Hi there!
I'm totally new to MikroTik boards and have recently setup my first one which was a challenge for me! All seems to work just fine although I have 3 questions/issues. I'm sorry to ask so many questions in one thread but they may all be related to each other so I have included them as a job lot so to speak. History; I setup a web proxy in order to restrict access to a few websites and to carry out automated schedules on access times to the Internet etc... The proxy does not cache any content as I'm using a 750g which can't seem to do that. I have setup a firewall to the best of my limited knowledge 
and I have redirected the clients to use the proxy. I'm not a real techy in this field but I have tried my best so far and have got stuck without google offering me any insight I thought I'd try the forums... so here we go...
apr/16/2010 22: 8:26 by RouterOS 4.6
xx.xx.xx.xx = Remote Admin IP
mc:mc:mc:mc:mc:mc = A mac address
- When I carry out a My IP query via http://ip-address.domaintools.com/ it shows my internal IP address rather than the routers IP address. What have I missed or done wrong here...?
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; Added by webbox
chain=srcnat action=masquerade out-interface=ether1-gateway
1 ;;; Web Proxy
chain=dstnat action=redirect to-ports=8000 protocol=tcp
in-interface=ether2-local-master-clients dst-port=80
- I want to enable/allow all ports to various clients specified via mac address setup in the firewall and only ports 80, 443, and 5050 to any other clients. I think this is working but I'm not getting any bytes or packets showing up on those rules (rules are towards the end of this firewall print). Have I done something wrong here or missed anything?
Flags: X - disabled, I - invalid, D - dynamic
4294967295> ;;; Drop Invalid connections
chain=input action=drop connection-state=invalid
4294967295> ;;; Allow Established connections
chain=input action=accept connection-state=established
4294967295> ;;; Allow limited pings
chain=input action=accept protocol=icmp limit=50/5s,2
4294967295> ;;; Drop excess pings
chain=input action=drop protocol=icmp
4294967295> ;;; Allow access to router from known network
chain=input action=accept src-address=192.168.88.0/24
in-interface=ether2-local-master-clients
4294967295> ;;; Drop anything else
chain=input action=drop src-address=!xx.xx.xx.xx
4294967295>X ;;; Block C
chain=forward action=drop src-mac-address=mc:mc:mc:mc:mc:mc
4294967295>X ;;; Block all restricted clients access to Internet
chain=forward action=drop src-address=192.168.88.51-192.168.88.255
4294967295> ;;; Drop invalid connections
chain=forward action=drop connection-state=invalid protocol=tcp
4294967295> ;;; Accept The Directors Laptop [WiFi]
chain=forward action=accept src-mac-address=mc:mc:mc:mc:mc:mc
4294967295> ;;; Accept M Laptop [WiFi]
chain=forward action=accept src-mac-address=mc:mc:mc:mc:mc:mc
4294967295> ;;; Accept The Directors BlackBerry [WiFi]
chain=forward action=accept src-mac-address=mc:mc:mc:mc:mc:mc
4294967295> ;;; Accept M BlackBerry [WiFi]
chain=forward action=accept src-mac-address=Fmc:mc:mc:mc:mc:mc
4294967295> ;;; Accept M Nokia E71 [WiFi]
chain=forward action=accept src-mac-address=mc:mc:mc:mc:mc:mc
4294967295> ;;; Accept S BlackBerry [WiFi]
chain=forward action=accept src-mac-address=mc:mc:mc:mc:mc:mc
4294967295> ;;; Allow already established connections
chain=forward action=accept connection-state=established
out-interface=ether2-local-master-clients
4294967295> ;;; Allow related connections
chain=forward action=accept connection-state=related
out-interface=ether2-local-master-clients
4294967295> ;;; Accept port
chain=forward action=accept protocol=tcp src-address=192.168.88.0/24
out-interface=ether2-local-master-clients dst-port=80
4294967295> ;;; Accept port
chain=forward action=accept protocol=tcp src-address=192.168.88.0/24
out-interface=ether2-local-master-clients dst-port=443
4294967295> ;;; Accept port
chain=forward action=accept protocol=tcp src-address=192.168.88.0/24
out-interface=ether2-local-master-clients dst-port=5050
4294967295> ;;; Drop forward
chain=forward action=drop
- I setup some simple queues to throttle bandwidth, all is working fine here. However, instead of listing individual IP addresses to specifiy who can have unlimited bandwidth I'd like to use MAC addresses (for queue 0) just incase someone gets clever and tries to use a fixed IP address (dynamic ones are being sent out at the moment). So... How do I specify MAC addresses rather than IP addresses to indicate which computers can have unlimted bandwidth?
Flags: X - disabled, I - invalid, D - dynamic
0 ;;; NO RESTRICTION
name="unrestricted-client-network-queue"
target-addresses=192.168.88.31/32,192.168.88.32/32,192.168.88.33/32,
192.168.88.34/32,192.168.88.35/32
dst-address=0.0.0.0/0 interface=ether2-local-master-clients parent=none
direction=both priority=1 queue=default/default limit-at=0/0
max-limit=0/0 burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
total-queue=default
1 ;;; C RESTRICTED
name="restricted-charlie-queue" target-addresses=192.168.88.54/32
dst-address=0.0.0.0/0 interface=ether2-local-master-clients parent=none
direction=both priority=8 queue=default/default limit-at=10k/20k
max-limit=15k/25k burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
total-queue=default
2 ;;; OTHERS RESTRICTED
name="restricted-network-queue" target-addresses=192.168.88.0/24
dst-address=0.0.0.0/0 interface=ether2-local-master-clients parent=none
direction=both priority=7 queue=default/default limit-at=20k/65k
max-limit=25k/70k burst-limit=0/0 burst-threshold=0/0 burst-time=0s/0s
total-queue=default