I’m getting a /28 subnet (official v4 IPs) assigned from my ISP and want to assign 5 customers clients, each one a official IP for further usage. use 1 IP on my router board for my own /24 subnet.
But instead of having all these 5 clients bridged to the WAN Port and connected, I want to run all the traffic through my new CCR2004 Cloud core router, to be able to shape and manage and limit the traffic via mangle etc. otherwise each client can saturate the Fibelink whenever possible and I have no control over it.
I know how to assign my CCR these 5 IP addresses and the give the 5 clients unofficial IPs and do this via 1:1 NAT, but then my customer, has these inoffical IPs on his WAN interface.
Is there a nice solution, running it through my CCR and give away official IPs to my customers WAN Ports…?
It is possible to use PPPoE (which works on all operating systems the same way) or you can use a direct ethernet connection to each customer, where each end has a /32 address, but the configuration differs per operating system. At the Mikrotik end, you add it this way:
On client end, a mirror of this configuration is necessary. The some.private.ip.address must not be in conflict with anything in client’s network and the client must set it as the default gateway.
i definitely would prefer the direct ethernet connection to each customer (not PPPoE),
lets assume
Ether 1 - WAN = IP 91.100.100.18/28 (on my CCR), Network 91.100.100.16, GW 91.100.100.17
Ether 2 - cust1 (want to assign customer 91.100.100.19)
Ether 3- cust2 (want to assign customer 91.100.100.20)
so the customers get /32 address, what gw do they need to use?
can you please get a little more into detail or make an example on the above addresses, so I can try to get this up and running.
I really appreciate your help on this!
THANKs!
I wrote that above - you have to choose some address which doesn’t conflict with any address the client uses internally in their network. If you only use public IPs at your WAN, the safest choice is an address from the CGNAT range, 100.64.0.0/10. These are neither “public” nor “private”, so they don’t conflict with either of those.
I now added on
ether1: 100.64.0.1, Network 93.100.100.26
on client (mac)
93.100.100.26, GW: 100.64.0.1
I can now ping the CCR (which has 93.100.100.27/28 with GW 93.100.100.17) but cannot ping any other host (external) since I probably need to set a route for this interface on my CCR.
How can I get the traffic routed/forwarded? I added a forwarding rule via src ether 1 - dst WAN and also the bytes counting the traffic on the forwarding rule, but I’m sure there is something more missing…
Since you can ping the CCR from the MAC, the backward route on the Mikrotik does exist on the CCR. So the most likely reason why you cannot ping anything behind the CCR (from the perspective of the Mac) are firewall rules on the CCR.
At this stage, I’ll need the export of your current configuration. See my automatic signature right below for anonymisation hints.
To react at your PM, I’ve missed that you have the /28 assigned directly as the WAN subnet, rather than having it routed to you via some interconnection subnet.
In this case, you must set arp=proxy-arp on the WAN interface. This will make Mikrotik respond to the ARP requests sent by the ISP’s gateway that ask for MAC address of IPs within the /28, which are actually connected via the point-to-point tunnels, with its own MAC address, so the ISP’s gateway will deliver the packets for these IPs to the Mikrotik, which will forward them.
Thank you Sindy!
just saw your post so late.
Great I try this or otherwise ask my provide for the interconnection subnet which I could get when asking for this /28 Fibre Link.
enabled ARP Proxy as said and works like a charm (of course had to add some FW rules to forward the traffic) - yeah!
Client now has official ip from a seperate interface/network diretly routed on it’s NIC instead of 1:1 NAT!
But thank you for keeping up, this PTP Trick via private IPs is sweet!
THANKs!!!