Community discussions

MikroTik App
 
bitsmt
just joined
Topic Author
Posts: 10
Joined: Tue Jun 05, 2012 9:04 pm

RB450g: Share WAN (Port 1) with 2xDHCP (1x port2, 1x port3)

Wed Jun 06, 2012 2:18 am

I am not finding this scenario (which is odd) but it seems so common, it should be an FAQ/KB article. Once this is working as expected, I would like to turn it into an FAQ or KB for others to benefit. Please feel free to respond with your ideas and suggestions.

The goal is to have different DHCP/NAT segments set on Ports 2 and 3 to allow nodes to acquire the needed configuration (some statically assigned) that would allow the node to communicate with the Internet using the WAN connection on Port 1. Below is the theoretical configuration example as well as the corresponding JPG image (attached).

From ISP (eth1)
Gateway: 169.169.169.1
IP Range: 169.169.169.2-6
Broadcast: 169.169.169.7 (SM: 255.255.255.248)

Guest LAN (eth2)
Gateway: 10.10.10.1
IP Range: 10.10.10.2-250
Broadcast: 10.10.10.255 (SM: 255.255.255.0)
WLAN AP1: 10.10.10.250 (Static DHCP)
WLAN AP2: 10.10.10.251 (Static DHCP)
NOTE: Will be seen by the Internet as IP address 169.169.169.2

Corp LAN (eth3)
Gateway: 10.10.11.1
IP Range: 10.10.11.11-250
Broadcast: 10.10.11.255 (SM: 255.255.255.0)
WLAN AP1: 10.10.11.250 (Static DHCP)
WLAN AP2: 10.10.11.251 (Static DHCP)
NOTE: Will be seen by the Internet as IP address 169.169.169.3

How do I configure the 450g...
1. to allow eth2 and eth3 access to the Internet?
2. to assign the same LAN IP to a specific node's MAC? (Static DHCP)
3. to allow a node, with a WAN IP (from the 169.169.169.xxx) on the LAN, access to the Internet?
4. to allow management of the switch from the WAN via a secure connection (SSL? TLS?)
5. with these settings using Winbox or Webbox?
You do not have the required permissions to view the files attached to this post.
Last edited by bitsmt on Fri Jun 08, 2012 2:21 pm, edited 2 times in total.
 
bitsmt
just joined
Topic Author
Posts: 10
Joined: Tue Jun 05, 2012 9:04 pm

Re: RB450g: Share WAN (Port 1) with DHCP/NAT on port 2, 3

Thu Jun 07, 2012 1:48 am

Are my expectations of MikroTik and their "community" too high? Should I not expect quick responses?

I have been able to get the DHCP to work so that devices on port 2 get an IP address of 10.10.10.xxx and devices on port 3 get an IP addresses of 10.10.11.xxx.

However, when I attempt to get out onto the Internet, no data is returning from the up-line router 169.169.169.1. I suspect there is a problem with NAT or Firewall on the MikroTik, as I can use New Terminal to ping the outside world without a problem, but can not do the same with a computer connected to the Mikrotik.

Here is a PDF that someone else made that I used as a example.
You do not have the required permissions to view the files attached to this post.
 
User avatar
lordkappa
Member Candidate
Member Candidate
Posts: 133
Joined: Wed May 16, 2012 1:53 pm
Location: Vancouver, Canada

Re: RB450g: Share WAN (Port 1) with DHCP/NAT on port 2, 3

Fri Jun 08, 2012 6:05 am

Are my expectations of MikroTik and their "community" too high? Should I not expect quick responses?
No need to be condescending. None of us are paid to be here to fulfill your expectations. We take time out of our schedules to help each-other out where and when we can.

Some more information regarding your current configuration would be helpful in places. I have no idea what you've tried so far.

For setup I prefer winbox.

1. I would try setting up 2 SrcNAT rules (IP->Firewall->NAT), one for each subnet, 10.1.10.0/24 and 10.1.11.0/24. and masquerade them as they left out the Eth1 interface. (Make sure you have a default route, 0.0.0.0/0, set in IP->Routes)

2. Static DHCP is actually trivial. Easiest way is to let the target device grab a DHCP address, then go into your IP->DHCP Server->Leases. Double click the appropriate entry, and click the "Make Static" button; change the settings to your liking.

3. You haven't said anything about acting as a DHCP Relay, so I'm not sure how this would happen. Perhaps you could provide more info.

4. SSH and Winbox settings are under IP->Services, as are other remote services.

It sounds like you may also want firewall rules to stop Eth2 traffic from passing out Eth3 and vice versa.

-Dave
 
bitsmt
just joined
Topic Author
Posts: 10
Joined: Tue Jun 05, 2012 9:04 pm

Re: RB450g: Share WAN (Port 1) with DHCP/NAT on port 2, 3

Fri Jun 08, 2012 9:47 am

Oooo...IC. My apologies and thank you.

Good advice. Looks like I have a lot of home work to do. I have until 8am to get this figured out.

Thank you for the advice.

Luis
 
bitsmt
just joined
Topic Author
Posts: 10
Joined: Tue Jun 05, 2012 9:04 pm

Re: RB450g: Share WAN (Port 1) with DHCP/NAT on port 2, 3

Fri Jun 08, 2012 2:17 pm

OK. I have managed to get MOST of what I need to do, working. Unfortunetly, it is so complicated (reading through different forums, testing different configs...etc.) that I am not sure I can explain it to someone on how to replicate it. Thus, I will be making a backup.


I have yet to figure out how to apply an external static IP to each port. The idea is that the Guest Port2 will have its own external (routable) IP address that the DHCP/NAT on port 2 will send/receive from, and port 3 will have its own separate external (routable) IP address that the DHCP/NAT on port 3 will send/receive from. At this time, Port 1 (WAN) is set for DHCP, and is using 1 externally.

supout.rif is available.
 
User avatar
macgaiver
Forum Guru
Forum Guru
Posts: 1764
Joined: Wed May 18, 2005 5:57 pm
Location: Sol III, Sol system, Sector 001, Alpha Quadrant

Re: RB450g: Share WAN (Port 1) with 2xDHCP (1x port2, 1x por

Fri Jun 08, 2012 3:15 pm

Your description is a little bit fuzzy, but let me see if i can help.

So you have 2 or more public IP addresses and you wanna that each of your local networks uses only specific ones. This is done by replacing your masquerade rule with 2 src-nat rules that have src-address=<one local network or another> , out-interface= ether1, to-address=<specific you need>

ALso if you use dst-nat to assign some public addresses to some services (like web-server) you can always use static DNS entries to force local users to use local IPs to resolve your server DNS names.
 
solis
just joined
Posts: 5
Joined: Tue Feb 28, 2012 12:52 am

Re: RB450g: Share WAN (Port 1) with DHCP/NAT on port 2, 3

Fri Jun 08, 2012 10:18 pm

Are my expectations of MikroTik and their "community" too high? Should I not expect quick responses?
I think you want a turnkey solution...... :shock:

1) wan acces.
/ip address add=169.169.169.2/29 disabled=no interface=eth1
/ip address add=169.169.169.3/29 disabled=no interface=eth1
/ip address add=169.169.169.4/29 disabled=no interface=eth1
/ip address add=169.169.169.5/29 disabled=no interface=eth1
/ip address add=169.169.169.6/29 disabled=no interface=eth1

/ip route add dst-address=0.0.0.0/0 gateway=169.169.169.1 distance=1 disabled=no
now from rb450 you have access to internet because your "external" ip's are 169.169.169.2-6/29 and your gateway 169.169.169.1 make the nat if needed, this only works accesing internet from rb450.


2) guest lan
/ip address add=10.10.10.1/24 disabled=no interface=eth2

/ip pool add name=guest ranges=10.10.10.2-10.10.10.250

/ip dhcp-server network add address=10.10.10.0/24 dns-server=8.8.8.8 gateway=10.10.10.1

/ip dhcp-server add address-pool=guest disabled=no interface=eth2 name=guest
now the translation:
/ip firewall nat add action=src-nat chain=srcnat disabled=no src-address=10.10.10.0/24 to-address=169.169.169.2
... Enough for your expectations?. First search in the forum ....

Who is online

Users browsing this forum: ckonsultor and 12 guests