My ISP provides a public IP which is locked to my previous router’s MAC address and additional carrier-grade nat IPs. I want my mikrotik router to pick up both the public IP and an additional “anonymous” IP and to use the anonymous IP for all regular outbound traffic, and the public IP only for traffic that originates as inbound traffic to the public IP. My setup is currently not working right; I believe that this is because my ISP requires that the source mac matches the assigned IP for outbound traffic, and my mikrotik router is sending out all traffic with the same source mac.
My configuration is setup like this:
ether1 runs a DHCP client with the mac from my old router XX
ether2 runs a vlan trunk to a vlan switch for my local lan
ether3 is connected to my ISP incoming fiber converter
my vlan setup is:
2: internet connection
11: local lan
12: other local lan
21: ISP ip phone
99: admin vlan
my vlan router is setup to expose vlan 2 untagged on a port that is looped back to ether1 on my mikrotik router
So basically, internet comes in on ether3. It is tagged with vlan=2 and a dhcp client runs on vlan2 to pick up the cgnat anonymous ip. It is the exposed over the vlan trunk ether2 to my other switch, which returns it on ether1 on which another dhcp client runs to pick up the public ip.
The DHCP client running on ether1 is configured to not add a default route, but rather runs a script to set up its default route in a separate routing table named public_ip
I have configured the firewall with the intent that any inbound connection on ether1 is marked with “public_ip_connection” and any connection marked “public_ip_connection” looks up its routing information from the public_ip routing table.
However, incoming connections on my public IP do not seem to work right. TCP connections take a long time to set up and it seems that packets are dropped. I have tried to debug the issue using wireshark and what I believe to be happening is that the router is sending out packets with the wrong source mac address - not the mac address that matches the source ip, and that my ISP filters out packets based on mac address vs DHCP assigned ip. But obviously something else could be wrong, if so I would much appreciate any suggestions at all.
This is my configuration with addresses redacted:
# 2023-08-04 14:00:26 by RouterOS 7.10.1
#
# model = RB5009UG+S+
# serial number = HEE0XXXXXXX
/interface bridge
add admin-mac=48:A9:8A:YY:YY:YY auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] mac-address=60:03:A6:XX:XX:XX
/interface vlan
add interface=bridge name=adminvlan vlan-id=99
add interface=bridge name=fakewanvlan vlan-id=12
add interface=bridge name=internalvlan vlan-id=11
add interface=bridge name=internetvlan vlan-id=2
/interface list
add comment="Internet WAN" name=Internet
add comment="Local and internal interfaces" name=Local
add comment="Internet Public Reachable IP" name=PublicIP
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
add name=dhcp11 ranges=192.168.11.40-192.168.11.90
add name=adminpool ranges=192.168.99.100-192.168.99.150
add name=pool12 ranges=192.168.12.100-192.168.12.150
/ip dhcp-server
add address-pool=dhcp11 interface=internalvlan lease-time=10m name=internaldhcp
add address-pool=adminpool interface=adminvlan name=admindhcp
add address-pool=pool12 interface=fakewanvlan name=fakewandhcp
/routing table
add comment="Public IP source route" disabled=no fib name=public_ip
/interface bridge port
add bridge=bridge comment="GS1900-8HP trunk" frame-types=admit-only-vlan-tagged interface=ether2
add bridge=bridge comment="Internet WAN" frame-types=admit-only-untagged-and-priority-tagged interface=ether3 pvid=2
add bridge=bridge comment=hpskrivare interface=ether4 pvid=11
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment="backup admin port" frame-types=admit-only-untagged-and-priority-tagged interface=ether8 pvid=99
add bridge=bridge comment=defconf interface=sfp-sfpplus1
/ip firewall connection tracking
set tcp-syn-received-timeout=1m5s tcp-syn-sent-timeout=1m5s
/ip neighbor discovery-settings
set discover-interface-list=Local
/interface bridge vlan
add bridge=bridge comment=LAN tagged=ether2,bridge,ether7 vlan-ids=11
add bridge=bridge comment="Admin VLAN" tagged=bridge,ether2 untagged=ether8 vlan-ids=99
add bridge=bridge comment=Internet tagged=ether2,bridge untagged=ether3 vlan-ids=2
add bridge=bridge comment=fakewan tagged=ether2,bridge vlan-ids=12
add bridge=bridge comment="IP Phone" tagged=ether2,ether3 vlan-ids=21
/interface list member
add comment=defconf interface=internalvlan list=Local
add comment=defconf interface=ether1 list=Internet
add interface=adminvlan list=Local
add interface=internetvlan list=Internet
add interface=fakewanvlan list=Local
add interface=ether1 list=PublicIP
/ip address
add address=192.168.11.1/24 interface=internalvlan network=192.168.11.0
add address=192.168.99.1/24 comment="Admin VLAN 99 router" interface=adminvlan network=192.168.99.0
add address=192.168.12.1/24 interface=fakewanvlan network=192.168.12.0
add address=192.168.1.77/24 comment="Only for communicating with old router" interface=internalvlan network=192.168.1.0
/ip dhcp-client
add comment=defconf interface=internetvlan
add add-default-route=no interface=ether1 script="{\r\
\n :local rmark \"public_ip\"\r\
\n :local gw \$\"gateway-address\"\r\
\n :local count [/ip route print count-only where comment=\"PUBLICIP\"]\r\
\n :if ( \$bound = 1 ) do={\r\
\n :if ( \$count = 0 ) do={\r\
\n :log info \"Public IP DHCP route created for gateway=\$gw\";\r\
\n /ip route add gateway=\$gw comment=\"PUBLICIP\" routing-table=\$rmark\r\
\n } else={\r\
\n :log info \"Public IP DHCP route updating for gateway=\$gw\";\r\
\n :if ( \$count = 1 ) do={\r\
\n :local routeid [/ip route find where comment=\"PUBLICIP\"]\r\
\n :if ([/ip route get \$test gateway] != \$gw) do={\r\
\n /ip route set \$test gateway=\$gw\r\
\n }\r\
\n } else={\r\
\n :error \"Multiple public IP routes found\"\r\
\n }\r\
\n }\r\
\n } else={\r\
\n :log info \"Public IP DHCP unbound\";\r\
\n /ip route remove [find comment=\"PUBLICIP\"]\r\
\n }\r\
\n}" use-peer-dns=no use-peer-ntp=no
/ip dhcp-server alert
add interface=internalvlan
add interface=*11
/ip dhcp-server network
add address=192.168.11.0/24 dns-server=192.168.11.1 gateway=192.168.11.1 netmask=24
add address=192.168.12.0/24 dns-server=192.168.12.1 domain=local.lan gateway=192.168.12.1 netmask=24
add address=192.168.99.0/24 comment=adminvlan
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.0.0/16 list=localips
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Accept connections from admin vlan" in-interface=adminvlan
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!Local
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=Internet
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Set connection mark on any inbound packets on public IP interfaces" connection-mark=no-mark in-interface-list=PublicIP new-connection-mark=public_ip_connection passthrough=yes
add action=mark-routing chain=prerouting comment="Set routing mark on connections marked public ip" connection-mark=public_ip_connection dst-address-list=!localips dst-address-type=!local new-routing-mark=public_ip passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=Internet
add action=dst-nat chain=dstnat dst-port=80,443 in-interface-list=PublicIP protocol=tcp to-addresses=192.168.11.22
add action=dst-nat chain=dstnat dst-port=19132,19133 in-interface-list=PublicIP protocol=tcp to-addresses=192.168.11.20
add action=dst-nat chain=dstnat dst-port=19132,19133 in-interface-list=PublicIP protocol=udp to-addresses=192.168.11.20
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!Local
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!Local
/system clock
set time-zone-name=Europe/Stockholm
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=Local
/tool mac-server mac-winbox
set allowed-interface-list=Local