hi
I want to convert some clients who have rang ip 10.5.50.0/24 to a specific page like 10.5.50.1/any.html .when they request of any address from the Internet ..
I am sorry for bad english
/ip firewall address-list
add list=redirectTheseCustomers address=10.5.50.10
add list=redirectTheseCustomers address=10.5.50.11
/ip firewall mangle
add chain=prerouting connection-state=new src-address-list=redirectTheseCustomers protocol=tcp dst-port=80 action=mark-connection new-connection-mark=redirectThisConnection passthrough=yes
/ip firewall nat
add chain=dstnat connection-mark=redirectThisConnection action=redirect to-ports=8080
/ip proxy set enabled=yes
/ip proxy access
add action=accept disabled=no dst-address=[IP of server that hosts reminder]
add action=deny disabled=no redirect-to="http://my.server.com/any.html"
populate the address list with the IPs to be redirected, edit the proxy access rules as required with the right destination IP address and URL.
Also, just as a sidenote, please don’t post the same question multiple time, and choose the right sub-forum - this is neither scripting nor forwarding protocols.
well, bad english + desire to forward user to some webpage = forwarding protocol %)
p.s. no offence
thanks fewi and iam sorry for multi posts.. i tried it. it is great but when i put another static ip like 192.168.1.88 it redirects me also , i want redirect some ip from rang 10.5.50.0/24 only.. thank you agian
i am using v 4.10
seems like you are already using WebProxy
bind you proxy to another additional port and then make that proxy redirect rule to work only for that port. don’t forget also to change port in NAT redirect rule
same problem
All the IP redirect to web page in proxy
This is my settings
[admin@serverlk] > ip firewall address-list print
Flags: X - disabled, D - dynamic
# LIST ADDRESS
0 D ssh_blacklist 59.188.12.132
1 D ssh_blacklist 86.122.122.81
2 D ssh_blacklist 216.146.46.214
3 D ssh_blacklist 221.204.246.54
4 D ssh_blacklist 76.191.100.182
5 D ssh_blacklist 117.41.169.18
6 D ssh_blacklist 115.248.49.217
7 redirectTheseCustomers 10.5.5.0/24
[admin@serverlk] >
[admin@serverlk] > ip firewall mangle print
Flags: X - disabled, I - invalid, D - dynamic
0 chain=prerouting action=mark-connection
new-connection-mark=redirectThisConnection passthrough=yes
connection-state=new protocol=tcp
src-address-list=redirectTheseCustomers dst-port=80
[admin@serverlk] >
[admin@serverlk] > ip firewall nat print
Flags: X - disabled, I - invalid, D - dynamic
0 X ;;; place hotspot rules here
chain=unused-hs-chain action=passthrough
1 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=10.5.5.0/24
2 ;;; masquerade hotspot network
chain=srcnat action=masquerade src-address=10.5.50.0/24
3 chain=srcnat action=masquerade src-address=10.6.6.0/24
4 chain=dstnat action=redirect to-ports=8008 protocol=tcp
connection-mark=redirectThisConnection
[admin@serverlk] >
[admin@serverlk] > ip proxy print
enabled: yes
src-address: 0.0.0.0
port: 8080,8008
parent-proxy: 0.0.0.0
parent-proxy-port: 0
cache-administrator: ""
max-cache-size: none
cache-on-disk: no
max-client-connections: 600
max-server-connections: 600
max-fresh-time: 3d
serialize-connections: no
always-from-cache: no
cache-hit-dscp: 12
cache-drive: system
[admin@serverlk] >
/ip proxy access
add action=allow disabled=no dst-address=10.5.5.1
add action=deny disabled=no redirect-to="http://10.5.5.1/clients.html"
Where is the problem??
Wild guess: you have an address pool defined on the Hotspot network. That turns on the Universal NAT feature, which means that your static address in a different range is getting NAT’d to an address within the 10.5.5.0/24 range. Set the address pool on the Hotspot to ‘none’ and try again.
If that doesn’t work, describe how you connected with that static IP outside that range.
replace
add action=deny disabled=no redirect-to="http://10.5.5.1/clients.html"
with
add action=deny local-port=8008 disabled=no redirect-to="http://10.5.5.1/clients.html"
When i change the localport to 8008 a redirect crashed as if aSetting in firewall Inactive>>
That’s right
But when i change the address pool to none, I can not get static ip when restart
“crashed”?..
sorry for bad english
When i change the localport to 8008 a redirect disable as if aSetting in firewall Inactive>>
do you have enabled ‘transparent proxy’ in hotspot settings?..
But when i change the address pool to none, I can not get static ip when restart
If you change the address pool to none, you can use statics, but they have to be within the subnet on that Hotspot interface.
what about DHCP? 
This picture explains what I want … Maybe I need a script to do that .. or Maybe there are better solutions to do this
You can’t do that. As far as I know Hotspot Universal NAT happens before everything else, so to the router those IP addresses are only accessible as the address seen in the “To Address” column. They are 10.5.5.0/24 addresses just like clients that get an address via DHCP.
I can’t think of any way around that, and in my opinion what you’re trying to do is impossible to do with RouterOS. Then again I always turn off universal NAT so I don’t have much experience with it, and someone else can help you.
If ‘everyone that got an address via DHCP should get redirected’ is sufficient (which means that everyone smart enough to just statically assign an address within that subnet does not get redirected and has Internet access) you can contact support@mikrotik.com and ask where the dynamic DHCP address list feature went, and use that to populate an address list of clients to redirect.
hmmm… what if to catch packets in prerouting and mark them?.. will ‘Universal NAT’ work before prerouting?..
mmm?.. v4.10 - it’s here…
I say ‘hotspot first, prerouting second’. Here is the test:
I set my dhcp server/hotspot to 192.168.0.1/24 and issuing 192.168.0.8-192.168.0.250
I set my laptop ip static to 10.0.0.10/24 with gateway 10.0.0.1. Then
/ip firewall mangle
add chain=prerouting action=add-src-to-address-list src-address=10.0.0.0/16 address-list=10dot
add chain=prerouting action=add-src-to-address-list src-address=192.168.0.0/16 address-list=192dot
All transactions in the address list appear in the 192dot address list. Nothing in 10dot.
ADD: There is a parameter on the “add chain=prerouting hotspot=xxx” with several choices. Maybe that is where the Universal NAT can be intercepted?
The packet flow diagram shows Hotspot-In before even pre-routing. There’s also Hotspot-NAT but that’s the very last thing, and what he tried so far should have worked if that’s where Universal NAT takes place. If it is in Hotspot-In even what Tim is suggesting will not work, and you cannot access the original IP anywhere.
DHCP: I must be blind.