Setting Up Secure Private network with RB450G

RouterOS Beginner Basics
1

Goal: To be able to access private network anywhere in the world.

Tools: Cisco DPQ3212 to Microtik RB450g to Apple Extreme to devices, including a Netgear for private wireless network for my guest.

Objective: I would like the Microtik RB450g to be my master gate to the world and the Apple Extreme to be the slave controlling DHCP - NAT of the private network.

Task: I need help setting this up. The way I have it set up, if I enable the Apple Extreme to control the DHCP - NAT functions, I get double NAT. How do I set everything up that I get the robustness of the RB450G firewall and the private network with the Apple Extreme. I am new to NAT, Port forwarding, etc. Thank you.

2

What is the upside of double NAT?.. Why not just use the MikroTik as the router/dhcp/nat? What does using the airport extreme get you?

3

I am not sure of the answer to the upside of double NAT. I wanted to be able access a Apple computer and an Apple TV via the Apple Extreme’s Through VNC, as well as wake the computer from sleep. Here is my interface.
Screen Shot 2013-07-26 at 7.59.18 PM.png

4

You don’t need to have it setup as a double NAT for that.

Basically what you can do is utilize the Airport Extreme as a WIFI access point, but use the MikroTik as the Router/DHCP/etc… Thats what I am currently running…

Then you just forward whatever ports through that you need for VNC, etc.. through the MikroTik… and just use the Airport for wireless. I personally would not do double nat.

I understand what you are trying to do… post your export and explain what parts you are stuck on and I can help you.

-Eric

5

[/quote]You don’t need to have it setup as a double NAT for that.

Basically what you can do is utilize the Airport Extreme as a WIFI access point, but use the MikroTik as the Router/DHCP/etc… Thats what I am currently running…

Then you just forward whatever ports through that you need for VNC, etc.. through the MikroTik… and just use the Airport for wireless. I personally would not do double nat.

I understand what you are trying to do… post your export and explain what parts you are stuck on and I can help you.

-Eric[/quote]

Thank you Eric for responding! No…I don’t want the double NAT! I found out through reading other forum that what I need is to create a DMZplus around the Apple Extreme and use port forward as you mentioned. So, it seems that I am creating an identical set up as yours, except I want to use the Apple Extreme’s wired and wireless connections. I have an AppleRV connected wired to the Apple Extreme…just want to take advantage of the optimum synergy and synchronization of devices made for each other.

I am new to all this; so, will need all the help. Thank you!

6

No problem. If you run into problems just post and I’ll see what I can do.

I was pretty sure you didn’t want Double NAT…

7

Okay, I know I need to set the Apple Extreme (AE) has to connect using DHCP-NAT for the Back To My Mac feature to work, which I believe uses port 5900…I’ll reconfirm. Then, I know that I need to to Microtik’s IP>Firewall >NAT, and set new rule…and that’s where I am. AE is below that.
Screen Shot 2013-07-28 at 10.13.03 AM.png
Screen Shot 2013-07-28 at 9.44.09 AM.png

8

http://en.wikipedia.org/wiki/Back_to_My_Mac

9

You can either use UPnP which Back to My Mac seems to support or use a dst-nat rule to forward it. Something like

/ip firewall nat
add chain=dstnat dst-address=<PUBLIC IP> protocol=tcp dst-port=80 \
  action=dst-nat to-address=<INTERNAL IP>