http redirect based upon MAC

RouterOS Scripting
1

Hello. I operate a WISP and would like to be able to redirect delinquent customer’s http traffic to a website indicating that their account is suspended.

I am using RBs as my core routers in the network. I have the MAC addresses of the customers and most of them have static IPs from the DHCP server. I am looking for the best way to be able to do this. I would be grateful for any suggestions.

Thanks,
Dustin

2
  1. enable web proxy
  2. transparently redirect only those customers (either by MAC, or by an address list if they get hard DHCP leases) to the web proxy
  3. make a web proxy rule that denies all traffic and redirects to your display page
3

Would the webproxy require me to use the webproxy for all users behind that router?

For instance. If I have customers 1 - 30 behind RB1. RB1 has IP address of 5.5.5.1. Customers behind router are issued addresses 5.5.5.2 - 31. If I enable webproxy will all 30 customers then have to go through the webproxy, or will they route around it? I am sorry if this is an ingnorant question. I have never worked with Mikrotik webproxy. The only proxy servers I have delt with are Microsofts. :frowning:

Thanks,
Dustin

4

No, you can set it up so only suspended customers go through the web proxy; pushing everyone through it would be bad since the whole purpose of the proxy in your situation would be to say “oh no I cannot proxy that (where ‘that’ would be absolutely everything), so I’ll show you this page telling you you’re suspended instead”.

5

Some rough steps would look like this:

Enable the web proxy and create the rule that denies all proxying and redirects to the “you are suspended page”:

/ip proxy set enabled=yes port=3128
/ip proxy access add src-address=0.0.0.0/0 action=deny redirect-to=http://my.webserver.com/youAreSuspended.html

Build an address-list of suspended customers:

/ip firewall address-list
add list=Suspended address=1.1.1.1/32
add list=Suspended address=10.10.10.10/32

And transparently redirect suspended customers to the proxy:

/ip firewall nat 
add chain=dstnat src-address-list=Suspended protocol=tcp action=redirect to-ports=3128
6

Awesome! Thank you. I will try that and let you know the results! I really appreciate the help.


-Dustin

7

Is the action for the proxy server going to be “deny” or “accept”. It appears that the IPs on my access list are not going anywhere. They are just being denied any http traffic.


Thanks,
Dustin

8

The action is supposed to be ‘deny’, with an action of redirecting you to the page that says you’re suspended. Maybe try implementing a line above that allows all traffic to the redirect URL.

9

I know this is a very old thread. Just curious how I would modify this to allow the traffic to proceed to a specific domain where payment can be made?

Basically I want the user to be pushed to www.ididntpaymybillnotice.com where they can then click a link and be redirected to www.paymybill.com