I’m trying to set up a full-duplex transparent wireless bridge with failover, using the following hardware:
Office Site:
1 x RB433 with 2 x R52n-M cards
Remote Site: (same as Office)
1 x RB433 with 2 x R52n-M cards
Both RB433s have been updated to RouterOS 4.12.
The idea is to give the remote client access as if he is plugged into the local network(see diagram below), but with the added benefits of full-duplex with redundancy. (provided by using OSPF?)
Could someone point me in the right direction please? All the tutorials and howto’s I’ve tried, failed to provide a working solution for my specific need and hardware as mentioned above.
Create a /30 subnet on wlan1 on each device. Ensure you can ping each other.
Create a different /30 subnet on wlan2 on each device. Ensure you can ping each other.
Enable OSPF. /routing ospf network add network=0.0.0.0/0 area=backbone <=I think that’s right…hehe
On AP wlan1 ospf interface(/routing ospf interface), set the cost to 20.
On Station wlan2 set the ospf interface cost to 20.
Create a bridge named bridge10. Add no ports. Put a host IP address on this bridge interface…say 1.1.1.1 on the AP and 1.1.1.2 on the Station.
Create an EoIP tunnel on each device and use the 1.1.1.X IP address of the neighbor as the destination IP.
Create a bridge interface on each device. Add ether1 and the EoIP tunnel to the bridge.
The network 0.0.0.0/0 is just to get this working in lab. If you do the exact network statements, do not forget to add the bridge interface addressing. Really, it doesn’t hurt to add 0.0.0.0/0 in this scenario, as he isn’t doing any routing…these are basically just transparent bridges.
Mattias, it won’t take OSPF any longer to find the devices. The network statement simply tells OSPF which interfaces to run on. This will cause it to run only on interfaces that have addressing bound, and we want it to run on all of these interfaces, so it is a bit of a moot point.
Thank you very much for replying. I’m not allowed to give karma yet - no karma button for beginners…
Luckily this is a lab set-up - needs to work properly before I install it. So, I’ve followed the steps in your first post and basically got to where the other tutorials also led me => everything seems to work except for the fact that the pc connected to the station can’t be pinged and cannot ping the office network. Your post made me look at the EoIP tutorial for transparent bridging, which of course is using only one set of wireless cards. I see that in said tutorial, the EoIP Tunnel points to the wireless IP on the other side. Your solution offered, suggests to point the EoIP tunnel to a portless bridge10(which has an IP assigned). Why? Should the OSPF then sort out access to that bridge and IP? It doesn’t seem to happen. Below is my set-up screenshot.
Mattias thanks for your input - will keep in mind with final set-up.
There is no ip assignment for bridge1. I think the ip on ether1 should be assigned to bridge1.
ADD: I see no ports assigned to bridge10.
OK, the coffee is kicking in!
Remove the ip assignment from ether1. That is the default ip/subnet from the default setting.
I think you want those two interfaces assigned to bridge10, not bridge1.
Thanks for the reply. Greg mentioned that bridge10 should not have any ports. Have tried moving the ports to bridge 10 and removed the IP assignments from the ether1’s on both sides. Still no luck with connecting the remote pc to the network though.
Some more questions:
Should the bridges the rstp protocol?
Should connection tracking in the firewall be disabled?
That should be no problem. It took a second to see what you want. I use no fancy routing protocols, so if you have enabled those, disable them.
One thing I do not see: Which interface connects to the internet? Is that eoip-tunnel? While waiting, I will work out the rest. The failover you can deal with once the basic connections work.
Basically the wireless bridge should just act as a virtual ethernet cable. So on both sides the switch/pc is plugged into ether1. For instance - on the remote side I plug my laptop in, with my laptop’s IP being 192.168.1.25. I should then be able to browse the network and network shares e.g. file server \192.168.1.5 at the office.
The above scenario work perfectly with single network card on each side with either WDS, MPLS or EoIP transparent bridge set-ups. It would just be great to add some redundancy, with the benefit of full duplex to this.
Yup, both radio’s are up and that creates the predicament I’m in. Utilising WDS creates the appearance that the link is working, but it only provides failover, not full duplex as well.
The idea was to get the wireless interfaces up first. You can ping the other side.
Then get OSPF working.
Bridge10 was going to just be a universal endpoint for the EoIP tunnel. It is a virtual IP in the middle of the router. If we use an IP in the middle of the router, it doesn’t matter which interface the traffic enters on, it will always make it to the intended destination. This is also referred to as a loopback interface.
Once you have OSPF up and working, the following should be all you need:
##add the ip address to the bridge10 interface
/ip address
add address=1.1.1.1/32 broadcast=1.1.1.1 comment=“” disabled=no interface=
bridge10 network=1.1.1.1
##add the ip address to the bridge10 interface
/ip address
add address=1.1.1.2/32 broadcast=1.1.1.2 comment=“” disabled=no interface=
bridge10 network=1.1.1.2
Followed your example. It appears to be working now. I left ether1 without an IP address on both sides and can now simply “plug into” the local network as if I’m directly connected. I did a simultaneous copy of large files both ways and the full-duplexing is working. After disabling the one set of wlan’s, it seamlessly fell back on the remaining set. The only strange thing was that, after re-enabling the wlan’s whilst copying the files, the traffic remained only on the one set of wlan’s and did not return to full-duplex…
Anyways, thanks for your input. Appreciate it.
Final test config for anyone interested:
(One side only. The other side is the same, except the IP’s should changes to x.x.x.2 and the eoip remote address is 1.1.1.1)
[admin@PC_SIDE] > interface wireless print
Flags: X - disabled, R - running
0 R name="wlan1" mtu=1500 mac-address=00:0C:42:65:D5:FA arp=enabled interface-type=Atheros 11N mode=ap-bridge
ssid="MikroTik_PC" frequency=5180 band=5ghz scan-list=default wds-mode=disabled wds-default-bridge=none
wds-ignore-ssid=no default-authentication=yes default-forwarding=yes default-ap-tx-limit=0
default-client-tx-limit=0 hide-ssid=no security-profile=default compression=no
1 R name="wlan2" mtu=1500 mac-address=00:0C:42:65:D5:0A arp=enabled interface-type=Atheros 11N mode=station
ssid="MikroTik_LAPTOP" frequency=5300 band=5ghz scan-list=default wds-mode=disabled wds-default-bridge=none
wds-ignore-ssid=no default-authentication=yes default-forwarding=yes default-ap-tx-limit=0
default-client-tx-limit=0 hide-ssid=no security-profile=default compression=no
[admin@PC_SIDE] > interface eoip print
Flags: X - disabled, R - running
0 R name="eoip-tunnel1" mtu=1500 l2mtu=65535 mac-address=02:73:25:30:6B:F4 arp=enabled remote-address=1.1.1.2
tunnel-id=0
[admin@PC_SIDE] > interface bridge print
Flags: X - disabled, R - running
0 R name="bridge1" mtu=1500 l2mtu=1526 arp=enabled mac-address=02:73:25:30:6B:F4 protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6
ageing-time=5m
1 R name="bridge10" mtu=1500 l2mtu=65535 arp=enabled mac-address=00:00:00:00:00:00 protocol-mode=none priority=0x8000
auto-mac=yes admin-mac=00:00:00:00:00:00 max-message-age=20s forward-delay=15s transmit-hold-count=6
ageing-time=5m
[admin@PC_SIDE] > interface bridge port print
Flags: X - disabled, I - inactive, D - dynamic
# INTERFACE BRIDGE PRIORITY PATH-COST HORIZON
0 eoip-tunnel1 bridge1 0x80 10 none
1 ether1 bridge1 0x80 10 none
[admin@PC_SIDE] > routing ospf network print
Flags: X - disabled, I - invalid
# NETWORK AREA
0 0.0.0.0/0 backbone
[admin@PC_SIDE] > routing ospf interface print
Flags: X - disabled, I - inactive, D - dynamic, P - passive
# INTERFACE COST PRIORITY NETWORK-TYPE AUTHENTICATION AUTHENTICATION-KEY
0 wlan1 20 1 broadcast none
1 D wlan2 10 1 broadcast none
2 DP bridge10 10 1 broadcast none
[admin@PC_SIDE] > ip address print
Flags: X - disabled, I - invalid, D - dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 10.10.10.1/30 10.10.10.0 10.10.10.3 wlan1
1 10.10.20.1/30 10.10.20.0 10.10.20.3 wlan2
2 1.1.1.1/32 1.1.1.1 1.1.1.1 bridge10
I have a problem with this setup I’m trying to figure out.
I already have it working full duplex, automatic failover, and bridging the two outside subnets and it’s awesome.
The only difference is I’m using two rb450G routers and 4 ubiquiti Rockets for the bridging links.
Even with the EOIP tunnel this still has a LARGE amount of bandwidth available.
If you are thinking about this solution try it, it’s awesome.
I have the UBNT rockets set up with addresses on the bridge subnets of the corresponding links for link A and link B.
I used a /29 for each instead of a /30 because of the extra interfaces on the rockets.
The problem I’m trying to figure out is how can I set this up differently where I can get back into the Rockets to manage them.
I say this because the layer 2 subnet will stretch across the two RB450g’s and plugged into that subnet I won’t be able to touch the subnet that the bridges are on.
