I'm proposing an RB450 Mikrotik router to be used as a transparent firewall for 3 servers. This device has 4 ethernet ports.
I would like to use PORT 1 to connect as the WAN I would like to use PORT 2, 3, and 4 for Server 1, Server 2, and Server 3.
I want to use it transparently so that I can firewall these 3 servers from the Internet.
The 3 servers will be assigned each a unique internet ip address, so I don't plan on using NAT.
Can this be done? What particular configuration settings should I be looking at to make this happen? Servers 1, 2, and 3 would need to be able to talk to each other as if they were plugged into the same switch, yet still talk to the common default gateway to get to the internet. Not sure of the exact direction that needs to be taken to make this happen. Appreciate any insight.
I emailed Mikrotik support and they gave me this advise for linking multiple ethernet ports together without using the bridge option
Hello,
Lets say wan interface is ether1 and the rest should be switched. Configuraton: /interface ethernet set ether3 master-port=ether2 set ether4 master-port=ether2
Now ether2,ether3 and ether4 are switched together.
In trying out this "feature" it appears that this does not actually configure the ports as a "switch", but rather as a "hub".
IOW - all the incoming traffic on any of the ports is echoed out the other ports that are grouped together. This seems to be more like port mirroring rather than switching.
A typical switch keeps a table of the MAC addresses on each port, and only sends non-broadcast data to the required port.
This is on an RB493AH. Perhaps it's different on other RBs?
Joined: Sun Mar 22, 2009 1:24 pm Posts: 8
Karma: 0
I'm trying to set up a simple AP with my 493, I thought i'd set up port 2 as the dhcp client but couldn't get it to work, if I switch the client to port 1 it works.
I tried to also make a DCHP Server for port 9, I couldn't get that to work either, but again if i switch that to either on of the WAN's or Ether 1 it works.
Is there someone thing special I need to do on ports 2-9 to get them to work as DHCP? i have no problem with getting this to work on my RB500 or Ether 1 or WAN ports.
Joined: Sun Mar 22, 2009 1:24 pm Posts: 8
Karma: 0
Hi
I don't want ports 2-9 to work as a switch, I want them to work as different routed type ports.
I believe setting the master port as 2 on ports 3-9 will make them a switch. But i might be wrong and i can't try until tomorrow.
Even with that said I think I should have been able to get port 2 (or port 9) to work as either a DHCP client or Server, and when I switch the DHCP stuff that i set up back to either WAN 1 or port 1 it works.
I don't want ports 2-9 to work as a switch, I want them to work as different routed type ports.
Ah sorry, misunderstood you. You are right, this should then work. Unfortunately I don't have a 493 but this does work on a 450 and 433 so maybe something funny with the 493.
Have you tried putting the interfaces on separate VLANs?
433 works the same as 493. If you have similar setup working on 433 then it should also work on 493. Maybe you misconfigured something, try to reset configuration and start from scratch.
hello i have 493 in place and have no problem like you exsplain. see my setting below only I did change the interface names the #9 is WAN named ether1 before and #8 was before Ether2 ect.
hmm i thought that there was no sensative info in there. anyways hope none of my cleints are here reading this , haha they would have free internet wouldnt they.
mike
_________________ setting up small WISP in Honduras over Satelite connections
@OP, did you ever get this to work? im trying to figure out how to do the same thing and then i found your post, but it doesnt really say if the setup worked.
I'm proposing an RB450 Mikrotik router to be used as a transparent firewall for 3 servers. This device has 4 ethernet ports.
I would like to use PORT 1 to connect as the WAN I would like to use PORT 2, 3, and 4 for Server 1, Server 2, and Server 3.
I want to use it transparently so that I can firewall these 3 servers from the Internet.
The 3 servers will be assigned each a unique internet ip address, so I don't plan on using NAT.
Can this be done? What particular configuration settings should I be looking at to make this happen? Servers 1, 2, and 3 would need to be able to talk to each other as if they were plugged into the same switch, yet still talk to the common default gateway to get to the internet. Not sure of the exact direction that needs to be taken to make this happen. Appreciate any insight.
Brian
(As mentioned in post 2 of this topic) This is done through adding a bridge and asigning ports 2 3 and 4 to it. After that you can use bridge filters or enable use-ip-firewall=yes and use regular firewall rules.
The other thing with the switch chip can not be controlled, RouterOS does not have control over what is communicated when master-port is set. This makes it faster, I am using it like that for clients that I know play nice with eachother and I dont need to firewall them from eachoter.
I have my WAN plugged into eth1 and I have a bridge setup on Eth2-5. These servers needs public IPs, so how would I go about setting those? Just manually assign it the IP like usual or do I have to do anything else?
Bah! I won't change the 450 for the 750 because my 450 have 64Mb RAM vs 32Mb of the 750... but the problem of replicated traffic as in a HUB is a really big issue.
ANy official response from MT ?
I can see now with dude, the traffic is perfectly replicated throgout the 4 ports of the switch group.. I could put an unmanaged switch 5 port (maybe a tplink or similar) in the ETH2 of the 450
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot post attachments in this forum
Login |
HOME
