All,
Question, is it possible to limit a bandwidth on a Mikrotik as bridge?
I have a RB-450G v5.1. The mikrotik is on default configuration. I connect Eth2 to WAN and Ether3 to my laptop, both eth2 and eth3 on a bridge. Now, I want to limit the bandwidth usage for my laptop. I tried to use simple queue and assign either bridge or ethernet port but it is not limiting the bandwidth. The scenario here is I want a public IP for my Laptop and I want to limit the bandwidth but don’t have much public IP to use. So I am trying to use only 2 IP, 1 for my Mikrotik and 1 for my Laptop.
Any assistance is highly appreciated.
Thanks,
Harold
http://wiki.mikrotik.com/wiki/TransparentTrafficShaper
In this article you can find information how to implement QoS with bridged interfaces.
HTH,
hi ditonet,
Thank you very much for your reply. Everything is working now.
Cheers
I thouhgt everything is working but just noticed that the public IP is not pinggable or accessible from the Internet. I have no problem browsing the Internet, simple queue is working, and configure NAT to allow only 1 IP to the Internet. We need a remote access from the Internet to this Public IP. Any thought of what I am missing?
Thanks again
Hi ditonet,
I have tried this http://wiki.mikrotik.com/wiki/TransparentTrafficShaper
Current setup is like this, eth2 and eth3 on bridge1, set a public IP address 175.x.x.x on eth2-local interface (WAN), connect my laptop to eth3 with another public IP 175.x.x.x, ethe1 is not used and no IP set (no connection). I can ping and browse the Internet without any problem from the laptop, BUT I cannot ping my public IP (eth2) from the Internet. I have tried to change the interface from ether2-local to bridge and ping, same cannot ping.
Please help, is my physical connection correct while on bridge mode?
Any help is much appreciated.
Check and post your firewall filter rules:
/ip firewall filter
export
ICMP is not enabled by default.
HTH,
hi ditonet
I did a couple of changes and now I was able to ping the Mikrotik from the Internet but not my Laptop (eth1/WAN & eth2/Laptop). This is what I did, I also added eth1 to the bridge1 (eth1, eth2 & eth3 all in bridge1) and assign a Public IP, that IP is reachable from the Internet. I assign another public IP to my laptop but it is not reachable from the Internet. I am not sure if that the nature of bridge mode?
You will see that I added also a bridge2 (eth4 and eth5), that I use for 2 Access Points.
Thank you very much for your assistance.
Below is my firewall configuration...
\
may/04/2011 17:26:12 by RouterOS 5.2
software id = NFAF-VJEB
/ip firewall address-list
add address=0.0.0.0/8 disabled=no list=bogons
add address=172.16.0.0/12 disabled=no list=bogons
add address=192.168.0.0/16 disabled=no list=bogons
add address=10.0.0.0/8 disabled=no list=bogons
add address=169.254.0.0/16 disabled=no list=bogons
add address=127.0.0.0/8 disabled=no list=bogons
add address=224.0.0.0/3 disabled=no list=bogons
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s
tcp-close-wait-timeout=10s tcp-established-timeout=1d
tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s
tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no
tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=jump chain=forward disabled=no jump-target=icmp protocol=icmp
add action=drop chain=input comment="Stop use as a blind proxy" disabled=no
dst-address=175.X.X.X dst-port=8080 protocol=tcp src-address=
0.0.0.0/0
add action=jump chain=input disabled=no jump-target=icmp protocol=icmp
add action=drop chain=input comment="Drop broadcast" disabled=no dst-address=
255.255.255.255 protocol=tcp src-address=0.0.0.0/0
add action=drop chain=forward comment="Drop NETBIOS" disabled=no dst-port=135
protocol=tcp src-address=192.168.100.0/24
add action=drop chain=forward disabled=no dst-port=137 protocol=udp
src-address=192.168.100.0/24
add action=drop chain=forward disabled=no dst-port=138 protocol=udp
src-address=192.168.100.0/24
add action=drop chain=input comment="drop ftp brute forcers" disabled=no
dst-port=21 protocol=tcp src-address-list=ftp_blacklist
add action=accept chain=output content="530 Login incorrect" disabled=no
dst-limit=1/1m,9,dst-address/1m protocol=tcp
add action=add-dst-to-address-list address-list=ftp_blacklist
address-list-timeout=3h chain=output content="530 Login incorrect"
disabled=no protocol=tcp
add action=drop chain=input comment="drop ssh brute forcers" disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=add-src-to-address-list address-list=ssh_blacklist
address-list-timeout=1w3d chain=input connection-state=new disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_stage3
add action=add-src-to-address-list address-list=ssh_stage3
address-list-timeout=1m chain=input connection-state=new disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_stage2
add action=add-src-to-address-list address-list=ssh_stage2
address-list-timeout=1m chain=input connection-state=new disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_stage1
add action=add-src-to-address-list address-list=ssh_stage1
address-list-timeout=1m chain=input connection-state=new disabled=no
dst-port=22 protocol=tcp
add action=drop chain=forward comment="drop ssh brute downstream" disabled=no
dst-port=22 protocol=tcp src-address-list=ssh_blacklist
add action=drop chain=input comment="Drop Invalid connections"
connection-state=invalid disabled=no
add action=accept chain=input comment="Allow Established connections"
connection-state=established disabled=no
add action=accept chain=input comment="Allow UDP" disabled=no protocol=udp
add action=accept chain=input comment="Allow ICMP" disabled=no protocol=icmp
add action=drop chain=forward comment="drop invalid connections"
connection-state=invalid disabled=no protocol=tcp
add action=accept chain=forward comment=
"allow already established connections" connection-state=established
disabled=no
add action=accept chain=forward comment="allow related connections"
connection-state=related disabled=no
add action=drop chain=forward comment="Drop bogons" disabled=no src-address=
!192.168.100.0/24 src-address-list=bogons
add action=drop chain=forward disabled=no dst-address=!192.168.100.0/24
dst-address-list=bogons
add action=drop chain=tcp comment="deny TFTP" disabled=no dst-port=69
protocol=tcp
add action=drop chain=tcp comment="deny RPC portmapper" disabled=no dst-port=
111 protocol=tcp
add action=drop chain=tcp comment="deny cifs" disabled=no dst-port=445
protocol=tcp
add action=drop chain=tcp comment="deny NFS" disabled=no dst-port=2049
protocol=tcp
add action=drop chain=tcp comment="deny NetBus" disabled=no dst-port=
12345-12346 protocol=tcp
add action=drop chain=tcp comment="deny NetBus" disabled=no dst-port=20034
protocol=tcp
add action=drop chain=tcp comment="deny BackOriffice" disabled=no dst-port=
3133 protocol=tcp
add action=drop chain=tcp comment="deny DHCP" disabled=no dst-port=67-68
protocol=tcp
add action=drop chain=udp comment="deny TFTP" disabled=no dst-port=69
protocol=udp
add action=drop chain=udp comment="deny PRC portmapper" disabled=no dst-port=
111 protocol=udp
add action=drop chain=tcp comment="deny NBT" disabled=no dst-port=137-139
protocol=tcp
add action=drop chain=udp comment="deny NFS" disabled=no dst-port=2049
protocol=udp
add action=drop chain=udp comment="deny BackOriffice" disabled=no dst-port=
3133 protocol=udp
add action=accept chain=icmp comment="Allow ping" disabled=no icmp-options=
0:0 limit=5,5 protocol=icmp
add action=accept chain=icmp disabled=no icmp-options=8:0 limit=5,5 protocol=
icmp
add action=accept chain=icmp comment="Allow traceroute" disabled=no
icmp-options=3:3 limit=5,5 protocol=icmp
add action=accept chain=icmp disabled=no icmp-options=11:0 limit=5,5
protocol=icmp
add action=accept chain=icmp comment="Path MTU discovery" disabled=no
icmp-options=4:3 limit=5,5 protocol=icmp
add action=drop chain=icmp comment="deny all other types" disabled=no
add action=log chain=icmp comment="Allow ping" disabled=no icmp-options=0:0
limit=5,5 log-prefix="Ping Flood!" protocol=icmp
add action=log chain=icmp disabled=no icmp-options=8:0 limit=5,5 log-prefix=
"Ping Flood!" protocol=icmp
add action=drop chain=forward comment="PSD Forward drop" disabled=no
protocol=tcp psd=10,3s,3,1
add action=log chain=forward disabled=no log-prefix="Port Scan!" protocol=tcp
psd=10,3s,3,1
add action=drop chain=input comment="PSD Input Drop" disabled=no protocol=tcp
psd=10,3s,3,1
add action=log chain=input disabled=no log-prefix="Port Scan!" protocol=tcp
psd=10,3s,3,1
add action=tarpit chain=input comment="DoS Attack Suppression"
connection-limit=10,32 disabled=no protocol=tcp src-address=0.0.0.0
add action=add-src-to-address-list address-list=DoS_black_list
address-list-timeout=1d chain=input comment="DoS Attack Detection"
connection-limit=10,32 disabled=no protocol=tcp src-address=0.0.0.0
/ip firewall mangle
add action=mark-connection chain=prerouting disabled=no dst-port=80
new-connection-mark=http_conn passthrough=yes protocol=tcp
add action=mark-packet chain=prerouting connection-mark=http_conn disabled=no
new-packet-mark=http passthrough=no
add action=mark-connection chain=prerouting disabled=no new-connection-mark=
p2p_conn p2p=all-p2p passthrough=yes
add action=mark-packet chain=prerouting connection-mark=p2p_conn disabled=no
new-packet-mark=p2p passthrough=no
add action=mark-connection chain=prerouting disabled=no new-connection-mark=
other_conn passthrough=yes
add action=mark-packet chain=prerouting connection-mark=other_conn disabled=
no new-packet-mark=other passthrough=no
/ip firewall nat
add action=masquerade chain=srcnat disabled=no out-interface=ether1
add action=masquerade chain=srcnat disabled=no src-address=192.168.100.0/24
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no
I feel a little bit embarassed 
because I don’t know what do you want to achieve with this setup.
How many public IPs do you have got?
If you bridged all interfaces, then assign one public IP address with proper subnet mask to bridge interface,
next address from your address pool to laptop, next to AP and so on.
And for testing purposes remove all blocking firewall rules, next allow trafic according to your needs, then block the rest.
HTH,
Hi ditonet,
thank you for your assistance. I manage to make things work.
thanks again!