RB750 Help - please

HI All,

please excuse my ignorance, but im not very clued up with mikrotik configuration.

i have a rb750 and have managed to install it on my network and have it working like this :

1.)
RB750 ether2 plugged into my original network via network switch. ip gateway 192.168.1.2 ( normal adsl router in dhcp mode )
2.)i created a ip address list on the same subnet as my local network.
3.) i have used ether3,4&5 as the same configuration and made them all use ether2 as the masterport. This allows traffic from those ports to access my network.

the plan is to have my 2 neighbours access internet via my setup. i have run hard cable on ether 3 , 4 & 5 to wireless AP’s at my neighbours houses. they can access my network. i am able to restrict speed by using the normal bandwidth control on the interface screen.
the problem i have is i am limited to 4MB adsl and if i change their bandwidth to like 2M then when they access my network to watch tv programs and movie via the PS3 it keeps sticking and this i understand is a result of me restricting the entire ether port to only 2MB.

what i want to do is actually disable all ptp traffic so then i can leave the ether’s all unlimited bandwidth and not have them max m line with torrent downloading as they currently do.

Now for the PROBLEM.
i have added firewall rules but nothing seems to block anything. see screenshots.
Screen Shot 2015-04-27 at 9.53.06 PM.png
Screen Shot 2015-04-27 at 9.53.01 PM.png
Screen Shot 2015-04-27 at 9.52.50 PM.png
may i please ask if somebody can let me know if ive done something simple wrong and how to enable a firewall to actually block all the p2p traffic torrent words etc on the rb750. The rb750 is only used on my network to give my neighbors access to my network.

im happy to provide remote access if it would help show me what to do.

i really appreciate all and any help.

From you screens, seems so. Best solution, test it. Try to start some torrent client from PC behind router and if it works, you failed. SImple as that.

hi,

i have tried to do a different method i found here : also still nothing works.

https://klseet.com/index.php/213-tm-unifi/unifi-mikrotik/rb750/45-mikrotik-rb750-qos

i understand the methodology but still nothing gets restricted and even the bandwidth doesnt get throttled even when i set all to 500k.

im wondering if because i have all the ether ports using ether2 as the min port and thus the rb750 just works as a switch to my existing network, then no rules apply ?

to test simply, i added a wireless ap to ether3. im logged onto it and get full bandwidth for everything torrents included.
now surely i can have the rules affect ether3 but i cant seem to get them to do so.

for firewalling to work , does the RB750 need to be the modem connecting to internet via PPOE etc ?

thanks

The firewall rules do not work in switch mode as the traffic bypasses the cpu. Use bridge mode and enable bridge firewall and set the rules on the bridge level.

Agreed. Also, update Router OS. 5.x is old and is missing some great fixes/features. (such as blocking p2p with a single firewall rule)

I’d look into your design plan as well. “the plan is to have my 2 neighbors access internet via my setup”
Do you want them to be able to access your own LAN or just the internet?
Are they going to be only using Wireless APs or will they be hardwired with switch at each place?
Do you want to guarantee you a certain amount but allow them to P2P or block p2p altogther?
Do you want to only allow them X amount bandwidth in general, or allow them full throttle unless you’re using your device?

There’s a dozen ways this can be sliced.

Hi thanks for the replies.

i will update the rb750 now quick thanks.

-i want the neighbors to access both my internet and local network (my PC server with movies on they connect via PS3 )
-they both have hardwired to their house with a wireless 4 port modem acting as their AP and switch.
-i would be more than happy just blocking all their p2p ( unless allowing them a small amount is easy to do ?)
-yes i would want to give them maximum of 2MB internet web traffic bandwidth and maximum local bandwidth.
-i would like to keep myself completely unrestricted.

ive been reading up allot and it would seem i need the rb750 to do the PPOE through bridge into my adsl modem. Do i have to do this, or can i have my ADSL modem do the DHCP and Internet setup etc.
1st prize is i would like to just use the rb750 to be between my network and theirs. ie use ether2 into my adsl modem, and ether3 & 4 to their houses.

i have fiddles so much with the rb750 that i think i should rather reset and start from scratch. any setup suggestions for me would help

thanks

I’ve drawn a diagram on how I would set this up.

Now, with this said, your neighbors will need to trust you and they’ll need to turn of DHCP on their AP/Routers, and make sure that your feed to them is on a switch port, not a wan port of the AP/Router.

As you can guess, you don’t know how many devices they may have at their house (cell phones, laptops, friends cellphones) and you want to QOS the traffic, they’ll need to be on separate subnets. However, because they’re all subnets on the same router, the default routes allow everyone to talk to one another.

  1. Upgrade router ASAP.
  2. After you upgrade, reset the router to factory.
  3. Then login with Winbox and now you’ll see a quickset tab on the left. (yes, the tab you’ve been looking for all your life)
    This is how you can setup 2/3’s of your router is no time flat, like your PPOE information on the wan port.
  4. Now on this screen, You want to set your internet info, local network info (192.168.0.1, 255.255.255.0, DHCP server checked, adjust the range to 192.168.0.11-192.168.0.199, and make sure NAT is checked)
  5. Next, go to the interface tab, and unslave eth3 and eth4 from eth2. (Make sure master port for eth3 and eth4 is set to ‘none’. )
    Also, in the name, after ether3/4 respectively, add -neighbor1 / - neighbor2 respectively (should look like this ether3-neighbor1). This will allow you to easily identify the ports in other screens.
  6. Next open IP > Addresses. Add the following addresses

192.168.0.1/24 for ether2
192.168.1.1/24 for ether3 (Neighbor1)
192.168.2.1/24 for ether4 (Neighbor2)
7. Next we need to add 3 DHCP servers. Easy stuff really. In IP>DHCP Server. You should see one already setup for your local network.
8. Click DHCP setup
Choose Ether3 > next > DHCP address space ‘should’ be pre-filled in if you setup the IP address already. > next> same for the Gateway>next > If it prompts for DHCP relay, just press the up arrow on the screen. >next> “Addresses to give out”, just leave the default > next > DNS servers. Fill in the DNS servers that work best for you. I use google if I don’t know what the fastest ones are in my area. (8.8.8.8 & 8.8.4.4) > next > lease time. I set this to 1d 00:00:00. 1 day should be plenty for most people. >next. That completes the setup of the Neighbor1 DHCP server.
9. Repeat the same steps for Ether4.

Now you have 3 subnets setup on 3 different ports with DHCP servers and everyone can ping/access one another resources via IP.
(You may want to reserve your PC ip as well as your PS3’s ip to make it easier for remote access to your PS3. You can do this on the Leases tab of IP>DHCP server screen). One you see your computer/ps3 in the list, right click and make static.
10. Next we want to setup a 1 firewall filter rule1 which blocks p2p traffic, but will need to set up 4 Mangle rules. (2 for each neighbor)
11. IP>Firewall> Mangle
Click Add
General Tab> Select the prerouting chain
then click the P2P dropdown, select all-p2p.
Then click the In Interface and Choose ether3
Then click the Out Interface and choose ether1
Click the Action tab and choose “mark packet” from the action dropdown list. In the new packet mark field, type neighborp2p
Click OK.

Do this 3 more times, except change the following.
12. 2nd time - swap the in/out interfaces.
13. 3rd time - put the In interface as ether4 / out as ether1
14. 4th time - reverse the interfaces again.

What you’ve done is set up tagging all p2p traffic to and from your neighbors networks.
15. Now click on the Filter Rules tab.
16. Click Add
Choose the forward chain
Click the packet mark field. Choose your neighborp2p mark.
Click the action tab. Then choose drop as the action.
Lastly, click on the Comment button on the left. Put in this box - Neighbor1 and 2- Block all p2p traffic
Click OK and Ok again.
This basically drops all p2p traffic that you’ve tagged in the above with just 1 filter rule.


Now we want to set the QOS to limit their internet bandwidth total usage and reserve at least 2MB of bandwidth as well.
17. Click on Queues>Click Add> Target Choose ether3 > Dst > Click the drop down and choose ether1.
Target Upload - Max Limit = 1M (or half of what your DSL upload speed is) – Target Download 1M
Burst Limit should be double what the Max Limit is set to.
Burst Threshold should be set to the same as Max Limit for this situation.
Burst Time set to 40. (This doesn’t mean 40 seconds of burst, but using a crazy ratio Mikrotik developed, its around 20 seconds of burst).
Click OK
18. Repeat the same queue but Target choose ether4.

LASTLY, to set up your reservation queue to reserve your bandwidth.
19. Click on Queues>Click Add> Target type 192.168.0.0/24 > Dst > Click the drop down and choose ether1.
Target Upload - Max Limit = 4M (or whatever your DSL upload speed is) – Target Download 4M
20. Then click on the Advanced tab. In the Limit At field… Set the upload to 2M (or half the max of your DSL pipe) and set the download to 2M.
Click OK.
21. Drag that Queue above the other 2 queues, and now you’ll have a priority over the other neighbors, while still giving them full bandwidth to your server/ps3.

ALL DONE!

p.s. I’m unsure how long the diagram will be online, so you may want to download it.

i cant thank you enough for your effort.

i will do as you said and let you know how it all went.

thank you again for the assistance.

Hi Sean

i have done all easily up to point 11.

then i get this
screenshot mikrotik firewall mangle.jpg
im not sure why its done this or whats wrong.

little info, i used my local ip range of 192.168.1.1 etc as have devices already programmed on that ip range.
neighbor 1 i used 192.168.2.1
neighbor 2 i used 192.168.3.1

all working just need to do the firewall configs .
i noticed that i cant access the neighbors AP’s unless i put the static AP IP onto the same ip range they are on. i had them on 192.168.1. and wasnt able to access them. just some info incase others using the conf, but once i changed them to the actual ip range the neighbor is on, i can access their AP.

thanks again for all the help, and hopefully you can find out why im getting the mangle error ?

Ahh… sorry about that. Instead of pre-routing, use the forward chain. I was up late typing it all out and forgot that if you’re matching both the in/output, its forward chain.

all sorted thanks.

is 19 and 20 necessary as i could just leave it to unlimited surely ?

really appreciate the help, thanks again !!

in testing it i noticed that its not blocking p2p.
Screen Shot 2015-04-29 at 5.09.20 PM.png
Screen Shot 2015-04-29 at 5.07.39 PM.png
Screen Shot 2015-04-29 at 5.07.46 PM.png

Screen Shot 2015-04-29 at 5.07.56 PM.png
ive added some screenshots.

not sure why its not blocking ? i connected to neighbor 2 wireless and opened up vuze and it was downloading ?

Ive also noticed this in the log… seems as though some type of ssh hack ? you seen this before ?
Screen Shot 2015-04-29 at 7.30.31 PM.png

In regards to 19 and 20, this is how you reserve your own bandwidth.
With simple queues, if my memory serves me, you cannot save the simple queue entry if you don’t complete the Target Upload / Download on the first screen (you can set it to 8M if you want, but this won’t boost your service you get to your location). The 2nd screen is where you have your reservation minimum bandwidth to the internet. So you’ll get at LEAST 2M. Without this rule, you may be competing with bandwidth when the neighbors are home.

In regards to the p2p blocking, can you to go the terminal, and do “/ip firewall mangle export” so I can see your mangle rules. Also export your filter rule “ip firewall filter export hide-sensitive”. This will export out your filter rule so I can double check it.

Yes, bots are trying to ssh into your router. If you haven’t done so already, please change your admin password on your router. Better yet, create a new user name and password. Log out, then login with the new user/password, then disable the default user name.
You’ll need a few filter rules.

Here is my filter rules (sanitized)

/ip firewall filter
add action=drop chain=input comment="Block invalid input connections" \
    connection-state=invalid
add action=drop chain=forward comment="Block invalid forward connections" \
    connection-state=invalid
add chain=forward comment="Plex Ports - TCP" dst-port=3005,8324,32469 \
    protocol=tcp
add chain=forward comment="Plex Ports - TCP" dst-port=1900,5353,32412-32414 \
    protocol=udp
add chain=forward dst-port=32400 protocol=tcp
add chain=input comment="default configuration" protocol=icmp
add chain=input comment="Allow Established and Related Input Connections" \
    connection-state=established,related
add chain=forward comment="Allow Established and Related Forward Connections" \
    connection-state=established,related
add action=drop chain=input comment="default configuration" in-interface=\
    ether1-gateway
add action=drop chain=forward comment=\
    "Disallow Forward Connections from Outside unless listed as an DST Nat." \
    connection-nat-state=!dstnat connection-state=new in-interface=\
    ether1-gateway

While you may not be able to directly import these… look at these line by line to see what I’m doing to recreate them.

HI
here are my mangle rules :

[admin@MikroTik] > ip firewall mangle export

apr/29/2015 22:32:23 by RouterOS 6.28

software id = 1WVA-7368

/ip firewall mangle
add action=mark-packet chain=forward in-interface=Neighbor1-Barry
new-packet-mark=neighborp2p out-interface=ether1 p2p=all-p2p
add action=mark-packet chain=forward in-interface=ether1 new-packet-mark=
neighborp2p out-interface=Neighbor1-Barry p2p=all-p2p
add action=mark-packet chain=forward in-interface=Neighbor2-Dave
new-packet-mark=neighborp2p out-interface=ether1 p2p=all-p2p
add action=mark-packet chain=forward in-interface=ether1 new-packet-mark=
neighborp2p out-interface=Neighbor2-Dave p2p=all-p2p

My IP Filter rules :

[admin@MikroTik] > /ip firewall filter export hide-sensitive

apr/29/2015 22:33:51 by RouterOS 6.28

software id = 1WVA-7368

/ip firewall filter
add action=drop chain=forward comment=
"Neighbor 1 and 2 - Block all p2p Traffic" packet-mark=neighborp2p

i dont understand properly the queue settings. is this correct for a 4MB down & 512k Upload line ( this is what we get in RSA where i am )
queue screen 1.jpg

queue screen2.jpg
Queue screen 3.jpg
Queue screen 4.jpg
the last 2 are my queue.

also could you help me with a port forward pls. mt cctv dvr is 192.168.1.24 port 6036 & 81. need to know how to allow remote access to it.

im glad to say im slowly learning how this all works.. better yet i actually understand what im doing thanks to you.