How do i route?

RouterOS Beginner Basics
1

i’am just guessing that i should route
DSC_1725 (Small).jpg
i have created an eoip tunnel to the 1.1.1.1 HQ firewall/router (clavister)
and successfully and its working nice..

i also want the office microtik to use the tunnel to the 2.2.2.2 mailserver this is where all attempt fails


/interface eoip
add !keepalive local-address=3.3.3.3  name=eoip-tunnel1 remote-address=1.1.1.1 \
    tunnel-id=0

/ip firewall filter
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept establieshed,related" connection-state=established,related
add chain=input comment="IPSEC-ESP 50" connection-state=new  dst-port=50 in-interface=SFP protocol=udp
add chain=input comment="IPSEC" connection-state=new  dst-port=500,1701,4500 in-interface=SFP protocol=udp
add chain=input comment="IPSEC-AH 51" connection-state=new  dst-port=51 in-interface=SFP protocol=udp
add action=drop chain=input comment="defconf: drop all from SFP" in-interface=SFP
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from SFP not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=SFP
add action=reject chain=forward comment="no netbios to tunnel" \
    connection-state=new dst-address=192.168.0.0/24 dst-port=135-139,445 \
    protocol=tcp
add chain=forward comment="Allow trafic from HQ" dst-address=192.168.88.0/24 \
    src-address=192.168.0.0/24
add chain=forward comment="Allow trafic to HQ" dst-address=192.168.0.0/24 \
    src-address=192.168.88.0/24


/ip firewall nat
add chain=srcnat action=accept place-before=0 \ dst-address=192.168.0.0/24 src-address=192.168.88.0/24
add chain=srcnat dst-address=192.168.0.0/24 src-address=192.168.88.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=eoip-tunnel1
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=SFP

/ip ipsec peer
add address=1.1.1.1/32 enc-algorithm=aes-256,aes-192,aes-128,3des generate-policy=port-strict local-address=\
    3.3.3.3 nat-traversal=no secret=0xahexpassword

/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.0.0/24 proposal=default sa-dst-address=1.1.1.1 sa-src-address=3.3.3.3 src-address=\
    192.168.88.0/24 tunnel=yes

/ip route
add check-gateway=ping comment=MailServer disabled=yes distance=1 dst-address=2.2.2.2/32 gateway=192.168.0.254 pref-src=\
    192.168.88.1
add comment="TAB LAN" distance=1 dst-address=192.168.0.0/24 gateway=eoip-tunnel1 pref-src=192.168.88.1
add distance=1 dst-address=192.168.0.254/32 gateway=eoip-tunnel1 pref-src=192.168.88.1 scope=10
/ip route add comment="IPsec Traffic to Client" disabled=no distance=1 dst-address=192.168.0.0/24 gateway=192.168.88.1 scope=30 target-scope=10

/ip route rule
add dst-address=2.2.2.2/32 interface=eoip-tunnel1 src-address=192.168.88.0/24 table=main
add action=lookup-only-in-table dst-address=2.2.2.2/32 interface="eoip-tunnel1" src-address=192.168.88.0/24 table=main

/ip firewall service-port
set sip disabled=yes
set h323 disabled=yes

/system ntp client
set enabled=yes primary-ntp=193.11.166.8 secondary-ntp=192.36.134.17 \
    server-dns-names=ntp1.sp.se,ntp1.mmo.netnod.se,ntp2.sp.se

so how do i reach the dmz server 2.2.2.2 trough the tunnel

(its a mail server.. and from outside i have to use ssl, but not from the inside)
(it works when i use a clavister as office router so i guess the HQ firewall/router is setup right… i dont have access to it)

2

the eoip-tunnel1 interface is member of a bridge called ipsec-net and also the eterport that is connected to the 192.168.88.0/24 lan

3

You’ll also need this policy:
add dst-address=2.2.2.2/32 proposal=default sa-dst-address=1.1.1.1 sa-src-address=3.3.3.3 src-address=
192.168.88.0/24 tunnel=yes

.. or else it won’t encrypt the mail server traffic.

Honestly, since the mail server has a public IP, I’d recommend that you simply enforce secure mail access protocols (pop3s, imaps, smtp-tls) and just use the public IP - because if the tunnel happens to fail for some strange reason, the mail server will still be accessible, and the routing/NAT rules will stay simple.

4

Thanks for your reply.. it helped alot.. i had to make the mail ipsec policy level unique else it did not work

add dst-address=2.2.2.2/32 level=unique proposal=default sa-dst-address=1.1.1.1 sa-src-address=3.3.3.3 \
    src-address=192.168.88.0/24 tunnel=yes

The reason for mail trough the tunnel is: we have a lot of old equipment that does not support secure mail (ssl, auth etc)

i’ll post a full export later :slight_smile:

5

Another idea would be to make the IPSec policy match the tunnel packets themselves, and route everything across the tunnel interface - that way, you can route any arbitrary traffic without having to update the IPSec policy. (this is my preferred way to use IPSec)

6

that sounds very intressting, (clavister recently change their licensing mode to count SA’s, intead of tunnels)

Here are a full export from the RB751U-2HnD

Legend:
1.1.1.1 HQ Clavister Public IKE IP
2.2.2.2 Mailsever DMZ public IP
3.3.3.3 Office local public IP
4.4.4.4 HQ in/out Public IP
192.168.0.0/24 HQ local lan
192.168.0.254 HQ local gateway (clavister)

# mar/09/2016 08:53:05 by RouterOS 6.34.2
# software id = PLP3-P4UV
#
/interface bridge
add admin-mac=00:0C:42:E1:B2:A7 auto-mac=no name=ipsec-net
add name=wifi-bridge

/interface ethernet
set [ find default-name=ether1 ] name=1.WAN
set [ find default-name=ether2 ] name=2.WIFI-LAN
set [ find default-name=ether3 ] name=3.LAN-master
set [ find default-name=ether4 ] master-port=3.LAN-master name=4.LAN
set [ find default-name=ether5 ] master-port=3.LAN-master name=5.LAN

/interface eoip
add allow-fast-path=no !keepalive local-address=3.3.3.3 mac-address=00:00:5E:88:88:88 name=eoip-tunnel1 remote-address=\
    1.1.1.1 tunnel-id=0

/ip neighbor discovery
set "1.WAN" discover=no

/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk,wpa2-eap management-protection=allowed mode=dynamic-keys name=Thage-Wifi-security \
    supplicant-identity="" unicast-ciphers=tkip,aes-ccm wpa2-pre-shared-key=WifiPassword

/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce disabled=no distance=indoors frequency=auto \
    hide-ssid=yes mode=ap-bridge security-profile=Thage-Wifi-security ssid=TAB wireless-protocol=802.11

/ip ipsec proposal
set [ find default=yes ] auth-algorithms=sha1,md5
add enc-algorithms=aes-128-cbc,3des name=Site2Site

/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.99
add name=wifi-pool ranges=192.168.188.10-192.168.188.99

/ip dhcp-server
add address-pool=default-dhcp disabled=no interface=ipsec-net name=lan-dhcp
add address-pool=wifi-pool disabled=no interface=wifi-bridge name=wifi-dhcp

/interface bridge port
add bridge=wifi-bridge comment="WIFI/UE port" interface=2.WIFI-LAN
add bridge=wifi-bridge comment="Internal WIFI" interface=wlan1
add bridge=ipsec-net interface=eoip-tunnel1
add bridge=ipsec-net interface=3.LAN-master

/ip address
add address=192.168.88.1/24 comment=defconf interface=ipsec-net network=192.168.88.0
add address=192.168.188.1/24 interface=wifi-bridge network=192.168.188.0

/ip cloud
set ddns-enabled=yes update-time=no

/ip dhcp-client
add comment=defconf dhcp-options=hostname,clientid disabled=no interface=1.WAN

/ip dhcp-server network
add address=192.168.88.0/24 dns-server=192.168.0.5,192.168.88.1 gateway=192.168.88.1
add address=192.168.188.0/24 dns-server=8.8.8.8 gateway=192.168.188.1

/ip dns
set allow-remote-requests=yes servers=8.8.8.8

/ip dns static
add address=192.168.88.1 name=router

/ip firewall address-list
add address=4.4.4.4 comment=fw.example.com list=TrustedIP
add address=192.168.0.254 comment="fw.example.com internt" list=TrustedIP
add address=192.168.88.0/24 comment="Local IP's" list=TrustedIP
add address=192.168.3.0/24 comment="L2TP LAN" list=TrustedIP
add address=192.168.0.0/24 comment="LAN huvudkontor" list=TrustedIP

/ip firewall filter
add action=reject chain=forward comment="no netbios to tunnel" connection-state=new dst-address=192.168.0.0/24 dst-port=\
    135-139,445 protocol=tcp
add chain=forward comment="allow trafic from HQ" dst-address=192.168.88.0/24 src-address=192.168.0.0/24
add chain=forward comment="allow mailtrafic from HQ" dst-address=192.168.88.0/24 src-address=2.2.2.2
add chain=forward comment="allow trafic to HQ" dst-address=192.168.0.0/24 src-address=192.168.88.0/24
add chain=forward comment="allow mailtrafic to HQ" dst-address=2.2.2.2 src-address=192.168.88.0/24
add chain=input comment="defconf: accept ICMP" protocol=icmp
add chain=input comment="defconf: accept establieshed,related" connection-state=established,related
add action=log chain=input comment="log ipsec" dst-port=50,51,500,1701,4500 protocol=udp
add chain=input comment="IPSEC-ESP 50" connection-state=new connection-type="" dst-port=50 in-interface=1.WAN protocol=udp
add chain=input comment=IPSEC connection-state=new connection-type="" dst-port=500,1701,4500 in-interface=1.WAN protocol=udp
add chain=input comment="IPSEC-AH 51" connection-state=new connection-type="" dst-port=51 in-interface=1.WAN protocol=udp
add chain=input comment="Remote Admin Winbox" dst-port=8291 protocol=tcp src-address-list=TrustedIP
add chain=input comment="Remote Admin using webfig" dst-port=8780 protocol=tcp src-address-list=TrustedIP
add action=drop chain=input comment="defconf: drop all from WAN" in-interface=1.WAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related
add chain=forward comment="defconf: accept established,related" connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf:  drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=\
    new in-interface=1.WAN

/ip firewall nat
add chain=srcnat dst-address=192.168.0.0/24 src-address=192.168.88.0/24
add chain=srcnat dst-address=2.2.2.2 src-address=192.168.88.0/24
add chain=srcnat dst-address=192.168.88.0/24 src-address=2.2.2.2
add chain=srcnat dst-address=192.168.88.0/24 src-address=192.168.0.0/24
add action=masquerade chain=srcnat comment="enable for access to tunnel from other bridges" disabled=yes out-interface=\
    ipsec-net
add action=masquerade chain=srcnat comment="defconf: masquerade" out-interface=1.WAN

/ip firewall service-port
set h323 disabled=yes
set sip disabled=yes

/ip ipsec peer
add address=1.1.1.1/32 enc-algorithm=aes-256,aes-192,aes-128,3des generate-policy=port-strict local-address=\
    3.3.3.3 secret=0xHEXpsk

/ip ipsec policy
set 0 disabled=yes
add dst-address=192.168.0.0/24 proposal=Site2Site sa-dst-address=1.1.1.1 sa-src-address=3.3.3.3 src-address=\
    192.168.88.0/24 tunnel=yes
add dst-address=2.2.2.2/32 level=unique proposal=Site2Site sa-dst-address=1.1.1.1 sa-src-address=3.3.3.3 \
    src-address=192.168.88.0/24 tunnel=yes

/ip route
add check-gateway=ping comment=MailServer distance=1 dst-address=2.2.2.2/32 gateway=eoip-tunnel1 pref-src=192.168.88.1
add comment="IPsec trafic to HQ" distance=1 dst-address=192.168.0.0/24 gateway=eoip-tunnel1 pref-src=192.168.88.1

/ip route rule
add dst-address=2.2.2.2/32 interface=eoip-tunnel1 src-address=192.168.88.0/24 table=main

/ip service
set www address=4.4.4.4/32,192.168.88.0/24,192.168.0.0/24,192.168.3.0/24 port=8780
set winbox address=4.4.4.4/32,192.168.88.0/24,192.168.3.0/24,192.168.0.254/32

/ip upnp
set enabled=yes

/system clock
set time-zone-name=Europe/Stockholm

/system identity
set name=MikroTik88

/system leds
set 0 interface=wlan1

/system logging
add topics=e-mail
add disabled=yes topics=ipsec,debug

/system ntp client
set enabled=yes primary-ntp=192.36.134.17

/system scheduler
add interval=10m name="keepalive 10m" on-event=keepalive policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
    start-date=feb/23/2016 start-time=09:55:13
add interval=4w2d name="ebackup 30d" on-event=e-backup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive \
    start-date=feb/28/2016 start-time=01:00:00

/system script
add name=e-backup owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/system backup save name\
    =email; /tool e-mail send to=\"admin@mail.com\" subject=([/system identity get name] . \" Backup\") file=email.backup"
add name=keepalive owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=\
    ":log info \"starting ping to intranet\"\r\
    \n/tool ping 192.168.0.2 count=10\r\
    \n:log info \"ping to intranet done\"\r\
    \n"

/tool e-mail
set address=2.2.2.2 from=admin@mail.com

/tool graphing interface
add allow-address=192.168.88.0/24
add allow-address=4.4.4.4/32
add allow-address=192.168.0.254/32

/tool graphing resource
add allow-address=4.4.4.4/32
add allow-address=192.168.88.0/24
add allow-address=192.168.0.254/32

/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ipsec-net

/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ipsec-net
7

The wifi net should not reach resources on the lan, it should just have access to internet

is there a startup script that i can use to create the eoip interface, peers and policys so that i can use it on a dynamic local ip?

8

i had to change in the route table creating a new list and then change the routing rules so that they only lookup in that specific list.. else i could not use mail from the wifi network..

A new problem appered:
i cant surf to some webpages like:
http://www.microsoft.com
http://www.mozilla.org
http://www.aftonbladet.se
http://www.kristianstadsbladet.se

while others works like:
http://www.google.com
youtube (but cant stream)
http://www.blocket.se
mikrotik.com (but cant download winbox)

9

That’s a classic sign of an MTU problem. Either lower the MTU on your tunnels or add a mangle rule to adjust MSS for TCP.

http://wiki.mikrotik.com/wiki/Manual:IP/Firewall/Mangle#Change_MSS

10

how can the tunnel affect internet traffic?

i have tried dos ping to determine that the max mtu could be

ping mozilla.org -f -l 1472

1472+28 = 1500

i guess i should change the MTU & L2 MTU on my 1.WAN interface (ether1) to 1500 ??

when pinging our RDP server inside the HQ net trough the tunnel i get max MTU 1410+28 = 1438

my eoip-interface show actual mtu 1410 and L2 MTU 65535

IF i use mangle.. what interface should i mangle?

11

I would say to mangle the EoIP interface - is this interface being used as a simple IP interface (do you have an IP address assigned to the EoIP interface) or as a bridge between sites? (sorry, I didn’t go re-read the thread, so if this has already been stated, then I apologize)

If routed, then you can use the EoIP interface. Simple.

If bridged, then the answer is a bit trickier, but I’d say the easiest solution would be to enable the “use IP firewalls” option on the bridge and mangle on the EoIP interface anyway. Otherwise, you’ll need to mangle on the bridge interface, which will affect all connections unless you narrow the scope of the MSS rule as well.

12

it is bridged:

i went to the bridge and klicked settings and marked firewall

/ip firewall mangle 
add out-interface=eoip-tunnel1 protocol=tcp tcp-flags=syn action=change-mss new-mss=1438 chain=forward

from the terminal.. but when looking in firewall mangle it was red so i had to change to ipsec-net bridge

while searching i found that one could skip smaller mtu’s

/ip firewall mangle
add action=change-mss chain=forward new-mss=1438 out-interface=ipsec-net protocol=tcp tcp-flags=syn tcp-mss=!0-1438
13

na.. did not help.. i guess i missed somthing more?

the pings did not change.. so i guess the mangle did not work?