HowTo: Initial Configuration

pedzopenguin · March 10, 2011, 3:57am

I’m very experienced with system administration but I have very limited knowledge when routers are in question.
I’m hoping you guys out there will help me master my first RouterBOARD I got as a birthday present.

I am using ASUS wireless router on my server to enable internet for laptop users and everything is working just fine.
Recently, server load increased and I wanted to limit bandwidth to WiFi clients, which is mission impossible on ASUS router

This is the scenario I would like to accomplish with RB750 implementation:

Out-of-the box (with Default config) works like charm except for two things:

I would like to limit bandwidth on Ethernet3 port and
I need to set up port forwarding for my server on Ethernet2 port.

Now in detail:

Ethernet1 port: WAN Connection through ISP’s Cable Modem
It is dynamiclly assigned IP address and that port is already configured as DHCP client, so nothing really has to be changed.
Local address to access that modem is: 192.168.100.10, but I believe that info is not important for this scenario.

Ethernet2 port: Connection to Server
My server has a lot of roles (see pic above).
That port on RB750 has to act as NAT (port forward) and with no other restrictions (bandwidth limiting, etc.).
Some of the ports I need to have forwarded to Server’s IP are: 21, 25, 80, 443, 110, 3389, 5900, 123 (UDP), 41055, etc.

Ethernet3 port: ASUS WL-520g, or how to enable wireless on non-wireless RB750
I’m currently using this ASUS router and I was happy with it until recently. Now I need to limit other users on my LAN which can not be done on ASUS.
I will configure that WiFi router to act as AP and that’s not the issue, the problem is how to limit bandwidth of Wireless clients to lets say:

Download limit: 2.482Mbps
Upload Limit: 145kbps

Clients should not have any other restrictions than bandwidth limit! All ports open, uninterrupted connection to server, MFP, etc.

Ethernet4 port: Network MFP
Do I need to say something here other than IP (see pic above)?

Ethernet5 port
Unused. Can be disabled.

Please help me do this! I know it’s basic stuff but I have never used MikroTik before and after reading tones of wikies and 4um’s and learning its possibilities - I know I will thrill studying stuff that baby can do

Thank you in advance.

fewi · March 10, 2011, 5:11am

It would be best if you set the cable modem to bridge mode so the router directly gets a public IP from the cable service provider. Double NAT is bad. Doesn’t change the below config, though.

By default an RB750 comes with a DHCP client configured on ether1, so that’s plug and play. Ports ether2 through ether5 are switched, and on the same network.

First, apply an IP address to ether2, which is the master port all other ports slaved to. A default route will be installed by the DHCP client on the WAN port.

/ip address add address=192.168.81.1/26 interface=ether2

Now, create a queue for the DHCP clients to rate limit them. Also, mark packets that are to be rate limited.

/ip firewall mangle
add chain=prerouting in-interface=ether2 src-address=192.168.1.30-192.168.1.50 action=mark-packet new-packet-mark=upload
add chain=postrouting out-interface=ether2 dst-address=192.168.1.30-192.168.1.50 action=mark-packet new-packet-mark=download
/queue type 
add name=upload type=sfq
add name=download type=sfq
/queue tree
add name=upload parent=global-in queue=upload max-limit=145000 packet-mark=upload
add name=download parent=global-out queue=download max-limit=2482000 packet-mark=download

Then port forward, and source NAT outbound traffic:

/ip firewall NAT
add chain=srcnat out-interface=ether1 action=masquerade
add chain=dstnat in-interface=ether1 protocol=tcp dst-port=21,25,80,443,110,3389,5900 action=dst-NAT to-address=192.168.81.11
add chain=dstnat in-interface=ether1 protocol=udp dst-port=123 action=dst-NAT to-address=192.168.81.11

And finally a stateful firewall:

/ip firewall filter
add chain=input connection-state=established action=accept 
add chain=input connection-state=related action=accept 
add chain=input connection-state=invalid action=drop 
add chain=input in-interface=ether2 action=accept
add chain=input action=drop 
add chain=forward connection-state=established action=accept 
add chain=forward connection-state=related action=accept 
add chain=forward connection-state=invalid action=drop 
add chain=forward in-interface=ether2 action=accept
add chain=forward dst-address=192.168.81.11 protocol=tcp dst-port=21,25,80,443,110,3389,5900 action=accept
add chain=forward dst-address=192.168.81.11 protocol=udp dst-port=123 action=accept
add chain=forward action=drop

pedzopenguin · March 12, 2011, 12:10am

Are you God?! Thanks a lot!
To tell the truth, I didn’t expect anyone to answer since there is a lot of config to do… You really made my day and I couldn’t wait to come to office a try your config…

First things first: The cable modem is set to bridge public IP and is working fine.

I had to replace just two small details in your code:

In your lines:

add chain=prerouting in-interface=ether2 src-address=192.168.1.30-192.168.1.50 action=mark-packet new-packet-mark=upload

>

I had to put **192.168.[u]81[/u].X** since that is my network; Just a detail... No offence meant :slight_smile:

2. In your lines:

> ```text
add name=upload type=sfq

I used kind instead of type since that sintax is not recognised by my RouterOS v4.5… I hope that’s OK, since bandwidth limiting is doing it’s job!

Well done!!!

Now just two minor details that has happened:

1. IIS problem
When I try to access my website, MikroTik is giving me webpage instead of forwarding that request to IIS server at 192.168.81.11:

and OWA (Outlook Web Access) acts similar:

2. FTP problem
also, same thing happened to FTP:

Mail and other stuff seems to be working.

I believe this is a piece-of-cake for a expert like you and that this is just a matter to disable those services on MikroTik, and I even hate myself for posting this, but I couldn’t easy-find Google’s answer for this issue

Now my netwok diagram picture is not shown in this post since I published it through my website:

If you need it for reference, here it is:

Thanks again man!

pedzopenguin · March 12, 2011, 12:18am

Btw,

I have tired to disable IP → Services: FTP and WWW with no success

Regards.

fewi · March 12, 2011, 12:20am

I can hit your web server just fine.
http://www.bugman.in.rs/NetworkConfig.png
That loads for me, obviously across the Internet. I can also telnet to port 21 on www.bugman.in.rs and get a prompt from a Microsoft FTP server, so that also appears to be working. tcp/443 is also an open port for me.

How are you testing your own web site? Are you testing from inside the network? And does the web site’s DNS record resolve to a public IP address? If yes, look at this article: http://wiki.mikrotik.com/wiki/Hairpin_NAT

And yeah, sorry for typos - that was all done on a phone, and from memory.

pedzopenguin · March 12, 2011, 1:00am

Yes I’m testing them from inside LAN, stupid me!
We have configured NAT on ether1 and I’m accessing from ether2.

I’ll try that HairpinNAT method… Feedback will follow…

fewi · March 12, 2011, 1:13am

Thinking about it, remove the in-interface=ether1 from the dst-nat rules, and add dst-address-type=local. Then add the hairpin NAT configuration. That should work.

Right now the rule says “when a packet establishing a new connection comes in via ether1 for the following ports, forward it to the server”. That won’t work for local access. The above change would set the rule to “when a packet establishing a new connection comes into the router and before any NAT is performed has a destination IP that resides on a router interface, forward it to the server”. That will work for outside access the same way it does now. It also enables you to add the source NAT configuration necessary for hairpin NAT when you access from the inside.

Hope that makes sense.

pedzopenguin · March 12, 2011, 1:21am

I’ve added code:

add chain=srcnat src-address=192.168.81.0/26 dst-address=192.168.81.11 protocol=tcp dst-port=21,80,443 out-interface=ether2 action=masquerade

,with no luck.

Can you tell me where I’m going wrong?

I can access ftp, owa and web using IP address or FQDN, so yes I need to have Hairpin NAT configured, but I don’t know how

fewi · March 12, 2011, 1:33am

Please post the output of “/ip address print detail” and “/ip firewall export” to make sure I get the details right.

pedzopenguin · March 12, 2011, 1:37am

Here is the output:

[penguin@MikroTik] > /ip address print detail 
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     address=192.168.88.1/24 network=192.168.88.0 broadcast=192.168.88.255 
     interface=ether2-local-master actual-interface=ether2-local-master 

 1   address=192.168.81.1/26 network=192.168.81.0 broadcast=192.168.81.63 
     interface=ether2-local-master actual-interface=ether2-local-master 

 2 D address=89.216.240.171/22 network=89.216.240.0 broadcast=89.216.243.255 
     interface=ether1-gateway actual-interface=ether1-gateway

[penguin@MikroTik] > /ip firewall export 
# jan/02/1970 01:02:59 by RouterOS 4.5
# software id = V4W4-HAV1
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s \
    tcp-close-wait-timeout=10s tcp-established-timeout=1d \
    tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no \
    tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=input comment="default configuration" disabled=no \
    protocol=icmp
add action=accept chain=input comment="default configuration" \
    connection-state=established disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="default configuration" \
    connection-state=related disabled=no in-interface=ether1-gateway
add action=drop chain=input comment="default configuration" disabled=no \
    in-interface=ether1-gateway
add action=accept chain=input comment="" connection-state=established \
    disabled=no
add action=accept chain=input comment="" connection-state=related disabled=no
add action=drop chain=input comment="" connection-state=invalid disabled=no
add action=accept chain=input comment="" disabled=no in-interface=\
    ether2-local-master
add action=drop chain=input comment="" disabled=no
add action=accept chain=forward comment="" connection-state=established \
    disabled=no
add action=accept chain=forward comment="" connection-state=related disabled=\
    no
add action=drop chain=forward comment="" connection-state=invalid disabled=no
add action=accept chain=forward comment="" disabled=no in-interface=\
    ether2-local-master
add action=accept chain=forward comment="" disabled=no dst-address=\
    192.168.81.11 dst-port=21,25,80,443,110,3389,5900 protocol=tcp
add action=accept chain=forward comment="" disabled=no dst-address=\
    192.168.81.11 dst-port=123 protocol=tcp
add action=drop chain=forward comment="" disabled=no
/ip firewall mangle
add action=mark-packet chain=prerouting comment="" disabled=no in-interface=\
    ether2-local-master new-packet-mark=upload passthrough=yes src-address=\
    192.168.81.30-192.168.81.50
add action=mark-packet chain=postrouting comment="" disabled=no dst-address=\
    192.168.81.30-192.168.81.50 new-packet-mark=download out-interface=\
    ether2-local-master passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=\
    no out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="" disabled=no out-interface=\
    ether1-gateway
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=\
    21,25,80,443,110,3389,5900 in-interface=ether1-gateway protocol=tcp \
    to-addresses=192.168.81.11
add action=dst-nat chain=dstnat comment="" disabled=no dst-port=123 \
    in-interface=ether1-gateway protocol=udp to-addresses=192.168.81.11
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
[penguin@MikroTik] >

Thank you for your time.

pedzopenguin · March 12, 2011, 2:00am

Got it!

  MMM      MMM       KKK                          TTTTTTTTTTT      KKK
  MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
  MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
  MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
  MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
  MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

  MikroTik RouterOS 4.5 (c) 1999-2010       http://www.mikrotik.com/





[penguin@MikroTik] > /ip address print detail 
Flags: X - disabled, I - invalid, D - dynamic 
 0   ;;; default configuration
     address=192.168.88.1/24 network=192.168.88.0 broadcast=192.168.88.255 interface=ether2-local-master 
     actual-interface=ether2-local-master 

 1   address=192.168.81.1/26 network=192.168.81.0 broadcast=192.168.81.63 interface=ether2-local-master 
     actual-interface=ether2-local-master 

 2 D address=89.216.240.171/22 network=89.216.240.0 broadcast=89.216.243.255 interface=ether1-gateway 
     actual-interface=ether1-gateway 
[penguin@MikroTik] > ip firewall export 
# jan/02/1970 01:25:42 by RouterOS 4.5
# software id = V4W4-HAV1
#
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s \
    tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s tcp-syn-received-timeout=5s \
    tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=input comment="default configuration" disabled=no protocol=icmp
add action=accept chain=input comment="default configuration" connection-state=established disabled=no in-interface=\
    ether1-gateway
add action=accept chain=input comment="default configuration" connection-state=related disabled=no in-interface=\
    ether1-gateway
add action=drop chain=input comment="default configuration" disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="" connection-state=established disabled=no
add action=accept chain=input comment="" connection-state=related disabled=no
add action=drop chain=input comment="" connection-state=invalid disabled=no
add action=accept chain=input comment="" disabled=no in-interface=ether2-local-master
add action=drop chain=input comment="" disabled=no
add action=accept chain=forward comment="" connection-state=established disabled=no
add action=accept chain=forward comment="" connection-state=related disabled=no
add action=drop chain=forward comment="" connection-state=invalid disabled=no
add action=accept chain=forward comment="" disabled=no in-interface=ether2-local-master
add action=accept chain=forward comment="" disabled=no dst-address=192.168.81.11 dst-port=21,25,80,443,110,3389,5900 \
    protocol=tcp
add action=accept chain=forward comment="" disabled=no dst-address=192.168.81.11 dst-port=123 protocol=tcp
add action=drop chain=forward comment="" disabled=no
/ip firewall mangle
add action=mark-packet chain=prerouting comment="" disabled=no in-interface=ether2-local-master new-packet-mark=upload \
    passthrough=yes src-address=192.168.81.30-192.168.81.50
add action=mark-packet chain=postrouting comment="" disabled=no dst-address=192.168.81.30-192.168.81.50 new-packet-mark=\
    download out-interface=ether2-local-master passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1-gateway
add action=masquerade chain=srcnat comment="" disabled=no out-interface=ether1-gateway
add action=dst-nat chain=dstnat comment="" disabled=no dst-address-type=local dst-port=21,25,80,443,110,3389,5900,40040 \
    protocol=tcp to-addresses=192.168.81.11
add action=dst-nat chain=dstnat comment="" disabled=no dst-address-type=local dst-port=123 protocol=udp to-addresses=\
    192.168.81.11
add action=masquerade chain=srcnat comment="" disabled=no dst-address=192.168.81.11 dst-port=21,80,443 out-interface=\
    ether2-local-master protocol=tcp src-address=192.168.81.0/26
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
[penguin@MikroTik] > /ip route print detail 
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, 
B - blackhole, U - unreachable, P - prohibit 
 0 ADS  dst-address=0.0.0.0/0 gateway=89.216.240.1 gateway-status=89.216.240.1 reachable ether1-gateway distance=0 scope=30 
        target-scope=10 

 1 ADC  dst-address=89.216.240.0/22 pref-src=89.216.240.171 gateway=ether1-gateway gateway-status=ether1-gateway reachable 
        distance=0 scope=10 

 2 ADC  dst-address=192.168.81.0/26 pref-src=192.168.81.1 gateway=ether2-local-master 
        gateway-status=ether2-local-master reachable distance=0 scope=10 

 3 ADC  dst-address=192.168.88.0/24 pref-src=192.168.88.1 gateway=ether2-local-master 
        gateway-status=ether2-local-master reachable distance=0 scope=10 
[penguin@MikroTik] > /interface print 
Flags: D - dynamic, X - disabled, R - running, S - slave 
 #     NAME                                                                                    TYPE             MTU   L2MTU
 0  R  ether1-gateway                                                                          ether            1500  1526 
 1  R  ether2-local-master                                                                     ether            1500  1524 
 2     ether3-local-slave                                                                      ether            1500  1524 
 3  R  ether4-local-slave                                                                      ether            1500  1524 
 4     ether5-local-slave                                                                      ether            1500  1524 
[penguin@MikroTik] >

You have my deepest gratitude!
And Karma goes up…

fewi · March 12, 2011, 2:09am

Glad it’s working. You should also delete the IP address, NAT rule, and firewall filters that have a comment of “default configuration”. They are either unneeded or not optimal for your setup, though they don’t interfere as such.