Public IPs for client, not bridging

[jdtracy]

Thanks to roadracer96 for the nice example. I have used this information to setup a single public IP network that I can pass through to one of my clients (I am starting up a small rural WISP). The only problem I still have is that even though I have assigned the “network” xxx.xxx.xxx.196/32 to the client and he is able to use that info to connect through to the internet and receive traffic from the internet, when he goes to a site that tells him what his IP address is, it says his address is the public address of my router (xxx.xxx.xxx.194). Is there any way around this?

[oxid]

@roadracer96

Assume my public IP block is 10.0.0.0/24. My default gateway from the ISP is 10.0.0.1, my mikrotik is 10.0.0.2, I have host 10.0.0.100 plugged into ether2 and 10.0.0.200 plugged into ether3.

The client plugged into ether2 will have its ip set to 10.0.0.100/24 with default gateway of 10.0.0.1 (Not the IP of the mikrotik, 10.0.0.2).
The client plugged into ether3 will have its ip set to 10.0.0.200/24 with default gateway of 10.0.0.1 (Not the IP of the mikrotik, 10.0.0.2).

/interface ethernet
***Set interfaces to proxy-arp (only important thing here is arp=proxy-arp
set 0 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:30 mtu=1500 name=ether1 speed=100Mbps
set 1 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:31 mtu=1500 name=ether2 speed=100Mbps
set 2 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:32 mtu=1500 name=ether3 speed=100Mbps

/ip route
***Default route
add comment=“” disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.0.0.1 scope=30 target-scope=10
***Routes for hosts on ether2/3. This tells the router that when 10.0.0.1 asks “who has 10.0.0.100/200?”, it replies saying “I do”. It is proxying the arp request on behalf of the 10.0.0.100/200 clients. Hence the term proxy-arp. The mikrotik isnt really 10.0.0.100, it just knows how to get there, so it “lies” and says it is the client IP.
add comment=“” disabled=no distance=1 dst-address=10.0.0.100/32 gateway=ether2 scope=30 target-scope=10
add comment=“” disabled=no distance=1 dst-address=10.0.0.200/32 gateway=ether3 scope=30 target-scope=10

/ip address
***Public IP of router
add address=10.0.0.2/24 broadcast=10.0.0.255 comment=“” disabled=no interface=ether1 network=10.0.0.0
***Fake IP addresses on ether2/3 so they will route IP traffic
add address=192.168.1.3/32 broadcast=192.168.1.3 comment=“” disabled=no interface=ether3 network=192.168.1.3
add address=192.168.1.2/32 broadcast=192.168.1.2 comment=“” disabled=no interface=ether2 network=192.168.1.2

(You might be able to use the same 10.0.0.2 IP address on ether2/3. I know that in the past it didnt work, but on MT, it might. I have seen other implementations where it did work).

/ip firewall filter
***Allow SSH into MT via ether1, but not from clients on ether2/3
add action=accept chain=input comment=“” disabled=no in-interface=ether1 connection-state=new protocol=tcp dst-port=22,8291
***Allow DNS queries to MT from clients. FYI, the clients will have to use the 192.168.1.2/3 IP addresses for DNS. They wont be able to talk to 10.0.0.2 directly. Maybe itll work if you put 10.0.0.2/32 on the ether2/3 interfaces. I havent tried it.
add action=accept chain=input comment=“” disabled=no in-interface=ether2 connection-state=new protocol=udp dst-port=53
add action=accept chain=input comment=“” disabled=no in-interface=ether3 connection-state=new protocol=udp dst-port=53
***Drop all other input into the MT
add action=drop chain=input comment=“” disabled=no in-interface=ether1
add action=drop chain=input comment=“” disabled=no in-interface=ether2
add action=drop chain=input comment=“” disabled=no in-interface=ether3
***Forward all traffic from internet to clients and clients to internet and clients to clients
add action=accept chain=forward comment=“” disabled=no in-interface=ether3 out-interface=ether1
add action=accept chain=forward comment=“” disabled=no in-interface=ether3 out-interface=ether2
add action=accept chain=forward comment=“” disabled=no in-interface=ether2 out-interface=ether1
add action=accept chain=forward comment=“” disabled=no in-interface=ether2 out-interface=ether3
add action=accept chain=forward comment=“” disabled=no in-interface=ether1 out-interface=ether2
add action=accept chain=forward comment=“” disabled=no in-interface=ether1 out-interface=ether3

You can firewall it however you want. Its up to you. The above example just forwards all traffic. This was real seat of the pants. I may have forgot something…

[oxid]

@roadracer96

Assume my public IP block is 10.0.0.0/24. My default gateway from the ISP is 10.0.0.1, my mikrotik is 10.0.0.2, I have host 10.0.0.100 plugged into ether2 and 10.0.0.200 plugged into ether3.

The client plugged into ether2 will have its ip set to 10.0.0.100/24 with default gateway of 10.0.0.1 (Not the IP of the mikrotik, 10.0.0.2).
The client plugged into ether3 will have its ip set to 10.0.0.200/24 with default gateway of 10.0.0.1 (Not the IP of the mikrotik, 10.0.0.2).

/interface ethernet
***Set interfaces to proxy-arp (only important thing here is arp=proxy-arp
set 0 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:30 mtu=1500 name=ether1 speed=100Mbps
set 1 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:31 mtu=1500 name=ether2 speed=100Mbps
set 2 arp=proxy-arp auto-negotiation=yes comment=“” disabled=no full-duplex=yes l2mtu=1600 mac-address=00:0C:42:43:70:32 mtu=1500 name=ether3 speed=100Mbps

/ip route
***Default route
add comment=“” disabled=no distance=1 dst-address=0.0.0.0/0 gateway=10.0.0.1 scope=30 target-scope=10
***Routes for hosts on ether2/3. This tells the router that when 10.0.0.1 asks “who has 10.0.0.100/200?”, it replies saying “I do”. It is proxying the arp request on behalf of the 10.0.0.100/200 clients. Hence the term proxy-arp. The mikrotik isnt really 10.0.0.100, it just knows how to get there, so it “lies” and says it is the client IP.
add comment=“” disabled=no distance=1 dst-address=10.0.0.100/32 gateway=ether2 scope=30 target-scope=10
add comment=“” disabled=no distance=1 dst-address=10.0.0.200/32 gateway=ether3 scope=30 target-scope=10

/ip address
***Public IP of router
add address=10.0.0.2/24 broadcast=10.0.0.255 comment=“” disabled=no interface=ether1 network=10.0.0.0
***Fake IP addresses on ether2/3 so they will route IP traffic
add address=192.168.1.3/32 broadcast=192.168.1.3 comment=“” disabled=no interface=ether3 network=192.168.1.3
add address=192.168.1.2/32 broadcast=192.168.1.2 comment=“” disabled=no interface=ether2 network=192.168.1.2

(You might be able to use the same 10.0.0.2 IP address on ether2/3. I know that in the past it didnt work, but on MT, it might. I have seen other implementations where it did work).

/ip firewall filter
***Allow SSH into MT via ether1, but not from clients on ether2/3
add action=accept chain=input comment=“” disabled=no in-interface=ether1 connection-state=new protocol=tcp dst-port=22,8291
***Allow DNS queries to MT from clients. FYI, the clients will have to use the 192.168.1.2/3 IP addresses for DNS. They wont be able to talk to 10.0.0.2 directly. Maybe itll work if you put 10.0.0.2/32 on the ether2/3 interfaces. I havent tried it.
add action=accept chain=input comment=“” disabled=no in-interface=ether2 connection-state=new protocol=udp dst-port=53
add action=accept chain=input comment=“” disabled=no in-interface=ether3 connection-state=new protocol=udp dst-port=53
***Drop all other input into the MT
add action=drop chain=input comment=“” disabled=no in-interface=ether1
add action=drop chain=input comment=“” disabled=no in-interface=ether2
add action=drop chain=input comment=“” disabled=no in-interface=ether3
***Forward all traffic from internet to clients and clients to internet and clients to clients
add action=accept chain=forward comment=“” disabled=no in-interface=ether3 out-interface=ether1
add action=accept chain=forward comment=“” disabled=no in-interface=ether3 out-interface=ether2
add action=accept chain=forward comment=“” disabled=no in-interface=ether2 out-interface=ether1
add action=accept chain=forward comment=“” disabled=no in-interface=ether2 out-interface=ether3
add action=accept chain=forward comment=“” disabled=no in-interface=ether1 out-interface=ether2
add action=accept chain=forward comment=“” disabled=no in-interface=ether1 out-interface=ether3

You can firewall it however you want. Its up to you. The above example just forwards all traffic. This was real seat of the pants. I may have forgot something…

[oxid]

dear roadracer96 more thanks for you.
i did this sting and every thing working fine just one problem , i cant ping and log in MT public IP .