I have a RB1100 AHX2, it is all working correctly, with one office network, one guest network and one PPPoE Internet connection. But I have now been informed that it is a legal requirement here to log guests connections to websites.
I understand this can be done using web-proxy, and that I should be able to send the data to a syslog server attached to the router. But for some reason I cannot make it work. I have installed the syslog server on one of our servers, connected directly to he router, and I have checked it is logging using a syslog test app I found on the web.
I have set-up remote logging by entering the IP address of the server, the port is the default syslog port. I also created the logging rule to forward web-proxy logs to both memory and the remote action. This is working as I can see the web-proxy logs in the log view. But nothing is reaching the syslog server.
I created a firewall rule to allow all UDP traffic on port 514 from All Ethernet, to the IP address of the Syslog server, and placed it at the top of the Firewall rules. But still nothing is logged to the syslog server.
I am now completely out of ideas of how to resolve this. So any and all suggestions would be greatly appreciated.
I have pasted a copy of the config below if it helps.
# jan/14/2016 19:21:17 by RouterOS 6.33.3
# software id = 4KQQ-KRSS
#
/interface ethernet
set [ find default-name=ether1 ] comment="Office LAN" name=ether1-office-master
set [ find default-name=ether2 ] master-port=ether1-office-master name=ether2-office-slave
set [ find default-name=ether3 ] master-port=ether1-office-master name=ether3-office-slave
set [ find default-name=ether4 ] master-port=ether1-office-master name=ether4-office-slave
set [ find default-name=ether5 ] master-port=ether1-office-master name=ether5-office-slave
set [ find default-name=ether6 ] comment="Guest LAN" name=ether6-guest-master
set [ find default-name=ether7 ] master-port=ether6-guest-master name=ether7-guest-slave
set [ find default-name=ether8 ] master-port=ether6-guest-master name=ether8-guest-slave
set [ find default-name=ether9 ] master-port=ether6-guest-master name=ether9-guest-slave
set [ find default-name=ether10 ] master-port=ether6-guest-master name=ether10-guest-slave
set [ find default-name=ether11 ] comment="Internet WAN"
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether11 max-mru=1480 max-mtu=1480 mrru=1600 name=pppoe-out1 password=********** service-name=internet use-peer-dns=yes user=**********
/ip neighbor discovery
set ether1-office-master comment="Office LAN"
set ether6-guest-master comment="Guest LAN"
set ether11 comment="Internet WAN"
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] dns-name=hs.login hotspot-address=10.0.0.1 http-cookie-lifetime=1w login-by=cookie,http-pap,mac-cookie
/ip hotspot user profile
set [ find default=yes ] idle-timeout=3d keepalive-timeout=1h mac-cookie-timeout=1w session-timeout=3d shared-users=unlimited transparent-proxy=yes
add idle-timeout=2d keepalive-timeout=1h mac-cookie-timeout=2d name=uprof-manager session-timeout=2d shared-users=unlimited transparent-proxy=yes
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=pool-guest ranges=10.1.0.1-10.255.255.254
add name=pooloffice ranges=192.168.20.100-192.168.20.254
/ip dhcp-server
add address-pool=pool-guest disabled=no interface=ether6-guest-master lease-time=1w10m name=server-guest
add address-pool=pooloffice disabled=no interface=ether1-office-master lease-time=1w10m name=server-office
/ip hotspot
add address-pool=pool-guest disabled=no interface=ether6-guest-master name=hotspot1
/system logging action
set 3 bsd-syslog=yes remote=192.168.20.20 syslog-facility=local0
/ip address
add address=192.168.20.1/24 interface=ether1-office-master network=192.168.20.0
add address=10.0.0.1/8 interface=ether6-guest-master network=10.0.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid interface=ether11
/ip dhcp-server network
add address=10.0.0.0/8 dns-server=10.0.0.1 gateway=10.0.0.1
add address=192.168.20.0/24 dns-server=192.168.20.1 gateway=192.168.20.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.20.20 name=rmserver ttl=1w
/ip firewall address-list
add address=10.0.0.0/8 list=guest-lan
add address=192.168.20.0/24 list=office-lan
add address=192.168.20.20 list=rmserver
/ip firewall filter
add chain=forward disabled=no dst-address=192.168.20.20 dst-port=514 log=yes log-prefix=TestLog protocol=udp
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add chain=forward comment="Usedfor guest login using PMS" dst-address-list=rmserver dst-port=85 protocol=tcp src-address-list=guest-lan
add chain=forward dst-address-list=rmserver dst-port=80 protocol=tcp src-address-list=guest-lan
add chain=forward comment="Used for Remote Access to PMS" dst-address-list=rmserver dst-port=3389 protocol=tcp src-address-list=guest-lan
add action=drop chain=input comment="drop ftp brute forcers" dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add chain=output content="530 Login incorrect" dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist address-list-timeout=3h chain=output content="530 Login incorrect" protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w3d chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1 address-list-timeout=1m chain=input connection-state=new dst-port=22 protocol=tcp
add action=drop chain=forward comment="Block Traffic from Guest to Office LAN" disabled=no dst-address-list=office-lan src-address-list=guest-lan
/ip firewall nat
add action=passthrough chain=unused-hs-chain comment="place hotspot rules here" disabled=yes
add action=masquerade chain=srcnat out-interface=pppoe-out1
add action=masquerade chain=srcnat comment="masquerade hotspot network" src-address=10.0.0.0/8
add action=dst-nat chain=dstnat dst-port=3389 in-interface=all-ethernet protocol=tcp to-addresses=192.168.20.20 to-ports=3389
add action=redirect chain=dstnat disabled=no dst-port=80 in-interface=all-ethernet protocol=tcp to-ports=8080
/ip hotspot ip-binding
add mac-address=6C:C2:17:6C:16:4B type=bypassed
add mac-address=EC:1F:72:27:7B:54 type=bypassed
add mac-address=14:2D:27:DC:4D:55 type=bypassed
/ip hotspot user
add name=admin password=******* profile=uprof-manager
add name=test password=*******
/ip hotspot walled-garden
add comment="place hotspot rules here" disabled=yes
add dst-host=rmserver dst-port=80 server=hotspot1
add dst-host=rmserver dst-port=85 server=hotspot1
add dst-host=www.thesilverpalm.com server=hotspot1
/ip hotspot walled-garden ip
add action=accept disabled=no dst-address=192.168.20.20 dst-port=80 server=hotspot1
add action=accept disabled=no dst-address=192.168.20.20 dst-port=85 server=hotspot1
/ip proxy
set max-cache-size=81920KiB
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api-ssl disabled=yes
/system logging
add action=remote disabled=no topics=web-proxy,info,account,dhcp,info
/system ntp client
set enabled=yes primary-ntp=122.155.169.213 secondary-ntp=122.155.169.213 server-dns-names=pool.ntp.org
/system resource irq rps
set ether1-office-master disabled=no
set ether2-office-slave disabled=no
set ether3-office-slave disabled=no
set ether4-office-slave disabled=no
set ether5-office-slave disabled=no
set ether6-guest-master disabled=no
set ether7-guest-slave disabled=no
set ether8-guest-slave disabled=no
set ether9-guest-slave disabled=no
set ether10-guest-slave disabled=no
set ether11 disabled=no
/tool sniffer
set filter-interface=all