Internet Access to private LAN (RB 450) etc.

MasterofDisaster · Sat Jan 31, 2009 9:18 am

I have the following Problem...

Problemstellung1.jpg

I would get access to my private LAN from Internet.
The internet router is a FritzBox SL(1.1.1.1) an Portforwarding is enabled. I looks to an address like 1.1.1.2 Port 1100
1.1.1.2 is a Mikrotik RB450 for Loadbalancing an works fine. The loadbalancer sent the pakets from my internal LAN (1.1.2.0/24) to 1.1.1.1 It works!...

On the RB I configure dst-nat in the way, that incoming (WAN) pakets would sent to my server but it dont work!

I also habe a PC in the 1.1.1.0/24 Subnet, I get the connection to my server oer the loadbalancer but only pakets from the internet came not to the server. I use the paket sniffer in RouterOS an I can see, that the PC in the Internet, send a Paket, but -> I dont know, whats my failure...

PS:
Sorry for my bad english

MasterofDisaster · Mon Feb 02, 2009 11:20 am

Has nobody any idea ?

galaxynet · Mon Feb 02, 2009 2:25 pm

Export your Mikotik config and paste it here so we can look at what you told the MT to do.... Then you can get some help.

R/

Thom

MasterofDisaster · Mon Feb 02, 2009 3:42 pm

Sorry, there is the config

/ip address

add address=192.168.15.7/24 broadcast=192.168.15.255 comment="" disabled=no \
    interface=INTERN network=192.168.15.0
add address=192.168.17.2/24 broadcast=192.168.17.255 comment="" disabled=no \
    interface=DSL_1 network=192.168.17.0
add address=192.168.16.2/24 broadcast=192.168.16.255 comment="" disabled=no \
    interface=DSL_2 network=192.168.16.0
add address=192.168.18.2/24 broadcast=192.168.18.255 comment="" disabled=no \
    interface=DSL_3 network=192.168.18.0

/ip firewall mangle

add action=mark-connection chain=prerouting comment="" connection-state=new \
    disabled=no in-interface=INTERN new-connection-mark=odd nth=3,1 \
    passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=odd \
    disabled=no in-interface=INTERN new-routing-mark=odd passthrough=no
add action=mark-connection chain=prerouting comment="" connection-state=new \
    disabled=no in-interface=INTERN new-connection-mark=even nth=3,2 \
    passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=even \
    disabled=no in-interface=INTERN new-routing-mark=even passthrough=no
add action=mark-connection chain=prerouting comment="" connection-state=new \
    disabled=no in-interface=INTERN new-connection-mark=other nth=3,3 \
    passthrough=yes
add action=mark-routing chain=prerouting comment="" disabled=no in-interface=\
    INTERN new-routing-mark=other passthrough=no routing-mark=other
/ip firewall nat
add action=src-nat chain=srcnat comment="" connection-mark=odd disabled=yes \
    to-addresses=192.168.15.2 to-ports=0-65535
add action=src-nat chain=srcnat comment="" connection-mark=even disabled=yes \
    to-addresses=192.168.16.1 to-ports=0-65535
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
    192.168.15.0/24
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=\
    x.x.x.x dst-port=1195 protocol=udp src-address=0.0.0.0/0 \
    to-addresses=192.168.15.12 to-ports=1195

In my opinion, the problem is, the server get the paket, but send it in other way back?!

galaxynet · Mon Feb 02, 2009 5:42 pm

MasterofDisaster -

Looking over your config -

add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no in-interface=INTERN new-connection-mark=odd nth=3,1 \
passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=odd \
disabled=no in-interface=INTERN new-routing-mark=odd passthrough=no
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no in-interface=INTERN new-connection-mark=even nth=3,2 \
passthrough=yes
add action=mark-routing chain=prerouting comment="" connection-mark=even \
disabled=no in-interface=INTERN new-routing-mark=even passthrough=no
add action=mark-connection chain=prerouting comment="" connection-state=new \
disabled=no in-interface=INTERN new-connection-mark=other nth=3,3 \
passthrough=yes
add action=mark-routing chain=prerouting comment="" disabled=no in-interface=\
INTERN new-routing-mark=other passthrough=no routing-mark=other

The above 'loadbalancing' does not work that way - you can't mark an incoming connection and then decide which interface (IP block) to send the answer out on.... What you need to do is mark the new connection by the scr-addr that it came from 192.168.x.x, then add routing tables/rules to send the answer back out the same IP block that it came in on.

What you have above is meant for outgoing connections initiated on the 'inside' of your network (you used the wiki) not connections from the outside coming in....

/ip firewall nat
add action=src-nat chain=srcnat comment="" connection-mark=odd disabled=yes \
to-addresses=192.168.15.2 to-ports=0-65535
add action=src-nat chain=srcnat comment="" connection-mark=even disabled=yes \
to-addresses=192.168.16.1 to-ports=0-65535
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
192.168.15.0/24
I do not see a rule for the connection mark 'other'....
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=\
x.x.x.x dst-port=1195 protocol=udp src-address=0.0.0.0/0 - this is not needed...\
to-addresses=192.168.15.12 to-ports=1195 This rule also only works for IP address x.x.x.x - it will NOT work for dst IP from your other interfaces dsl2 & dsl3

I see you are trying to use loadbalancing..... I did not see any /ip route, /ip route table, or /ip route rule configs - which are necessary for this all to work....

R/
Thom

MasterofDisaster · Mon Feb 02, 2009 6:18 pm

/ip firewall nat
add action=src-nat chain=srcnat comment="" connection-mark=odd disabled=yes \
to-addresses=192.168.15.2 to-ports=0-65535 
add action=src-nat chain=srcnat comment="" connection-mark=even disabled=yes \
to-addresses=192.168.16.1 to-ports=0-65535
add action=masquerade chain=srcnat comment="" disabled=no src-address=\
192.168.15.0/24

The both src-nat chains are disabled. For outgoing connections I only use masquerading. I should delete the rules, sorry!
The load balancing from intern to extern works.

x.x.x.x dst-port=1195 protocol=udp src-address=0.0.0.0/0 - this is not needed...\ OK, I delete it!
to-addresses=192.168.15.12 to-ports=1195

It should only works for x.x.x.x as IP-Address, because only this IP is an static IP. The other DSL interfaces have a dynamic IP.

What you need to do is mark the new connection by the scr-addr that it came from 192.168.x.x, then add routing tables/rules to send the answer back out the same IP block that it came in on.

How should I do this? At the same way that marks incoming traffic?

galaxynet · Mon Feb 02, 2009 9:37 pm

MasterofDisaster -

First - I mis-read the interface scheme you had - my original interpretation was that INTERN was = INTERNET.... I overlooked the dsl1, dsl2, & dsl3 as the 'Internet' interfaces...

But back to the task at hand.....

You want any request to IP x.x.x.x on UDP port 1195 to be dst-nat'd to 192.168.15.12 same port - right?

So your dst rule should be:
add action=dst-nat chain=dstnat comment="" disabled=no dst-address=\
x.x.x.x dst-port=1195 protocol=udp \
to-addresses=192.168.15.12 to-ports=1195

Your first src-nat rule should be:
add action=src-nat chain=srcnat comment="" disabled=no src-address=\
192.168.15.12 to-ports=1195 protocol=udp

Then you put your masquerade run after the above src-nat rule.

Since dsl1 is the ONLY static IP - requests to your server will only come in and go out of dsl1. There will no need to mark the incoming connection - connection tracking should pick up on it and send it out the correct interface.

R/
Thom

MasterofDisaster · Tue Feb 03, 2009 2:49 pm

It does'nt work...

With the paket sniffer on MT I see the incoming paket in Port 1195 with the ip x.x.x.x, but there are no answer...

actually I use:

 
2   chain=dstnat action=dst-nat to-addresses=192.168.15.12 to-ports=1195 dst-address=x.x.x.x dst-port=1195 protocol=udp 
3   chain=srcnat action=src-nat to-addresses=0.0.0.0 to-ports=1195 src-address=192.168.15.12 protocol=udp 
4   chain=srcnat action=masquerade src-address=192.168.15.0/24

2   chain=srcnat action=src-nat to-addresses=0.0.0.0 to-ports=1195 src-address=192.168.15.12 protocol=udp 
3   chain=dstnat action=dst-nat to-addresses=192.168.15.12 to-ports=1195 dst-address=x.x.x.x dst-port=1195 protocol=udp 
4   chain=srcnat action=masquerade src-address=192.168.15.0/24

Both version did'nt work

galaxynet · Tue Feb 03, 2009 3:13 pm

MasterofDisaster -

3 chain=srcnat action=src-nat to-addresses=0.0.0.0 to-ports=1195 src-address=192.168.15.12 protocol=udp

the "to-addresses=0.0.0.0" above is the problem. to-addresses should be the same value (IP) as your x.x.x.x value in your dst-nat rule (rule 2).

What is rule 1? You didn't show it....

R/
Thom

MasterofDisaster · Tue Feb 03, 2009 3:47 pm

Rule 0 and 1 are disabled an I delete it, because they are not needed...

 
0   chain=dstnat action=dst-nat to-addresses=192.168.15.12 to-ports=1195 dst-address=x.x.x.x dst-port=1195 
     protocol=udp 

1   chain=srcnat action=src-nat to-addresses=x.x.x.x to-ports=1195 src-address=192.168.15.12 protocol=udp 

2   chain=srcnat action=masquerade src-address=192.168.15.0/24

also the same problem, it doesnt work...
I dont no, I think I'm a dummy

galaxynet · Tue Feb 03, 2009 6:01 pm

MasterofDisaster -

1 chain=srcnat action=src-nat to-addresses=x.x.x.x to-ports=1195 src-address=192.168.15.12 protocol=udp

Try removing the " to-ports=1195 " from the above.

R/

Thom

MasterofDisaster · Wed Feb 04, 2009 2:51 pm

I test some configuration the last day.
First, the udp paket come on MT, and goes to my server, the server get the paket and send an answer (tcpdump show it)
but on the client nothing, he cant establish the connection.
I dont no, whats the problem...

My "System"

ClientPC(192.168.18.1) -> (privateSubnet) -> (192.168.18.2) DSL Router-1(Internet, openly IP Adress) -> other DSL Router-2(static IP) -> (internal 192.168.16.1 private Subnet) -> (192.168.16.2)Mikrotik Loadbalancer(192.168.15.7) -> (private Subnet) -> (192.168.15.12)Server

The Server get the connection with the IP from DSL Router-1 and send the answer back to it... but it dont work correctly...

Whats my Problem?

galaxynet · Wed Feb 04, 2009 4:50 pm

MasterofDisaster -

There are two possibilities that I see....

1) In your src-nat rule for the server, change the 'to-ports=' to 0-65535

2) Your load balancing setup is interferring with the server 'returning' the connection to the correct dsl / ethernet port. You'll have to look in the MT under /tools, torch and see where the reply is going to.... If it is as I suspect it is going out a different ether port then you have to change your loadbalancing setup to exclude that server from loadbalancing and make it only go out the one static IP dsl route.

R/
Thom

MasterofDisaster · Thu Feb 05, 2009 9:31 am

1) In your src-nat rule for the server, change the 'to-ports=' to 0-65535

I do this, also I test some other configuration

I have a look to "Torch" an I see on the "intern" Interface that the server send an answer back to the client, but I dont see this on any outgoing interface, like DSL1, DSL2 or DSL3, also the counter shows no pakets that going the srcnat rule. In my opinion the srcnat rule, doesnt that, what she should.

But I dont no why...

If I connect the client between the DSL Router and the MT, the connection is possible...

galaxynet · Thu Feb 05, 2009 4:15 pm

MasterofDisaster -

Please post your config again;

/ip route export
/ip route rule export
/ip firewall nat export
/ip firewall mangle export

Just to let you know - from inside your network you will have to go directly to the server via it's private IP 192.168.15.12 From outside your internal network you can access it via the public IP (on the UDP port you specified).

OUTSIDE - Internet<>dsl router2<>MT Loadbalancer<>server 192.168.15.12
INSIDE - Local client INTERN<>MT Loadbalncer<>INTERN server 192.168.15.12 (And here basically the MT is just a gateway - it is not really used for the client to access the server...the client can 'see' the server as long as they are on the same network. Now if the client and the server are on different IP networks then the MT will get used....)

This type of routing is done all the time with MT products, so I know it's possible (hell I use it to protect my servers) so it's just a matter of fixing your configs correctly.

R/
Thom

MasterofDisaster · Thu Feb 05, 2009 4:30 pm

INSIDE - Local client INTERN<>MT Loadbalncer<>INTERN server 192.168.15.12 (And here basically the MT is just a gateway - it is not really used for the client to access the server...the client can 'see' the server as long as they are on the same network. Now if the client and the server are on different IP networks then the MT will get used....)

Thats rigth, but "Intern","DSL1","DSL2" and "DSL3" are three different networks. The connection whos established, get from the Clinet (192.168.16.57) to MT (DSL2, 192.168.16.2) then to MT (INTERN, 192.168.15.7) and then to the Server...

The information who would have...

ip route

 0 A S  0.0.0.0/0                          reachable     192.168.16.1                1        DSL_2                
 1 A S  0.0.0.0/0                          reachable     192.168.18.1                1        DSL_3                
 2 A S  0.0.0.0/0                          reachable     192.168.18.1                2        DSL_3                
 3 A S  0.0.0.0/0                          reachable     192.168.17.1                1        DSL_1                
 4   S  0.0.0.0/0                          reachable     192.168.17.1                2        DSL_1                
 5   S  0.0.0.0/0                          reachable     192.168.16.1                2        DSL_2                
 6 ADC  192.168.15.0/24    192.168.15.7                                              0        INTERN               
 7 ADC  192.168.16.0/24    192.168.16.2                                              0        DSL_2

ip route rule
nothing

ip firewall nat

 0   chain=dstnat action=dst-nat to-addresses=192.168.15.12 to-ports=1195 dst-address=192.168.16.2 dst-port=1195 
     protocol=udp 

 1   chain=srcnat action=src-nat to-addresses=0.0.0.0 to-ports=0-65535 src-address=192.168.15.12 src-port=1195 
     protocol=udp 

 2   chain=srcnat action=masquerade src-address=192.168.15.12

ip fireall mangle

 0   chain=prerouting action=mark-connection new-connection-mark=odd passthrough=yes 
     connection-state=new in-interface=INTERN nth=3,1 

 1   chain=prerouting action=mark-routing new-routing-mark=odd passthrough=no in-interface=INTERN 
     connection-mark=odd 

 2   chain=prerouting action=mark-connection new-connection-mark=even passthrough=yes 
     connection-state=new in-interface=INTERN nth=3,2 

 3   chain=prerouting action=mark-routing new-routing-mark=even passthrough=no in-interface=INTERN 
     connection-mark=even 

 4   chain=prerouting action=mark-connection new-connection-mark=other passthrough=yes 
     connection-state=new in-interface=INTERN nth=3,3 

 5   chain=prerouting action=mark-routing new-routing-mark=other passthrough=no routing-mark=other 
     in-interface=INTERN

Seems, I cannot route all traffic from 192.168.15.12 to the Interface with the static ip, because, all traffic to external Internet come from it

galaxynet · Thu Feb 05, 2009 5:01 pm

MasterofDisaster -

Ok well the main problem here is you 'started' to use the loadbalancing wiki and didn't finish implementing all of it. Go back, read the wiki article on loadbalancing, and then put all the required items in your router.

Like right now you have 5 default routes to the internet, the defaults are the route entries that look like this;
1 A S 0.0.0.0/0 reachable 192.168.18.1 1 DSL_3

The 0.0.0.0/0 means 'anything' I don't already 'know' send to this gateway 192.168.18.1 - your router is VERY confused as to where to send what to....

You have no route rules - these would send connections you marked with your routing marks out specific interfaces and would allow you to src-nat (or masquerade) those to the IP of the correct interface. Without the rules - again you'll have a very confused router.

So go back, read the wiki again, and then probably a few more times and then implement it. If you can't then just start with the one static DSL line interface and your INTERN interface. Then observe how it works. That will help you understand a lot better how routing works....

A router has one question with two possible answers.

Router; Do I know where this datagram (by IP address now) goes?

Yes - ok then send it there.

No - ok then send it to the specified upstream gateway.

That's it - all the magic of a router boiled down to a few statements.....

If you can't do this then there are several MT consultants that can set this up for a price. I am not going to go through your entire config and set it up for you. Those of us on the forum are here to help out, not do the work for you.... Not being 'bad' here, just pointing out the facts.... I post a lot of answers here to problems, point folks in the right direction, write a few scripts from time to time, etc - most of us do. But you need to help yourself here and understand the very flexible MT router that you have there. I hate to say this - but you need to spend some time reading the manual and other posts here on the forum to help yourself understand your router and it's capabilities better.

R/

Thom

MasterofDisaster · Thu Feb 05, 2009 5:34 pm

Thank you for your patience.
I was happy, that the loadbalncing does what it should, but I dont see thats not correct.
Thank you for the not to it. I would have a new implementation off it. I read the manual again and hope its sucessfulled
Please dont worry about me, I'm sorry for the effort that have I you prepared

Much thanks!

I hope you understand what I mean, because my english is a deasaster, like my routers configuration!

MasterofDisaster · Thu Feb 05, 2009 7:05 pm

I have reconfigured all, with the actually tutorial... and all works fine...

Thank you very much...

galaxynet · Sat Feb 07, 2009 12:32 am

MasterofDisaster -

Your english is fine - I understand what you are saying. I just hope you understood what I said...as in I was not trying to be 'mean spirited' with my reply - educational was my intent.

You started off saying the you had used the wiki to implement load balancing and everything was working fine - so I answered your questions based on the premisis that you had in fact implemented load balancing correctly. Later in your post we find that you had not implemented it properly, which basically made all my answers worthless - good reading but otherwise still worthless.

I am glad to see that you did go back to the tutorial and get the load balancing straightened out as well as your nat'ing issue. I am sure you learned quite a bit about routing, nat'ing, and firewalls.

R/

Thom

MasterofDisaster · Mon Feb 09, 2009 12:10 pm

I think, I understand what you would say...

And since the 22.January 2009 thera are a new tutorial thats is much easiere to understand and to implement... I think

Thanks!

Internet Access to private LAN (RB 450) etc.

Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Re: Internet Access to private LAN (RB 450) etc.

Who is online