1d chain=input comment="list IP's who try rdp" dst-port=3389 protocol=tcp
add action=add-src-to-address-list address-list=trying_to_login address-list-timeout=1d chain=input comment="list IP's who try remote login" dst-port=20-23 protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add chain=input comment="allow ssh" dst-port=22 protocol=tcp
2nd line logs IPs trying to login to the router over FTP, SSH or Telnet (ports 20-23)
The next few lines will prevent SSH brute force, the IP will be added to an address list on 3 stages and then added to an SSH blacklist and blocked for 10 days on the fourth failed attempt.
The last line is the rule that allows SSH
You will see the IP's build up in /ip firewall address-list. It's not my work, it's from here http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention
Here is a full export of my firewall filters, there are some very important drop invalid, allow established connections and accept lan rules in there/ip firewall filter
add chain=input comment="allow icmp" protocol=icmp
add chain=input comment="allow winbox" dst-port=8291 protocol=tcp
add chain=input comment="allow api" dst-port=8728 protocol=tcp
add action=add-src-to-address-list address-list=trying_to_rdp address-list-timeout=1d chain=input comment="list IP's who try rdp" dst-port=3389 protocol=tcp
add action=add-src-to-address-list address-list=trying_to_login address-list-timeout=1d chain=input comment="list IP's who try remote login" dst-port=20-23 protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add chain=input comment="allow ssh" dst-port=22 protocol=tcp
add action=drop chain=input comment="drop ftp" disabled=yes dst-port=21 protocol=tcp
add chain=input comment="accept vpn" dst-port=1723 in-interface=ether1-gateway protocol=tcp
add chain=input in-interface=ether1-gateway protocol=gre
add action=drop chain=forward comment="drop invalid connections" connection-state=invalid
add chain=forward comment="allow already established connections" connection-state=established
add chain=forward comment="allow related connections" connection-state=related
add action=drop chain=input comment="drop invalid connections" connection-state=invalid
add chain=input comment="allow established connections" connection-state=established
add chain=input comment="acccept lan" in-interface=!ether1-gateway src-address=192.168.80.0/24
add action=drop chain=input comment="drop everything else"0 -
Advertisement
-
Advertisement