Im pretty new to RouterOS, I have managed to configure successfully some mangle rules and traffic shaping before, simple queues too. Now im dealing with a problem that I dont even know how to google. I have 2 networks in my office: 192.168.254.x and 192.168.2.x, I want to connect 2 ethernet cables to my mikrotik RB750Gr3(one from each network) and make a new network for example: 10.10.10.x which im going to connect to with my PC. I want to be able to be in both networks(connect to web configurations devices in both networks and servers) but I dont want the networks to “see” each other. Both networks have their own gateway, i want to use 192.168.2.1 that is the faster connection. Appreciate the help!
You can accomplish what you want already via firewall rules.
It sounds rather simple.
You have two office networks A, B connected to the router on lets say ports 2,3
You want to be able to reach into both networks at any time
Where are you located ( on office network A, B, a different network?) and which port??
If you need to create another subnet just do it.
Then you use firewall rules to establish what traffic is allowed.
Im not in any existing network, i want to be in port 3 creating a new subnet. Here is the diagram, my knowledge is not high enough to understand it exactly as it is.
Don’t invent anything (relatively) complicated like VLANs. Simply configure router the same way you’d configure it for connecting to internet (DHCP client on WAN, DHCP server on LAN). WAN port in this case is where you have your primary 192.168.2.x network. When you have this, add another DHCP client on the port connected to 192.168.254.x, but do not let it add default gateway. Then tweak the firewall a bit (if you have default one, just add the second port to WAN interface list). And that’s it.
So, I set up 2 WAN, ether1 and ether2 with DHCP client, ether3 on bridge with DHCP server 10.10.10.x. It seems to be working, Im not sure which Gateway im using. Where to find that? Also, I want a guest network on ether4 using gateway from ether2 and another network on ether5 using gateway from ether1. How do I configure this?
If you configured second DHCP client to not add gateway, as I wrote, you have only one (check IP->Routes).
As for the new requirements, it will be easier to get rid of DHCP and use static config (I assume you can get IP address from each network that’s not included in their DHCP range). Basic config is this (RouterOS v6, if you have v7, it’s slightly different):
And you also need to add DHCP servers on ether4 and ether5 (I’m too lazy to write their configs, but you know how to do that). With this, everything including guests will be hidden behind your router and only 192.168.2.X and 192.168.254.Y will be visible in other networks.
Another way would be to have guests connected directly to upstream networks, so there wouldn’t be 10.10.11.0/24 and 10.10.12.0/24, and they would get 192.168.2.x / 192.168.254.x from upstream DHCP.
Edit: fixed invalid addresses, in case someone finds it later
First of all, thanks a lot for the time you are spending helping me. I have used the configuration, ether4 gives DHCP normally-gateway isnt woking(i dont have internet connection) ether5 doesnt even give out IP adress. What should I look for to find the problem?
You have small config, so there aren’t many places where mistakes can be hiding. But if you don’t see any, it’s probably best to export your config using:
/export hide-sensitive file=myconfig
And then take content of myconfig.rsc and post it here in code tags.
The networks are 192.168.2.x and 192.168.1.x, im trying to create a guest 254.254.254.x using gateway 192.168.2.1 and another one 192.168.254.x using gateway 192.168.1.1
Don’t be overly creative, 254.254.254.0/24 is not valid private subnet, everything from 240.0.0.0 up is reserved and some devices may not like it.
Other than that, both addresses on ether4 and ether5 are invalid, they end with 0 and that’s actually subnet address. But I see it’s my fault, because I had zeros in my config too (I swear I don’t know how that happened ), sorry. So change that to 1 and also update gateways given out by DHCP servers.
And to isolate the two networks, remove this:
/ip firewall filter
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
), sorry. So change that to 1 and also update gateways given out by DHCP servers.