Help for configuration

RouterOS Beginner Basics
1

Hello.

I am just starting out in a professional role where I have been asked to set up a specific configuration on a hAP AC².

I work for a company that supplies hardware and services to business clients. We provide connectivity—such as fiber links—and routers, which we configure either with standard settings or according to specific client requirements.

I am currently working alone and urgently need to create a configuration for a hAP AC²: the client wants one public IP routed to their firewall, and for a second public IP, they want DHCP to assign that public IP across all ports.

While I have a very useful internal tool for the first part of the setup (routing the IP to the firewall), I am completely unsure how to handle the "DHCP assigning the public IP to all ports" requirement. I assume I need to remove port 1 from the bridge, but is there anything else involved?

I would appreciate any help you can provide.

2

I am not sure what this requirement even means and may be neither are you. Often when you can sort out what is required, how to do it is either easy or it becomes clear that the requirement is nonsense. Suggest you get the requirement defined in terms of what the customer wants to achieve.

3

If it's meant to be professional, then the requests must be professional too,
not a source of different interpretations.

And if you need to be professional, take courses once this urgency is over.

4

Interpretation:
All ports (any one) must be assigned the same public IP address to all devices.

Therefore, the request makes no sense.

At most, it could have been something like:

"DHCP assigning IPs from the public pool 15.15.15.0/24 to the connected devices, on any port"

5

Thanks, everyone. I had the same feeling as you all, but I wasn't sure.
The most "sensible" solution would be to understand that there is one public IP assigned to the firewall and a second one bridged to the router's other ports—wouldn't it?
In any case, I’ll clarify this with the person who made the request. Thanks again.

6

Concur with Rextended. This is a paid job, do your client a real service and

a. high a consultant to get this job done ( https://mikrotik.com/consultants?category=consultants ) and then

b. get some training, if your company is too cheap to provide such training then recommend something like:
https://www.youtube.com/watch?v=a_XTHHPXbuk&list=PLJ7SGFemsLl3XQhO8g0hHCrKnC6J3KURk

There are also many online paid courses.

Pretending to be a Network IT Person for Mikrotik Equipment is not amusing. I for one would not help you as its not fair to the client to have someone fumble through an install/config. The fact that you dont even have the training to do requirements properly is very disconcerting and speaks to the lack of foundational training to do the job.

7

OK. I'll manage on my own, then. End of discussion. Thanks.

8

edited by accident...............

9

As has been said by others, this is a non-sense requirement.

If you don't understand what a client wants, make sure you do understand before working on the config. In my opinion, it is much better to be honest with your custormer and tell them you don't understand what they want, than to pretend you understand their requirements. That will just delay getting a working solution.

My guess is that what they really want is to have a standard nat masqueraded config sharing one public ip address, and the second public ip address being used for a public web server (the ip "routed to their firewall").

DHCP assigning the public IP to all ports makes no sense, since each host needs to have a unique ip address on the LAN. What can be done is to share a single public ip address to DHCP clients that are in their own private subnet.

For example, a public ip address of 203.0.113.25 that is being shared by a private subnet 192.168.122.0/24 with the router having its LAN bridge ip set to 192.168.122.1 and having a dhcp server providing ip addresses from a pool in 192.168.122.0/24 (for example 192.168.122.10-192.168.122.254).

Then a dhcp client on the subnet would get an address from the pool and its default gateway would be 192.168.122.1, but due to nat masquerade if the client pc browse to ipchicken.com, it would report the ip address as being 203.0.113.25 (even though the ip on the local area network may be 192.168.122.247). In fact any pc on the LAN would get the exact same ip address reported by ipchicken.com

And it you don't understand what was just said, then you do need to invest some time learning.