I posted earlier describing how I was having problems replacing an existing firewall with an RB750G.
It got no response ... probably because I didn't do a good job of describing the problem.
I have very little hair left anyway, and what I do have I am tearing out trying to see what I did wrong here, hopefully, its just one of those things I don't see because I am too close to the problem, and one of your fresh sets of eyes will see the problem sticking out like a sore thumb.
I have had chance to play around a little more, here are my problem and observations:
Problem:
An existing firewall has a public interface of 70.89.191.217/29.
It NATs from an internal network (10.0.0.0/24).
It works fine.
If I replace this firewall with the RB750G, it doesn't work.
I can replace the external interface IP with (for example) 70.89.191.218/29 and it works fine.
I have tried several IPs on the external interface, and they all work.
All but the 217 address.
Put the old firewall back and everything works (using the 217 external IP).
Observations:
It appears to be a routing issue within the RB750G.
If I run "torch" on the external interface I can see traffic hitting my external interface.
More importantly, if I do an nslookup (against google DNS - 8.8.4.4) on the internal network, I see responses from 8.8.4.4 addressed to the 217 external IP -- but the nslookup times out never receiving a response.
Similarly, if I run a ping against the first router inside my ISP, I see packets coming back from that address to my external interface, but they never show up in the "ping" running on my laptop on the internal network.
So - packets go out correctly, and responses appear to be delivered to the external interface, but never get back to the internal network - but ONLY with that one address on the external interface.
What I have tried:
Rebooting the RB750G - obviously.
Export from the base level and looking for occurrences of 70.89.191.217 to see if there is some explicit rule on that address - the only occurence is for the interface configuration.
Config:
Routing:
[philip@MikroTik] /ip route> print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme,
B - blackhole, U - unreachable, P - prohibit
DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 A S 0.0.0.0/0 70.89.191.222 1
1 ADC 10.0.0.0/24 10.0.0.1 ether2-local-ma... 0
2 ADC 10.1.0.0/24 10.1.0.1 ether1-gateway 0
3 ADC 10.1.10.0/24 10.1.10.90 ether1-gateway 0
4 ADC 70.89.191.216/29 70.89.191.220 ether1-gateway 0
[philip@MikroTik] /ip route> export
jun/11/2010 18:41:49 by RouterOS 4.10
software id = L7N1-QW2I
/ip route
add comment="" disabled=no distance=1 dst-address=0.0.0.0/0 gateway=70.89.191.222 scope=30 target-scope=10
Interface:
[philip@MikroTik] /interface ethernet> print
Flags: X - disabled, R - running, S - slave
NAME MTU MAC-ADDRESS ARP MASTER-PORT SWITCH
0 R ether1-gateway 1500 00:0C:42:70:8B:33 enabled none switch1
1 R ether2-local-master 1500 00:0C:42:70:8B:34 enabled none switch1
2 S ether3-local-slave 1500 00:0C:42:70:8B:35 enabled ether2-local-master switch1
3 S ether4-local-slave 1500 00:0C:42:70:8B:36 enabled ether2-local-master switch1
4 RS ether5-local-slave 1500 00:0C:42:70:8B:37 enabled ether2-local-master switch1
IP config:
Flags: X - disabled, I - invalid, D - dynamic
ADDRESS NETWORK BROADCAST INTERFACE
0 ;;; Internal network gateway
10.0.0.1/24 10.0.0.0 10.0.0.255 ether2-local-master
1 ;;; Internet gateway
70.89.191.217/29 70.89.191.216 70.89.191.223 ether1-gateway
2 ;;; Wireless link devices
10.1.0.1/24 10.1.0.0 10.1.0.255 ether1-gateway
3 10.1.10.90/24 10.1.10.0 10.1.10.255 ether1-gateway
\
For completeness here is the NAT and filter config:
NAT:
[philip@MikroTik] /ip firewall nat> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
chain=srcnat action=masquerade out-interface=ether1-gateway
Filter:
[philip@MikroTik] /ip firewall filter> print
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; default configuration
chain=input action=accept protocol=icmp
1 ;;; default configuration
chain=input action=accept connection-state=established in-interface=ether1-gateway
2 ;;; default configuration
chain=input action=accept connection-state=related in-interface=ether1-gateway
3 ;;; default configuration
chain=input action=drop in-interface=ether1-gateway
4 ;;; Drop Invalid connections
chain=input action=drop connection-state=invalid
5 ;;; Allow Established connections
chain=input action=accept connection-state=established
6 ;;; Allow UDP
chain=input action=accept protocol=udp
7 ;;; Allow access to router from known network
chain=input action=accept src-address=10.0.0.0/24
8 ;;; Drop anything else
chain=input action=drop
9 ;;; drop invalid connections
chain=forward action=drop connection-state=invalid protocol=tcp
10 ;;; allow already established connections
chain=forward action=accept connection-state=established
11 ;;; allow related connections
chain=forward action=accept connection-state=related
12 ;;; Block bogons
chain=forward action=drop src-address=0.0.0.0/8
13 chain=forward action=drop dst-address=0.0.0.0/8
14 chain=forward action=drop src-address=127.0.0.0/8
15 chain=forward action=drop dst-address=127.0.0.0/8
16 chain=forward action=drop src-address=224.0.0.0/3
17 ;;; jump to specific chains
chain=forward action=jump jump-target=tcp protocol=tcp
18 chain=forward action=jump jump-target=udp protocol=udp
19 chain=forward action=jump jump-target=icmp protocol=icmp
20 ;;; deny TFTP
chain=tcp action=drop protocol=tcp dst-port=69
21 ;;; deny RPC portmapper
chain=tcp action=drop protocol=tcp dst-port=111
22 ;;; deny RPC portmapper
chain=tcp action=drop protocol=tcp dst-port=135
23 ;;; deny NBT
chain=tcp action=drop protocol=tcp dst-port=137-139
24 ;;; deny cifs
chain=tcp action=drop protocol=tcp dst-port=445
25 ;;; deny NFS
chain=tcp action=drop protocol=tcp dst-port=2049
26 ;;; deny NetBus
chain=tcp action=drop protocol=tcp dst-port=12345-12346
27 ;;; deny NetBus
chain=tcp action=drop protocol=tcp dst-port=20034
28 ;;; deny BackOriffice
chain=tcp action=drop protocol=tcp dst-port=3133
29 ;;; deny DHCP
chain=tcp action=drop protocol=tcp dst-port=67-68
30 ;;; deny TFTP
chain=udp action=drop protocol=udp dst-port=69
31 ;;; deny PRC portmapper
chain=udp action=drop protocol=udp dst-port=111
32 ;;; deny PRC portmapper
chain=udp action=drop protocol=udp dst-port=135
33 ;;; deny NBT
chain=udp action=drop protocol=udp dst-port=137-139
34 ;;; deny NFS
chain=udp action=drop protocol=udp dst-port=2049
35 ;;; deny BackOriffice
chain=udp action=drop protocol=udp dst-port=3133
36 ;;; drop invalid connections
chain=icmp action=accept protocol=icmp icmp-options=0:0
37 ;;; allow established connections
chain=icmp action=accept protocol=icmp icmp-options=3:0
38 ;;; allow already established connections
chain=icmp action=accept protocol=icmp icmp-options=3:1
39 ;;; allow source quench
chain=icmp action=accept protocol=icmp icmp-options=4:0
40 ;;; allow echo request
chain=icmp action=accept protocol=icmp icmp-options=8:0
41 ;;; allow time exceed
chain=icmp action=accept protocol=icmp icmp-options=11:0
42 ;;; allow parameter bad
chain=icmp action=accept protocol=icmp icmp-options=12:0
43 ;;; deny all other types
chain=icmp action=drop
