Please help me with this routing.

kameelperdza · Tue Mar 30, 2010 3:09 pm

HI there i realy hope that i will get a response.

Is this possible????

I want to run personal and business wifi on one network. Personal will use 172.23.128.0/24 as backbone and business will use 10.0.0.0/24 as backbone.

On router 1 i will do the following.

ip address add address=172.23.128.1/30 interface=wlan1
ip address add address=10.0.0.1/30 interface=wlan1
ip address add address=172.16.0.1/24 interface=ether1

ip firewall mangle add src-address=192.168.0.0/24 chain=prerouting action=mark-routing new-routing-mark=business
ip firewall mangle add src-address=192.168.10.0/24 chain=prerouting action=mark-routing new-routing-mark=personal

ip route add dst-address=192.168.0.0/24 gateway=10.0.0.
ip route add dst-address=192.168.10.0/24 gateway=172.23.128.2
ip route add gateway=172.16.0.200 routing-mark=business
ip route add gateway=172.16.0.201 routing-mark=personal
ip route rule add src-address=192.168.0.0/24 routing-mark=business table=business
ip route rule add src-address=192.168.10.0/24 routing-mark=personal table=personal

On router 2 i will do the following.

ip address add address=172.23.128.2/30 interface=wlan1
ip address add address=10.0.0.2/30 interface=wlan1
ip address add address=192.168.0.1/24 interface=ether1
ip address add address=192.168.10.1/24 interface=ether2

ip firewall mangle add src-address=192.168.0.0/24 chain=prerouting action=mark-routing new-routing-mark=business
ip firewall mangle add src-address=192.168.10.0/24 chain=prerouting action=mark-routing new-routing-mark=personal

ip route add dst-network=0.0.0.0/0 gateway=172.23.128.1 routing-mark=personal
ip route add dst-network=0.0.0.0/0 gateway=10.0.0.1 routing-mark=business
ip route rule add src-address=192.168.0.0/24 routing-mark=business table=business
ip route rule add src-address=192.168.10.0/24 routing-mark=personal table=personal

Here is the problem that i get. The problem is on router2.....When both default gateways have routing-marks then the network goed down. If only one of the gateway have routing marks then they bot use the other gateway(the one without the routing mark)

Can someone please help me.

janisk · Tue Mar 30, 2010 3:15 pm

you have to have normal default routes and deafault routes with routing mark.

SurferTim · Tue Mar 30, 2010 3:16 pm

Can you show me "/ip firewall nat"?

kameelperdza · Tue Mar 30, 2010 3:39 pm

Can you show me "/ip firewall nat"?

I am not using natting.
The two gateways on router one are firewalls

kameelperdza · Tue Mar 30, 2010 3:40 pm

you have to have normal default routes and deafault routes with routing mark.

can you give me an example?

SurferTim · Tue Mar 30, 2010 3:47 pm

Maybe I misunderstood. There is no internet connection? Just two localnets?

ADD: I think I see now. Both the gateways are on the same interface. Then you need to decide which gateway you want as default, and remove the routing mark from it.

kameelperdza · Tue Mar 30, 2010 3:50 pm

On router 1
ip route add gateway=172.16.0.200 routing-mark=business
ip route add gateway=172.16.0.201 routing-mark=personal

172.16.0.200 is gateway for business
172.16.0.201 is gateway for personal.

If i setup only router 1 with above settings then internet works, but when i setup routing marks and gateways with routing marks on router2 then i cannot ping other side

SurferTim · Tue Mar 30, 2010 3:52 pm

I see. Both gateways on the same net. Decide which route you want as the "default". Remove the routing mark from it.

kameelperdza · Tue Mar 30, 2010 3:56 pm

Maybe I misunderstood. There is no internet connection? Just two localnets?

ADD: I think I see now. Both the gateways are on the same interface. Then you need to decide which gateway you want as default, and remove the routing mark from it.

There should be no default gateway. I want all ip ranges that is set yo use routing mark "personal" to go through gateway "personal".

And all business go thought business gateway

SurferTim · Tue Mar 30, 2010 4:02 pm

Then those you are currently using are the correct settings. DNS may not work tho. Neither will NTP. You might want to routing-mark the router's ips too. Just a thought...

ADD: This is a typo, not the setting, correct?

ip route add dst-address=192.168.0.0/24 gateway=10.0.0.

The ping must go through the 10.0.0.x net to get to router 2 localnet. On return, there is no gateway for the 10.0.0.x net.

kameelperdza · Tue Mar 30, 2010 4:08 pm

I did some tests yesterday. I created one routing-mark with one gateway on router1. And created a default gateway on second router. Networks was pinging fine until i added routing-marks, routing rules and mangle rules.

kameelperdza · Tue Mar 30, 2010 4:09 pm

ip route add dst-address=192.168.0.0/24 gateway=10.0.0.

[/quote]

Hi sorry i mistyped. iT should actually be ip route add dst-address=192.168.0.0/24 gateway=10.0.0.2

kameelperdza · Tue Mar 30, 2010 4:12 pm

If i setup router 1 with above then the packets do go through the correct gateway at the end. But this will mean that i can only have one gateway on the other router and both networks will go though the same gateway on router 2. I dont want the networks to be aware of each other, they should not be able to ping or connect to each other.

SurferTim · Tue Mar 30, 2010 4:13 pm

Did you see my edit? The ping can't return. It has no gateway because the 10.0.0.x ip set is not routing-marked for a gateway.

kameelperdza · Tue Mar 30, 2010 4:20 pm

So i should remove that and reaplce it with

ip route add dst-address=192.168.0.0/24 gateway=10.0.0.2 routing-mark=business

SurferTim · Tue Mar 30, 2010 4:25 pm

You are making this more difficult than it should be. Which gateway do you want the routers to use for dns, ntp and the like? My advice is to remove the routing-mark from that gateway on both routers. ADD: You can block the connection between the two networks with "/ip firewall filter" settings.

kameelperdza · Tue Mar 30, 2010 4:34 pm

ok i try

kameelperdza · Tue Mar 30, 2010 4:36 pm

I did a tracert and it still chooses the gateway without the routing marks.

kameelperdza · Tue Mar 30, 2010 4:39 pm

u think im only going to setup routing marks etc on router 1 and then use firewall rules to block connections between networks

SurferTim · Tue Mar 30, 2010 5:36 pm

u think im only going to setup routing marks etc on router 1 and then use firewall rules to block connections between networks

Now you're thinking! You want them to work perfect if they are not blocked by the firewall filter.
/ip firewall filter
add chain=forward src-address=xx.xx.xx.00/24 dst-address=yy.yy.yy.00/24 action=drop
add chain=forward src-address=yy.yy.yy.00/24 dst-address=xx.xx.xx.00/24 action=drop

Replace xx.xx.xx.00/24 with one localnet, and yy.yy.yy.00/24 with the other. Add more as needed.

kameelperdza · Tue Mar 30, 2010 5:38 pm

Do you think i should add input and output aswell? If they try to ping with their mikrotik router?

for example

ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.11.0/24 action=drop chain=forward
ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.11.0/24 action=drop chain=output
ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.11.0/24 action=drop chain=input
ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.12.0/24 action=drop chain=forward
ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.12.0/24 action=drop chain=output
ip firewall filter add src-address=192.168.10.0/24 dst-address=192.168.12.0/24 action=drop chain=input

SurferTim · Tue Mar 30, 2010 5:43 pm

You might want to
add chain=input src-address=192.168.0.0/24 action=drop
on untrusted localnets. ( I used 192.168.0.x net here). It would prevent a brute force attack on your router OS.

kameelperdza · Tue Mar 30, 2010 5:47 pm

thanx

SurferTim · Tue Mar 30, 2010 6:09 pm

Actually, I told an untruth. You should allow trusted localnets and drop all else on the input chain. You should read the "Protect your RouterOS router" section here:
http://www.mikrotik.com/testdocs/ros/2.9/ip/filter.php

You are welcome!

Please help me with this routing.

Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Re: Please help me with this routing.

Who is online