Hi,
Thank you for the pointer. I’ve tried to adjust the final script to my environment.
- I reset the router
- I changed the router password
- I changed the router IP to 192.168.2.2
- My computer IP connected to the router is 192.168.2.1
- My computer is connected to the port labelled “PoE/In ETH/BOOT”
- The four external devices all with IP 192.168.1.1 are connected to the four SFP+ ports.
I’ve created a templated version of the script where the extracted template variables are:
systemName = "PLC-Gateway"
interfaceDevices = "PLC-PORTS"
interfaceWAN = "WAN"
interfaceForWAN = "ether1"
interfaceForDevices = ["ether2", "ether3", "ether4"]
primaryIP = "172.29.10.1"
externalIPs = ["172.29.10.102", "172.29.10.103", "172.29.10.104"]
internalIP = "192.168.2.180"
toIP = "192.168.2.20"
dstIP = "192.168.2.0"
I’ve adjusted them for my purposes to:
systemName = "Devices-Switch"
interfaceDevices = "DEVICES-PORTS"
interfaceWAN = "NUC"
interfaceForWAN = "ether1"
interfaceForDevices = ["sfp-sfpplus1", "sfp-sfpplus2", "sfp-sfpplus3", "sfp-sfpplus4"]
primaryIP = "192.168.2.2"
externalIPs = ["192.168.2.101", "192.168.2.102", "192.168.2.103", "192.168.2.104"]
internalIP = "192.168.1.180"
toIP = "192.168.1.1"
dstIP = "192.168.1.0"
Resulting in the final script:
## /export
## /export verbose
## /system reboot
## /system reset-configuration
# Identity for better management
/system identity set name="Devices-Switch"
#######################################
# Interface Organization
#######################################
# Create interface lists for better management
/interface list
add name=DEVICES-PORTS
add name=NUC
# Add interfaces to lists
/interface list member
add interface=ether1 list=NUC
add interface=sfp-sfpplus1 list=DEVICES-PORTS
add interface=sfp-sfpplus2 list=DEVICES-PORTS
add interface=sfp-sfpplus3 list=DEVICES-PORTS
add interface=sfp-sfpplus4 list=DEVICES-PORTS
#######################################
# IP Configuration
#######################################
# WAN interface (Edge device connection)
/ip address
add address=192.168.2.2/24 interface=ether1 comment="Edge Network Primary IP"
# Add virtual IPs for each PLC on the WAN interface
add address=192.168.2.101/24 interface=ether1 comment="Idx 0 External IP"
add address=192.168.2.102/24 interface=ether1 comment="Idx 1 External IP"
add address=192.168.2.103/24 interface=ether1 comment="Idx 2 External IP"
add address=192.168.2.104/24 interface=ether1 comment="Idx 3 External IP"
# Configure IP addresses for each device interface - directly using Ethernet ports
add address=192.168.1.180/24 interface=sfp-sfpplus1 comment="Idx 0 Network"
add address=192.168.1.180/24 interface=sfp-sfpplus2 comment="Idx 1 Network"
add address=192.168.1.180/24 interface=sfp-sfpplus3 comment="Idx 2 Network"
add address=192.168.1.180/24 interface=sfp-sfpplus4 comment="Idx 3 Network"
#######################################
# Create Routing Tables
#######################################
/routing table
add disabled=no fib name=to-idx0
add disabled=no fib name=to-idx1
add disabled=no fib name=to-idx2
add disabled=no fib name=to-idx3
#######################################
# Create Routing Rules
#######################################
/routing rule
add action=lookup-only-in-table routing-mark=to-idx0 table=to-idx0
add action=lookup-only-in-table routing-mark=to-idx1 table=to-idx1
add action=lookup-only-in-table routing-mark=to-idx2 table=to-idx2
add action=lookup-only-in-table routing-mark=to-idx3 table=to-idx3
#######################################
# Connection Marking for Policy Routing
#######################################
/ip firewall mangle
# Mark inbound traffic from WAN to devices with routing marks directly
add chain=prerouting in-interface=ether1 dst-address=192.168.2.101 action=mark-routing new-routing-mark=to-idx0 comment="Route to Idx 0"
add chain=prerouting in-interface=ether1 dst-address=192.168.2.102 action=mark-routing new-routing-mark=to-idx1 comment="Route to Idx 1"
add chain=prerouting in-interface=ether1 dst-address=192.168.2.103 action=mark-routing new-routing-mark=to-idx2 comment="Route to Idx 2"
add chain=prerouting in-interface=ether1 dst-address=192.168.2.104 action=mark-routing new-routing-mark=to-idx3 comment="Route to Idx 3"
# Mark connections based on initiator
add chain=prerouting connection-mark=no-mark in-interface=ether1 action=mark-connection new-connection-mark=from-mgmt comment="Mark connection from MGMT side"
add chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus1 action=mark-connection new-connection-mark=from-idx0 comment="Mark connection from device 0"
add chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus2 action=mark-connection new-connection-mark=from-idx1 comment="Mark connection from device 1"
add chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus3 action=mark-connection new-connection-mark=from-idx2 comment="Mark connection from device 2"
add chain=prerouting connection-mark=no-mark in-interface=sfp-sfpplus4 action=mark-connection new-connection-mark=from-idx3 comment="Mark connection from device 3"
# Route return traffic from router to devices (where connection-mark=from-idx)
add chain=output connection-mark=from-idx0 action=mark-routing new-routing-mark=to-idx0 comment="Route to idx 0"
add chain=output connection-mark=from-idx1 action=mark-routing new-routing-mark=to-idx1 comment="Route to idx 1"
add chain=output connection-mark=from-idx2 action=mark-routing new-routing-mark=to-idx2 comment="Route to idx 2"
add chain=output connection-mark=from-idx3 action=mark-routing new-routing-mark=to-idx3 comment="Route to idx 3"
#######################################
# Policy-Based Routing Rules
#######################################
# Policy routes for the entire device subnet (/24), not just the device (/32)
/ip route
add dst-address=192.168.1.0/24 gateway=sfp-sfpplus1 routing-table=to-idx0 comment="Route to idx 0"
add dst-address=192.168.1.0/24 gateway=sfp-sfpplus2 routing-table=to-idx1 comment="Route to idx 1"
add dst-address=192.168.1.0/24 gateway=sfp-sfpplus3 routing-table=to-idx2 comment="Route to idx 2"
add dst-address=192.168.1.0/24 gateway=sfp-sfpplus4 routing-table=to-idx3 comment="Route to idx 3"
#######################################
# NAT Configuration - Inbound & Reply Traffic
#######################################
# Destination NAT
/ip firewall nat
add chain=dstnat in-interface=ether1 dst-address=192.168.2.101 action=dst-nat to-addresses=192.168.1.1 comment="Idx 0 Inbound"
add chain=dstnat in-interface=ether1 dst-address=192.168.2.102 action=dst-nat to-addresses=192.168.1.1 comment="Idx 1 Inbound"
add chain=dstnat in-interface=ether1 dst-address=192.168.2.103 action=dst-nat to-addresses=192.168.1.1 comment="Idx 2 Inbound"
add chain=dstnat in-interface=ether1 dst-address=192.168.2.104 action=dst-nat to-addresses=192.168.1.1 comment="Idx 3 Inbound"
# Source NAT for replies (makes router appear as 192.168.1.180 to devices)
add chain=srcnat out-interface-list=DEVICES-PORTS action=src-nat to-addresses=192.168.1.180 comment="Source NAT to devices"
# might be default but just in case
/ip firewall connection tracking set enabled=yes
I can execute this script on the router without any issues.
However, when I try to connect to e.g. http://192.168.2.102 from my computer, I would expect to see the web server of one of the devices, but it actually shows RouterOS.
Any idea what I messed up?