Community discussions

MikroTik App

Search found 105 matches

by mur
Thu Aug 20, 2020 10:06 pm
Forum: Beginner Basics
Topic: Redirect outgoing DNS requets to internal DNS server
Replies: 15
Views: 21168

Re: Redirect outgoing DNS requets to internal DNS server

Hello I did it a little different and it seems to work with rouge DNS Requests. Example a NvidiaShield with Andoid TV (Nvidia) OS has hardcoded DNS entries - Even if you change the IP mode to Manual it still calls home over 8.8.8.8. What did I do? Winbox: --> IP-Firewall-Address Lists added an entr...
by mur
Thu Aug 06, 2020 11:12 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

I didn't test it, but this looks ok: viewtopic.php?f=9&t=161785
Great!
If I got it right I have to copy-paste it into "On Event:" field of the scheduler.
Thank you very much
by mur
Thu Aug 06, 2020 10:18 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

You can give pi-hole's address directly to devices, using either manual config or dhcp. But then if pi-hole doesn't work for any reason, you won't have any dns. And there's no way how to quickly change it, because devices will use original config and won't ask dhcp server for updates for some time....
by mur
Thu Aug 06, 2020 1:15 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

@sob
interesting indeed.
Yes, I set 8.8.8.8 on my network card properties to test the dns redirect.
It seems to work, but I'd like to figure out whether it is the best way to do dns redirect.
Thank you very much for your explanation.
by mur
Wed Aug 05, 2020 12:56 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

I'm not sure if it's just tcpdump in promiscuous mode (i.e. catching everything on the wire, not just traffic for own machine), or if using VMs messes things up a little. First packet is from PC to 8.8.8.8 and normally the OMV machine should not see it. Try to add "p" parameter to tcpdump...
by mur
Tue Aug 04, 2020 10:44 am
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

On the machine with Pi-hole. I ran the tcpdump command on my OMV machine with pi-hole installed in it. It is the linux machine where pi-hole and my NAT rules above work flawlessly. The IPs are different though: OMV=192.168.3.127 pi-hole=192.168.3.66 mypc=192.168.3.100 As I said, everything works he...
by mur
Mon Aug 03, 2020 11:59 am
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

@Sob

Thanks sob. It is exactly what I needed to know. I mean, a good starting point at least.
I'll do a few tests over the next days.
Last thing, where I have to run the commands above from?
From one of the clients which uses pi-hole or from the machine in which pi-hole is installed?
Thanks
by mur
Sat Aug 01, 2020 10:01 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

You can try to find out if you can configure Pi-hole to use .97 as source for outgoing queries. Or you can check first response in this thread, which shows how you can use address list to exlude more than one address. But don't skip steps and don't assume, see what really happens. From your feedbac...
by mur
Sat Aug 01, 2020 1:12 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

One repeating thought, verify what source address Pi-hole uses for own outgoing queries. If it happens to be .99, then it wouldn't work with your rules, because they match everything except only .97, so every single query from Pi-hole would be sent back to it. Let's assume that it is exactly that t...
by mur
Fri Jul 31, 2020 8:40 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

I'm not familiar with dnsmasq, I know what it does, but that's all. If you have it listening only on .99 and Pi-hole has .97 for itself, they should coexist without problems. I did a few tests. I reloaded an OpenMediaVault VM machine on my VMware workstation. It has an old version of pi-hole instal...
by mur
Fri Jul 31, 2020 1:32 am
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

Few notes for ^^^: - The one in green is not required IF you drop all traffic later, but that currently doesn't happen because (6) is disabled. - If you change it as suggested, you want to accept everything with connection-nat-state=dstnat, without any in-interface filter. That's because you want i...
by mur
Thu Jul 30, 2020 11:39 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

I think some network diagrams may help........ A full config is far more helpful than a few snippets. Ok # jul/30/2020 22:32:36 by RouterOS 6.45.8 # software id =xxxxx # # model =xxxx # serial number =xxx /interface bridge add admin-mac=C4:AD:xx:xxxx:xx auto-mac=no comment=defconf name=bridge /inte...
by mur
Thu Jul 30, 2020 10:05 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

Meanwhile I disabled Masquerade rule. Then it can't work. Do I understand correctly that you don't actually have separate server, but both addresses (.97 and .99) are on your netbook and you are also testing this from same netbook? It that's the case, are you sure that Pi-hole not only listens on 1...
by mur
Thu Jul 30, 2020 9:27 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

For port 53, udp, tcp. redirect - replaces destination port of an IP packet to one specified by to-ports parameter and destination address to one of the router's local addresses I set my NAT rules again (those in my first post above) and do some test: The NATdst rule seems to redirect the dns query...
by mur
Thu Jul 30, 2020 8:25 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

Can one not use REDIRECT in the dstnat ruleset??
What exactly do you mean? What would you do in such a situation?
Thanks
by mur
Thu Jul 30, 2020 10:15 am
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

@sob, @ nithinkumar2000

None of the rules above really affects traffic in some way. They don't catch and redirect DNS query requests,
even when I change dns server ip directly in one of my devices. It is as if I hadn't set them at all.
Thank you
by mur
Thu Jul 30, 2020 1:08 am
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Re: Still struggling with DNS redirect

I believe that the NAT Rules are incorrect Please Try Below: #For DST NAT /ip firewall nat add chain=dstnat action=dstnat src-address=192.168.3.0/24 src-address-list=!nat-exempt-list protocol=tcp dst-port=53 to-address=192.168.3.97 add chain=dstnat action=dstnat src-address=192.168.3.0/24 src-addre...
by mur
Wed Jul 29, 2020 9:30 pm
Forum: General
Topic: Still struggling with DNS redirect
Replies: 35
Views: 11425

Still struggling with DNS redirect

Hi, I had to install pi-hole again on another linux machine. Since I want every DNS query requests coming from my LAN be redirected to my pihole, I had set these rules: My LAN = 192.168.3.0/24 Pi-hole Ip= 192.168.3.97 Linux machine IP with pihole = 192.168.3.99 add action=dst-nat chain=dstnat dst-ad...
by mur
Fri May 15, 2020 9:17 am
Forum: Beginner Basics
Topic: Different LAN VS VLAN solution
Replies: 2
Views: 999

Re: Different LAN VS VLAN solution

As one of your LANs is connected to dingle interface, then whatever RB roes with it is routing. And whrn it comes to routing, there is no difference between your current config and VLAN-based config. The only benefit of using VLANs would be when multipke LAN segments shared same physical infrastruc...
by mur
Thu May 14, 2020 1:51 pm
Forum: Beginner Basics
Topic: Different LAN VS VLAN solution
Replies: 2
Views: 999

Different LAN VS VLAN solution

Hi, As I said in one of my previous threads, I removed an interface from the bridge, set an IP for it in a different subnet than my bridge. I added the IP and its subnet to my mikrotik's address list tab. I also create a DHCP server on it. Ok, it makes its job and fits my needs at the moment at leas...
by mur
Thu Apr 30, 2020 3:17 pm
Forum: Beginner Basics
Topic: Safe browsing via OpenVPN [SOLVED]
Replies: 1
Views: 5771

Re: Safe browsing via OpenVPN [SOLVED]

I finally found out what kept my smartphone from browsing the internet as it was connected to my Openvpn server on my LAN. I had to disable this rule: add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN But why? I could get access to anything ...
by mur
Wed Apr 29, 2020 12:24 pm
Forum: Beginner Basics
Topic: Safe browsing via OpenVPN [SOLVED]
Replies: 1
Views: 5771

Safe browsing via OpenVPN [SOLVED]

Hi everyone, I set up OpenVpn on my Mikrotik device, I used their DDNS service too since I have no static public IP. Everything works great so far; I also can get access to my LAN with my smartphone via OpenVPN. However, I noticed that I can't browse the Internet with my smartphone when my OpenVPN c...
by mur
Tue Apr 21, 2020 1:33 am
Forum: Beginner Basics
Topic: Mikrotik mode button and wlan2 [SOLVED]
Replies: 3
Views: 7457

Re: Mikrotik mode button and wlan2 [SOLVED]

Yes, you can. The the following command may be used to enable/disable the interface: /interface wireless set wlan2 disabled=(![get wlan2 disabled]) Open System -> Routerboard -> Mode Button in Winbox and paste the command into On Event field. I set this, and it works great. Is there a brief list of...
by mur
Mon Apr 20, 2020 2:55 pm
Forum: Beginner Basics
Topic: Mikrotik mode button and wlan2 [SOLVED]
Replies: 3
Views: 7457

Mikrotik mode button and wlan2 [SOLVED]

Can I enable/disable Wlan2 interface by clicking "Mode Button" on my Mikrotik hap AC2? How?

Thanks
by mur
Thu Apr 16, 2020 6:04 pm
Forum: General
Topic: keeping a service on my pc from communicating outside
Replies: 2
Views: 1416

Re: keeping a service on my pc from communicating outside

I will comment only on the rule...
Yes it will drop any TCP connection originated from anyone inside the LAN, not only your PC, towards that IP...
Ok thank you very much
by mur
Thu Apr 16, 2020 5:29 pm
Forum: General
Topic: keeping a service on my pc from communicating outside
Replies: 2
Views: 1416

keeping a service on my pc from communicating outside

Hi, In connections tab in the firewall windows I saw an established connetion ftom my pc's IP address to a public IP. Thanks to a port scanning program I found out that it came from a program's service I had installed on my pc a while ago. I then tried to block it by adding this rules: add action=dr...
by mur
Sat Apr 11, 2020 8:57 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

Yes thats what i meant...
Ah ok,
Anyway, I don't use DD-WRT anymore, I was just trying to figure out a possible bridge connection between the ISP router/AP and my mikrotik, then my devices, but I think that it is not possible, the way I hoped at least.
I think I got it now
Thank you very much
by mur
Sat Apr 11, 2020 7:24 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

You can avoid station pseudobridge... As i suggested earlier you can try setting Mikrotik to AP Bridge mode, enable wds and then on the WRT enable Client mode with WDS as well... It is worth trying... It is not experimental, i ve implemented this exact scenario (with other vendors) with devices tha...
by mur
Sat Apr 11, 2020 4:45 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

Well, there cannot be other way how it works. For proper bridging to work your AP and your station bridge should exchange frames with 4 MAC addresses (source, destination, sender, receiver), whereas the standard frame for station to AP communication contains only 3 MACs (because source and sender a...
by mur
Sat Apr 11, 2020 3:07 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

So, what would it be the Mikrotik equivalent? Station-bridge mode? No. Your ISP router is not a RouterOS-powered devices, as far I understand, so station-bridge won't work for you as expected. The only viable option is station-pseudobridge. I'm sure DD-WRT does the same, unless it talks to another ...
by mur
Sat Apr 11, 2020 2:02 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

https://www.linksysinfo.org/index.php?threads/diffrence-between-client-and-client-bridge-mode.13563/ It seems that a DD-WRT router can do what a Mikrotik can't. Really? Your link talks about wireless in "client" mode vs wireless in "client-transparent-bridge" mode on DD-WRT. And...
by mur
Sat Apr 11, 2020 10:18 am
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

You cannot bridge wireless interface in station mode. You can, however, do that if you change the mode to station-bridge or station-pseudobridge . Please be aware, though, that these modes have their own limitation. You can read more about various wireless station modes on the wiki here: Wireless S...
by mur
Fri Apr 10, 2020 8:02 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

Create a bridge interface and add the eth interface as well as the wirelles one...
I can't give it a go now, but what would the result be? Would I get an IP on the same subnet of my WAN (ISP router LAN subnet)?
Should I set a DHCP client on the bridge? Thanks
by mur
Fri Apr 10, 2020 7:45 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Re: Can you bridge a WLAN working as WAN with an ethernet interface

Where is the point to do that. If is wlan1 WAN side of the roter than is eth0 LAN side of router. Or do want to have bridge to local wireless hotspot? I was wondering if it can be possible to bridge directly to ISP router's LAN via Wifi and get an IP for a device connected to that enthernet interfa...
by mur
Fri Apr 10, 2020 6:37 pm
Forum: Beginner Basics
Topic: Can you bridge a WLAN working as WAN with an ethernet interface
Replies: 21
Views: 5922

Can you bridge a WLAN working as WAN with an ethernet interface

The more I study how Mikrotik works, the more I realize that I know almost nothing about computer networking. It can be frustrating sometimes. Ok. I was wondering if I can bridge my WLAN1 (which is working as my WAN in station mode at the moment) with an ethernet interface in order to get the same W...
by mur
Mon Apr 06, 2020 1:05 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

Yes, correct.
Thank you very much indeed :wink:
by mur
Mon Apr 06, 2020 10:39 am
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

.... The same does not apply for the ISPs Router, where you should make a route where when the destination address is the 192.168.4.0/24 the Gateway used must be the 192.168.0.2... Or if you dont want to do that, just let the src nat rule enabled on your Mikrotik with out interface the wlan... We g...
by mur
Mon Apr 06, 2020 12:33 am
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

Yes, you can. But you need to add a static route on your ISP router so it knows where to forward traffic destined to your 192.168.4.0/24 network to. hmms....Static route as adding a static dhcp record in the ISP router dhcp server or is it something different completely? I set also a static IP for ...
by mur
Sun Apr 05, 2020 9:08 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

Once you understand section about "limitations of L2 bridging," you will understand how all the other modes work the way they do, and that the proprietary extensions like "station-bridge" that allow MikroTik gear to overcome that standards deficiency will only work between two M...
by mur
Sun Apr 05, 2020 8:52 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

1) a "real" L2 bridge connection (as that of any network ap/switch) is not possible, unless I have another mikrotik device as an AP 2) as for my case and many others, Station mode is the more advisable way to go, even though it is the "routed (NAT too?) way? Thanks 1. Yes... 2. If in...
by mur
Sun Apr 05, 2020 6:57 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

What if I want just one client being connected to the ISP router via WIFI? In this case station-pseudobridge or station-pseudobridge-clone will work for you just fine. if you don't mind, I still have a few questions: as far as I've understood (I might've as well got it wrong; I'm still learning net...
by mur
Sun Apr 05, 2020 1:42 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

Provided you have more then one client behind your Mikrotik router, you cannot really do that, unless your ISP router is also a Mikrotik product (in which case station-bridge mode is what you are looking for). Well, the station-pseudobridge mode may appear to work for you, but I doubt that MAC addr...
by mur
Sun Apr 05, 2020 1:20 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

Re: How to connect a hap ac2 to an ISP router via wifi [SOLVED]

What would you like to achieve in the end?
making my LAN work on the same subnet and avoid double NAT.
Furthermore I'd like to understand how the different mode work.
Thanks
by mur
Sun Apr 05, 2020 1:02 pm
Forum: Wireless Networking
Topic: How to connect a hap ac2 to an ISP router via wifi [SOLVED]
Replies: 16
Views: 13959

How to connect a hap ac2 to an ISP router via wifi [SOLVED]

Hi everyone, I have a hap ac2 and I connected it to an ISP router/modem via WIFI in station mode. I set a dhcp client on it and a dhcp server for my LAN which is now on a different subnet. Ok, it works great. But, I was wonder if I can connected, apart from station mode, to the ISP router in another...
by mur
Fri Apr 03, 2020 8:28 pm
Forum: Beginner Basics
Topic: Did I add another level of NAT this way? [SOLVED]
Replies: 3
Views: 6646

Re: Did I add another level of NAT this way? [SOLVED]

NAT is normally having a private network behind the router which shows the world only its public facing WANIP. All the subnets be they vlans or normal lans, on or off bridges are part of the PRIVATE network. Single NAT! Unless I connect that interface to a WAN interface port of another router. It w...
by mur
Fri Apr 03, 2020 6:05 pm
Forum: Beginner Basics
Topic: Did I add another level of NAT this way? [SOLVED]
Replies: 3
Views: 6646

Did I add another level of NAT this way? [SOLVED]

Hi everyone, I removed an interface of my Mikrotik from the bridge, and I set a new Ip on a different subnet to it. I also create a DHCP server on it. Can be considered the computer which is connected, or a switch too, to that interface under another level of NAT or is it just... routing? Sorry, I k...
by mur
Fri Apr 03, 2020 12:02 am
Forum: Beginner Basics
Topic: still doubt about "LAN" and a firewall rule [SOLVED]
Replies: 3
Views: 6911

Re: still doubt about "LAN" and a firewall rule [SOLVED]

The firewall filter rule parameter XX-interface-list (XX can be either in or out) points to interface list, which explicitly states member interfaces. There's no magic inside router to guess which interface might be part of some list or not. And LAN in example is just a random name for the interfac...
by mur
Thu Apr 02, 2020 9:14 pm
Forum: Beginner Basics
Topic: Default firewall config
Replies: 16
Views: 52440

Re: Default firewall config

That is basically what a SOHO firewall is with fasttrack rule removed (you don't need it using a CCR in home environment): /ip firewall filter add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked add action=drop chain=...
by mur
Thu Apr 02, 2020 8:12 pm
Forum: Beginner Basics
Topic: still doubt about "LAN" and a firewall rule [SOLVED]
Replies: 3
Views: 6911

still doubt about "LAN" and a firewall rule [SOLVED]

Hi everyone, I have been learning how my mikrotik device works for a couple of months and I still consider myself a newbie when it comes to networking. So, I still find myself struggling with the networking terminology and mikrotik setup. I have this rule for example: add action=drop chain=input com...
by mur
Tue Mar 31, 2020 11:17 am
Forum: Beginner Basics
Topic: OpenVPN VS Mikrotik VPN quick setup
Replies: 5
Views: 3440

Re: OpenVPN VS Mikrotik VPN quick setup

Quick Set creates some VPN config, I'm not really sure what exactly. But you can create anything else manually if you want. And DDNS and VPN are not related, it's not like you'd have to use MikroTik's DDNS only with Quick Set VPN. MikroTik's DDNS just gives you hostname pointing to your router's ad...
by mur
Mon Mar 30, 2020 9:40 pm
Forum: Beginner Basics
Topic: OpenVPN VS Mikrotik VPN quick setup
Replies: 5
Views: 3440

Re: OpenVPN VS Mikrotik VPN quick setup

Just more options from my experience. If you prefer the OVPN client OpenVPN is a good choice, otherwise there are other clients you can use, or PPTP, SSL-VPN, etc. I use duckdns for ddns, and run an OpenVPN server, I have not used the MT built in ddns yet. Ok, I'll go for OpenVPN then. Is duckduck ...
by mur
Mon Mar 30, 2020 7:31 pm
Forum: Beginner Basics
Topic: OpenVPN VS Mikrotik VPN quick setup
Replies: 5
Views: 3440

OpenVPN VS Mikrotik VPN quick setup

I'd like to set up a VPN server on my Mikrotik hap ac2 in order to get access to my home LAN from outside, and be able to surf the internet safely when my notebook is connected to an untrusted wifi network. I saw this tutorial: https://www.youtube.com/watch?v=QWLY5vdKV4c In which the author lunches ...
by mur
Sun Mar 29, 2020 5:22 pm
Forum: Beginner Basics
Topic: DNS redirect: action redirect VS dst-nat [SOLVED]
Replies: 8
Views: 47602

Re: DNS redirect: action redirect VS dst-nat [SOLVED]

I think the key here is any misconception you may have about dstnat. It does not care where the traffic is coming from, so this is applied to ANY traffic attempting to hit port 53 be it incoming traffic from the internet or from the LAN. The redirect rule ONLY applies to local traffic behind the ro...
by mur
Sun Mar 29, 2020 5:07 pm
Forum: Beginner Basics
Topic: DNS redirect: action redirect VS dst-nat [SOLVED]
Replies: 8
Views: 47602

Re: DNS redirect: action redirect VS dst-nat [SOLVED]

Mur the redirect rule is doing what you state as a requirement in your first post! If forces all LAN requests from PCs (regardless of destination intention of the PC setup or pC user) to the settings you have setup in the router. here it is stated the same for dst NAT rule: https://wiki.mikrotik.co...
by mur
Sun Mar 29, 2020 3:13 pm
Forum: Beginner Basics
Topic: DNS redirect: action redirect VS dst-nat [SOLVED]
Replies: 8
Views: 47602

Re: DNS redirect: action redirect VS dst-nat [SOLVED]

redirect - replaces destination port of an IP packet to one specified by to-ports parameter and destination address to one of the router's local addresses As long you are redirecting to local address you can use redirect and if it outside then you need to use dst-nat. local - if dst-address is assi...
by mur
Sun Mar 29, 2020 12:42 pm
Forum: Beginner Basics
Topic: DNS redirect: action redirect VS dst-nat [SOLVED]
Replies: 8
Views: 47602

DNS redirect: action redirect VS dst-nat [SOLVED]

Hi everyone, In order to force my LAN's users to use specified DNS server, my Mikrotik router I use this NAT rules: add action=dst-nat chain=dstnat comment="Make Mikrotik preferred dns server UDP" dst-port=53 protocol=udp to-addresses=192.168.3.1 to-ports=53 add action=dst-nat chain=dstnat...
by mur
Wed Mar 25, 2020 10:38 am
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

@mur do you know tht the Firewall rules (and not only) are checked sequentially ? Please place the rules in a correct order, the wiki and some search will help you on that... Or you can just reset to default and let the firewall as is and only add carefully... I changed them. Are they ok now? thanks
by mur
Wed Mar 25, 2020 10:06 am
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

Without a full config, its hard to say. ok /ip firewall filter add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid add action=accept chain=forward dst-address-list=WAN src-address-list=LAN add action=accept chain=input comment="defconf: accept estab...
by mur
Tue Mar 24, 2020 8:08 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

i would use these two rules... ip firewall filter add chain=forward in-interface-list=WAN protocol=tcp dst-port=445 action=drop ip firewall filter add chain=forward out-interface-list=WAN protocol=tcp dst-port=445 action=drop or you can simply not specify interface, so with one rule it will be drop...
by mur
Tue Mar 24, 2020 7:39 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

No, it wouldn't work. bridge interface is typically originating interface for traffic generated by router itself. Which contradicts with chain=forward . But then, if you're filtering using out-interface-list (right thing to do), then most of the time that's enough (no need to use in-interface). The...
by mur
Tue Mar 24, 2020 7:38 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

The fact that you allow ICMP (1) in the input chain has nothing to do with the ports that appear as open... Ok, I won't make any change to it. Also, the rule in your first post, blocks what comes from inside your Lan and tries to go out to the internet with destination port TCP 445... So, it does n...
by mur
Tue Mar 24, 2020 6:50 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

How can I make that determination without seeing your config...................
I'd like to know whether my rule above is correct to just give it a try.
Thanks
by mur
Tue Mar 24, 2020 5:15 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

try grc.com and their shields up tool to see what is visible from the internet.
Ok, but I would like to drop requests from my LAN to Internet too, and understand if my rule above would be ok
Thanks
by mur
Tue Mar 24, 2020 4:13 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

Re: How to block ports effectively?

Even destination ports are visible but CLOSED when doing port scans from the internet. Why ports are showing as OPEN is very weird, perhaps if you allow ICMP?? I did port scan from my LAN (Lubuntu is on a VM in my own LAN although on "Host mode" in Vmware workstation pro) I allow ICMP in ...
by mur
Tue Mar 24, 2020 3:39 pm
Forum: Beginner Basics
Topic: How to block ports effectively?
Replies: 16
Views: 5172

How to block ports effectively?

Hi everyone, By running Nmap on my Lubuntu distro in VM and targeting my Windows desktop PC, it seems that a few ports are open. They seem to be related to Windows services mostly, and some crappy things I haven't identified yet. I'd want now to block them. Would a rule like this work for example? i...
by mur
Sat Mar 21, 2020 8:15 pm
Forum: Beginner Basics
Topic: Problem with Simple Queues
Replies: 0
Views: 1835

Problem with Simple Queues

Hi, I thought that it was time for me to approach Mikrotik Queues and make some experiments with it to figure out how to limit and prioritize traffic on my LAN for certain IPs, interfaces, etc. So, in Simple Queues, I set 2M donwload and upload limits for one IP of my LAN. It was simple to set and w...
by mur
Sat Mar 14, 2020 4:53 pm
Forum: Beginner Basics
Topic: Best firewall setup ever [SOLVED]
Replies: 7
Views: 7158

Re: Best firewall setup ever [SOLVED]

I still don't know how to create black lists and set them up in the firewall. There's nothing magical about black lists. They are simply address list (you can create and maintain them under /ip firewall address-list , ditto for IPv6), and then use them as criterion for some drop rules (e.g. /ip fir...
by mur
Sat Mar 14, 2020 2:39 pm
Forum: Beginner Basics
Topic: Best firewall setup ever [SOLVED]
Replies: 7
Views: 7158

Re: Best firewall setup ever [SOLVED]

No, it's not good starting point, current default firewall is better for that, it's simpler, easier to understand, ...
I think you're right.
Thanks
by mur
Sat Mar 14, 2020 1:14 pm
Forum: Beginner Basics
Topic: Best firewall setup ever [SOLVED]
Replies: 7
Views: 7158

Re: Best firewall setup ever [SOLVED]

One thing that may add to firewall security is use of remote IP address black lists. Collecting those is a complex task and random home user likely can't collect a decent list himself. Using lists from a quality and trusted source is then a must. This is interesting. Could you please give me more i...
by mur
Sat Mar 14, 2020 11:32 am
Forum: Beginner Basics
Topic: Best firewall setup ever [SOLVED]
Replies: 7
Views: 7158

Best firewall setup ever [SOLVED]

Along my journey to figure out what would be the best setup for my Mikrotik firewall ever, I stumbled upon this article: https://wiki.mikrotik.com/wiki/Basic_universal_firewall_script Apart from one own needs, I was wondering if that setup is still valid and you would suggest it as a good starting p...
by mur
Mon Mar 09, 2020 2:24 pm
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Re: Getting access to a device in a different LAN

Well, I already knew that there would be some issues at making sense of my configuration :-) Anyway, it works flawlessly so far..apparently. First of all, my eth1 is part of the bridge because it is not my WAN. My WAN is Wlan1 because my mikrotik router is connected to the ISP router (192.168.1.1) v...
by mur
Mon Mar 09, 2020 12:50 am
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Re: Getting access to a device in a different LAN

That is not a download of the config?? Did you take a screenshot of something as its butt ugly. Many of the rules are cut off. Also, I wont say this again but your rules are not ordered........... input chain then forward chain (and order is important) Use /export hide-sensitive file=myconfigtoday ...
by mur
Sun Mar 08, 2020 9:23 pm
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Re: Getting access to a device in a different LAN

Much easier if you give complete information from the start but two can play this game. Clue. One of your previous threads, Slide/post #11, ++++++++++++++++++++++++++++++++++++++ /ip firewall filter add action=accept chain=forward dst-address-list=WAN src-address-list=LA add action=accept chain=inp...
by mur
Sun Mar 08, 2020 8:53 pm
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Re: Getting access to a device in a different LAN

Do you mean from a PC on a LAN behind the router? YES, from a PC (192.168.3.100) behind my Mikrotik router to another device which is connected to an interface of the same Mikrotik set on a different subnet (192.168.10.0/24) Only you know if you have allowed subnet access to the internet in firewal...
by mur
Sun Mar 08, 2020 8:40 pm
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Re: Getting access to a device in a different LAN

Clear as mud. Dont have a clue about your setup or what you are trying to do based on the post. Is pfsense on your pc acting as a router? or a Server? is one of the million questions. Use diagrams, something....... Right. Ok, like in my previous thread, one step at a time. First, how can I make sur...
by mur
Sun Mar 08, 2020 8:33 pm
Forum: Beginner Basics
Topic: Getting access to a device in a different LAN
Replies: 11
Views: 6998

Getting access to a device in a different LAN

Hi, As I said in one of my previous threads, I removed an interface from the bridge, set an IP for it in a different subnet than my bridge. I added the IP and its subnet to my mikrotik's address list tab. I then set an Ip on the same subnet for my pc (pfsense) connected to the interface I removed fr...
by mur
Sat Mar 07, 2020 8:49 pm
Forum: Beginner Basics
Topic: How to move firewall rules up and down
Replies: 16
Views: 10359

Re: How to move firewall rules up and down

No it just means that we already made the same mistake and learned LOL
PS -I figured this one out before Sob. I am going to have a Corona......oops a Stella.

:lol: :lol: :wink:
by mur
Sat Mar 07, 2020 7:29 pm
Forum: Beginner Basics
Topic: How to move firewall rules up and down
Replies: 16
Views: 10359

Re: How to move firewall rules up and down

Just make sure that you have left clicked the NUMBER SYMBOL at the top far left of the firewall page, to ensure that numbering is the determining list factor (and not any of the other columns). In other words, 0 rule is the top and its sequential down the page. Then try............ Yes! That was th...
by mur
Sat Mar 07, 2020 6:44 pm
Forum: Beginner Basics
Topic: How to move firewall rules up and down
Replies: 16
Views: 10359

Re: How to move firewall rules up and down

Yes, you can drag rules, it works. Except maybe when you use WinBox on Mac, I don't do it myself, but I think I've noticed some complaints about that somewhere in this forum.
I can't drag rules via Winbox on my PC either.
Is there anotehr way to accomplish that?
Thanks
by mur
Sat Mar 07, 2020 6:24 pm
Forum: Beginner Basics
Topic: How to move firewall rules up and down
Replies: 16
Views: 10359

How to move firewall rules up and down

Hi everyone, I'm sorry if my question may sound stupid. I saw in this videotutorial that the author can move his mikrotik firewall rules up and down in the list: https://www.youtube.com/watch?v=78jhP62VvwI I tried to do the same by left clicking on a rule and holding then moving it up or down, but n...
by mur
Fri Mar 06, 2020 9:36 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

This new rule below: add action=drop chain=forward comment="Drop all else" has replaced my old one: add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=\ !dstnat connection-state=new in-interface-list=WAN Why? Okay, one item at a ...
by mur
Fri Mar 06, 2020 9:21 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

You'll want to allow also other stuff, for example access from LAN to internet: /ip firewall filter add chain=forward src-address-list=LAN dst-address-list=WAN action=accept With the unconditional drop at the end, everything you don't allow will be blocked. That's the change from previous rule, whe...
by mur
Fri Mar 06, 2020 4:58 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

It makes much more sense to me now. So the final setup would look something like this: add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related add action=drop chain=input comment="defconf: drop invalid" connection-state=inv...
by mur
Fri Mar 06, 2020 12:16 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

Hi everyone, First thing first, thank you all for your comments. Please consider that I'm a newbie. In this case I first want to make sure that I correctly set the basic firewalls rules before going ahead and dealing with my final purpose which is, in this case, not to allow different subnets (on th...
by mur
Thu Mar 05, 2020 9:54 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

A cleaner simpler approach is only to add to the existing default rules: a. users rules where you need to provide additional access b. last rule dropping everything else. FORWARD CHAIN [default rules - fasttrack, allow established/related, drop invalid packets etc.....] User Rules examples: - allow...
by mur
Thu Mar 05, 2020 8:44 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Re: Firewall rules for an interface on a different subnet

As for the rules I was thinking about something like this: ip firewall filter add chain=forward src-address=192.168.10.0/24 dst-address=192.168.8.0/24 action=drop ip firewall filter add chain=forward src-address=192.168.8.0/24 dst-address=192.168.10.0/16 action=drop I want now to enable 192.168.8.10...
by mur
Thu Mar 05, 2020 2:53 pm
Forum: Beginner Basics
Topic: Firewall rules for an interface on a different subnet
Replies: 15
Views: 8419

Firewall rules for an interface on a different subnet

I have been doing some experiments with my Mikrotik hAP AC² and my home LAN. My goal is now to set an interface of my Mikrotik apart from the rest of my LAN in order to enable it get traffic from internet without being affected by any mikrotik firewall rules, and isolate the two subnets as well. Ok,...
by mur
Sat Feb 29, 2020 2:43 pm
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Re: Mikrotik and pihole as a DNS server

Does your Pi.hole resolve? You can test this by going to the CLI on your Pi-hole and rnter: dig mikrotik.com If it resolves the you can take the step to point clients to Pi-hole through seting it's in the DHCP of the Mikrotik. Later you then also point the mikrotik to Pi-hole. I have pihole as a do...
by mur
Sat Feb 29, 2020 10:58 am
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Re: Mikrotik and pihole as a DNS server

Still here :-) There must be something wrong with the firewall rules. I can't get access to the internet anymore, but pihole seems to be getting dns request from my PC, but it can't respond back to my PC, or the pc can't get the address resolution somehow. I deleted the two rules above and I can get...
by mur
Sat Feb 29, 2020 10:31 am
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Re: Setting DMZ in Mikrotik

Thanks, and you're right; I need to experiment
by mur
Fri Feb 28, 2020 11:18 pm
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Re: Mikrotik and pihole as a DNS server

"Second server" as a second physical server machine? Second server as the other DNS configured on client machines (either second IP address configured as DNS server on DHCP server or second resolver configured statically on client machine ...). Doesn't matter what kind of server that is (...
by mur
Fri Feb 28, 2020 9:27 pm
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Re: Mikrotik and pihole as a DNS server

There is no such thing as backup DNS server. Sorry, I don't think I've understood what you mean. You wrote: So, I set pihole'IP in Dns servers of the tab Network in DHCP server window, that is 192.168.3.66. (I set also a second dns server 1.1.1.1 in case pihole stop working for any reason). What @m...
by mur
Fri Feb 28, 2020 8:02 pm
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Re: Mikrotik and pihole as a DNS server

There is no such thing as backup DNS server.
Sorry, I don't think I've understood what you mean.
by mur
Fri Feb 28, 2020 7:27 pm
Forum: Beginner Basics
Topic: Mikrotik and pihole as a DNS server
Replies: 10
Views: 17932

Mikrotik and pihole as a DNS server

Hi, I'd like to address any DNS request coming from my LAN (192.168.3.0/24) to pihole which is installed as a Virtual machine (actually as a OpenmediaVault's docker) in Vmware workstation pro. I'd like to make sure that I get everything right. So, I set pihole'IP in Dns servers of the tab Network in...
by mur
Fri Feb 28, 2020 7:18 pm
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Re: Setting DMZ in Mikrotik

If you only want to send incoming traffic to this internal device and you don't care about isolating that device from anything else that might be in 192.168.3.0/24, dstnat rule is enough (if you have otherwise configured router). Yes..and no. As I said I'd like to have my pfsense as it were directl...
by mur
Thu Feb 27, 2020 12:11 pm
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Re: Setting DMZ in Mikrotik

If it should be the same config with 192.168.1.11 on WAN and 192.168.3.1 on LAN (I guess you were able to configure these parts?), then you can forward everything from 192.168.1.11 to 192.168.3.80 with: /ip firewall nat add chain=dstnat dst-adddress=192.168.1.11 action=dst-nat to-addresses=192.168....
by mur
Wed Feb 26, 2020 9:32 pm
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Re: Setting DMZ in Mikrotik

You first need to define DMZ and what you expect from it. I am just practising and I don't expect anything in particular from it now. I have an idea about what it will be my final LAN setup, but I am now messing up in order to learn how a MikrotiK device works. I will probably use it just as a swit...
by mur
Wed Feb 26, 2020 9:26 pm
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Re: Setting DMZ in Mikrotik

I don't think anyone here is going to recommend a dmz approach as its usually not necessary and often can be a security risk. For what reason do you required to open up every port to a PC........... for incoming WAN exploitation? ;-) Because on that PC there is a pfsense firewall. I know that it's ...
by mur
Wed Feb 26, 2020 7:27 pm
Forum: Beginner Basics
Topic: Setting DMZ in Mikrotik
Replies: 15
Views: 51932

Setting DMZ in Mikrotik

Hi everyone, I'm new to RouterOS and I'm still struggling to make sense of its many features. Today, I was trying to set a "DMZ" for one of my pc. Setting it in a "normal"router device is kind of a simple and straightforward process: you set a machine's IP in DMZ, save, and boom,...
by mur
Tue Feb 18, 2020 10:09 am
Forum: Useful user articles
Topic: Using RouterOS to VLAN your network
Replies: 291
Views: 421832

Re: Using RouterOS to VLAN your network

The fun thing about MT devices is there is no one answer EVER! LOL. IF its acting as a router and access point, look for this file........... "Router-Switch-AP (all in one)" IF its acting solely as an access point, look for this file ............. "Access Point" IF its acting so...
by mur
Mon Feb 17, 2020 11:37 pm
Forum: Useful user articles
Topic: Using RouterOS to VLAN your network
Replies: 291
Views: 421832

Re: Using RouterOS to VLAN your network

in the topic Switch with a separate router (RoaS) , what is the difference between the Switch Config file and the Router Config file? The two files are the configurations for the two hardware devices that will be in use. One a switch, the other a router. Just to make sure I got it right. Which is t...
by mur
Mon Feb 17, 2020 1:10 pm
Forum: Useful user articles
Topic: Using RouterOS to VLAN your network
Replies: 291
Views: 421832

Re: Using RouterOS to VLAN your network

As for the topic "Switch with a separate router (RoaS)", what is the difference between the Switch Config File and the Router Config File?
Thank you very much.
by mur
Fri Feb 14, 2020 8:34 pm
Forum: Beginner Basics
Topic: MikroTik rb951g-2hnd VS RB951Ui-2HnD
Replies: 3
Views: 5014

Re: MikroTik rb951g-2hnd VS RB951Ui-2HnD

What makes you want to choose those over the hAP ac²? With the hAP ac² you get better wireless (dual-band/w AC), much better CPU performance, in a package that isn't noticeably more expensive. All RouterOS devices (with multiple Ethernet ports) can do what you want. Yes, I'm going to buy this HAP a...
by mur
Thu Feb 13, 2020 9:03 pm
Forum: Beginner Basics
Topic: MikroTik rb951g-2hnd VS RB951Ui-2HnD
Replies: 3
Views: 5014

MikroTik rb951g-2hnd VS RB951Ui-2HnD

Hi everyone, Since I'd like to get serious about learning networking, I'm thinking about buying either of the these two devices and enter in the Mikrotik world: https://mikrotik.com/products/compare/RB951G-2HnD+RB951Ui-2HnD What really are the difference between the two devices? Is it just a matter ...