DVR with RB951Ui-2HnD

RouterOS Beginner Basics
1

salam to all

this is my network

1- Modem WAN (192.168.16.16) non static ip
2- RB951Ui-2HnD router (4.4.4.1)
3-LAN Pc's (4.4.4.2-4.4.4.254)
4-Wlan Pc's (5.5.5.2-5.5.5.254)

i work now very good with hotspot (user+pass)

since one week client who working banding with ip lan 4.4.4.229
want static ip to use DVR

i get static ip to this client
ip =41.x.x.182
mask =255.255.255.252
GW =41.x.x.181
ISP repair modem to work DVR
but he don't know how mikrotik work

please help me what i can do in mikrotik
i am new user
DVR work direct very good befor RB951Ui-2HnD router ( conected to mdem direct )
when i confuger DVR as ip =41.x.x.182
mask =255.255.255.252
GW =41.x.x.181

but after RB951Ui-2HnD Not working
now internet work to all pcs - dvr non

please help me the right way to working DVR

2

Why you use 4.4.4.0/24 and 5.5.5.0/24 as yours ip address? It’s not a private addresses, it is a public address.

3

i use 4.4.4.0/24 and 5.5.5.0/24 as for hosts which login via hotspot

this is my mikrotik configurations before i work with static ip

i find a help to my DVR but i am not sure if that true or not


and need me to change DVR IP to

4.4.4.200
255.255.255.0
4.4.4.1
8.8.8.8
8.8.4.4

and change DVR port the same
is that true?

4

Could you post your IP > Firewall > Filter rules?

5 



[admin@SISC] /ip firewall> export
# may/11/2015 12:52:19 by RouterOS 6.5
# software id = LQ4R-BR8T
#
/ip firewall filter
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" \
    disabled=yes
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" \
    disabled=yes to-addresses=0.0.0.0
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    src-address=5.5.5.0/24
add action=masquerade chain=srcnat comment="masquerade hotspot network" \
    src-address=4.4.4.0/24 to-addresses=0.0.0.0
add action=dst-nat chain=dstnat dst-port=9000 in-interface=WAN protocol=tcp \
    to-addresses=4.4.4.200 to-ports=9000
add action=dst-nat chain=dstnat dst-port=80 in-interface=WAN protocol=tcp \
    to-addresses=4.4.4.230 to-ports=80
6

Info>>>>>>>>>>>>>>>

i want to tell you that i work with dynamic ip from ISP
that mean:

Modem (192.168.x.x) >>>to>>> mikrotik router (4.4.4.1) >>>>to >>>> clients (4.4.4.2:4.4.4.254)
hotspot server for all clients


one host work 4.4.4.200 (binding)
this host want static ip alone to remote DVR

ISP give us this static ip and configure the modem
DVR working and remotely after modem Direct

my old network the same with no changes

what i want?

1-i want DVR working after Mikrotik as host
2- other hosts work too as old way by hotspot

thanks

7

Hy khaloudy,

what it’s the purpose of the modem ? it’s DSL technology ?
If so you need to set up your modem in bridge mode only then your NAT rule will work .

Please read / watch the following:

http://wiki.mikrotik.com/wiki/How_to_Connect_your_Home_Network_to_xDSL_Line
http://pcservis.flimel.eu/how-to-conect-to-the-internet-with-mikrotik-by-bridge-mode-on-dsl-modem-pppoe-client/
http://forum.mikrotik.com/t/bridge-adsl-modem-router-to-mikrotik-router/64172/1

Best Regards,

Daniel

8

thank you Mr Daniel

Our ISP don’t support bridge in her modem (router)
but support 2 lan ip
ISP confugur her Modem with 2 ips
IP address :192.168.1.1
Second IP address:: 41.XX.XXX.181 (this is static gatway)
and give me for dvr 41.XX.XXX.182
i can login to modem with any one

mikrotik WAN working now as 192.168.1.1
mikrotik lan working now as 4.4.4.1


can i give DVR 4.4.4.200?
and forwording 41.XX.XXX.182 to 4.4.4.220?
or forwording 192.168.1.1 to 4.4.4.220?


or forwording 192.168.1.1 to 41.XX.XXX.181?

9

Hi khaloudy,

first of all i will suggest you change the 4.4.4.0 class to something from private class like 10.0.0.0 - 10.255.255.255 ( http://en.wikipedia.org/wiki/Private_network).

Normally they should allowed you to put the modem in bridge mode or PPPoE Mode ( http://www.techlineinfo.com/difference-between-pppoe-and-bridge-mode-of-adsl-modem/). In this way your mikrotik receive public ip in order to access from internet the DVR.

Second you told us that the ISP provide you 2 ips
First IP address :192.168.1.1 [ it’s part also as private class so i this case you will not be able to access it from the internet ]
Second IP address:: 41.XX.XXX.181 (this is static gatway) [ this is public ip and you can access it from outside]
AND give me for dvr 41.XX.XXX.182 .

Are u able to access 41.XX.XXX.181 ip of the modem from outside ? If yes are you able to access your modem configuration ?

An idea it’s to set ip address ( 41.XX.XXX.182 ) to mikrotik interface .. see if you could access it from the internet .

Best Regards,

Daniel

10

Khaloudy you’ve been told… you cannot use public address space as if were private or you’ll have unexpected routing problems…

An idea it’s to set ip address ( 41.XX.XXX.182 ) to mikrotik interface .. see if you could access it from the internet .

Best Regards,

Daniel

Daniel I think that’s what his ISP provides as a workaround for the router not having bridge mode…

That would be the best approach, assigning that IP to the RB951 WAN interface.

11

i am sorry sir our ISP modems not support Bridge
no choice in NATpage to change PPPoe to Bridge
so i work now by this way>>>


modem working with 2 ip as gateway
192.168.1.1 ===============> modem ip login
41.XX.XXX.181 =============> modem static ip as gateway to static and login to modem too

Internet working without mikrotik
DVR working without Mikrotik

Now
i configure mikrotik like this way for 1 year

wan = 192.168.1.99/24
lan = 4.4.4.1/24 (hosts via lan)
wlan = 5.5.5.1/24 (wireless from modem)

hotspot setup
DHCP setup
firewall nat
IP dns
------------------------------- now all my network working very good via hotspot

except the new host which want DVR

DVR working and tested without mikrotik (very good)
not working with mikrotik
we work now without static ip and we not change this way

we get new static ip for DVR only not for all network
ip              =41.xx.xxx.182
mask       =255.255.255.252
gateway  = 41.xx.xxx.181

DNS1      =163.121.128.134
DNS2      =163.121.128.135

====================================================
i just want forwarded static ip to DVR

i am sorry i can't understand from links
but i can understand from WINBOX

can u tell me please what i do?

12

Hi khaloudy,

could you please tell me where is DVR phisical connected ?

It’s connected to modem or to mikrotik ?

Best Regards,

Daniel

13

Now connected to Mikrotik

14

Ok,

you write earlier that :

modem it’s working with 2 ip as gateway

192.168.1.1 ===============> modem ip login
41.XX.XXX.181 =============> modem static ip as gateway to static and login to modem too

and:

Now you configured mikrotik 1 year ago like :

wan = 192.168.1.99/24
lan = 4.4.4.1/24 (hosts via lan)
wlan = 5.5.5.1/24 (wireless from modem)

you also noted that DVR have the following IP : 41.xx.xxx.182 and if it’s connected directly to the modem can access the internet and also himself could be access it .
In this case my suggestion it’s to add secondary ip on wan interface of the mikrotik ( you can secondary ip from another network ) as the following:

wan = 192.168.1.99/24
wan = 41.xx.xxx.182/mask ( as secondary ip ) - also don’t forget to add static default route to 41.xx.xxx.181 ( in this case you will have two default routes )
lan = 4.4.4.1/24 (hosts via lan)
wlan = 5.5.5.1/24 (wireless from modem)

connect the DVR to mikrotik LAN interfaces and change ip address of the DVR to one of the lan host ( 4.4.4.199/24)
At the end write the correct nat rule to be able to be access from outside where destination ip should be 41.xx.xxx.182 to nat ip ( in this case ) 4.4.4.199

Best Regards,

Daniel

15

hi Daniel

i dd this steps

1- ip >> address >> add (81.xx.xxx.182/30) interface = wan
i have now 2 wan

2- ip >> route >> gateway (41.xx.xxx.181) become ( s - 0.0.0.0/0 - 41.xx.xxx.181 reachable wan) color become blue
i have now 2 rout

3- i change DVR ip to 4.4.199/24 and now connected to Mikrotik lan

but sorry i can’t understand this step
((((At the end write the correct nat rule to be able to be access from outside where destination ip should be 41.xx.xxx.182 to nat ip ( in this case ) 4.4.4.199)))

at last i am sorry for 1 mistake
this mistake wlan = 5.5.5.1/24 (wireless from modem) = wlan = 5.5.5.1/24 (wireless from mikrotik)
because this model have wan and wlan

i am sorry to tired you
best regards
khaloudy

16

up >>> up

17

Ok no problem ,

So to question for you now :

1.From the internet, from other system, are you able to ping ip address written on wan 41.xx.xxx.182?
2.From the local network you are able to connect to the DVR with the new IP 4.4.4.199 ( not 4.4.199) ?


If so follow the next steps to write a nat rule that will give you the opportunity to access the DVR from the internet .
Nat1.jpg
Nat2.jpg
Let me explain the rule create on pictures :the traffic it’s coming to Destination Nat 41.xx.xxx.182 on protocol tcp, to destination port 3999 on interface wan ( in my case internet ) will have an action destination nat to address 4.4.4.199 ( not 4.4.199 because you forgot an 4, i hope that it’s not this the ip address of the DVR ) to ports 3999 . For this rule i have selected log to be able to see in log section the status of the rule. Later you can unselected the log option .

With this rule you will be able to access the DVR from the internet when you will write on a favorite browser: http or https://41.xx.xxx.182:3999

I hope that this will work for you.

Best Regards,

Daniel

18

Hi Daniel

first i add the firwall >>nat as you said

now

1.From the internet, from other system, are you able to ping ip address written on wan 41.xx.xxx.182?

No i can’t ping 41.xx.xxx.182 from other system or my system

but i am able to ping with gateway 41.xx.xxx.181 form other system and my system



2.From the local network you are able to connect to the DVR with the new IP 4.4.4.199 ( not 4.4.199) ?

yes i can login to DVR with 2 way’s

IP: 4.4.4.199
IP: 41.xx.xxx.182

19

Hy,

please check if you have in firewall an input rule that will permit icmp packets. If not please add the rule before ( in font ) the rule that drop everything.

The rule that permit ping the outside interface :
Ping1.jpg
Ping 2.jpg
Ping3.jpg
Best Regards,

Daniel

20

Hi,

who is 41.xx.xxx.181 ? It’s the IPS gateway ?

Best Regards,

Daniel