Community discussions

MUM Europe 2020
 
Ivoshiee
Member
Member
Topic Author
Posts: 471
Joined: Sat May 06, 2006 4:11 pm

Hotspot NAT address.

Tue May 08, 2007 8:10 pm

If I look into the connection table then I fail to find what IP-address the Hotspot users are using.
What outgoing address does the Hotspot NAT is using?
 
User avatar
usrox
just joined
Posts: 24
Joined: Sat Sep 17, 2005 7:59 am

Wed May 09, 2007 8:34 am

If you use masq rule from default config (setup-wizard), hotspot use any public ip on your router.
If you want to specify your hotspot outgoing ip you can change default masq rule with src-nat.
 
User avatar
sergejs
MikroTik Support
MikroTik Support
Posts: 6619
Joined: Thu Mar 31, 2005 3:33 pm
Location: Riga, Latvia
Contact:

Wed May 09, 2007 9:34 am

'ip hotspot host' provides clients information about HotSpot address translation. As 'usrox' mentioned, masquerade forces to use router public IP address, as well enabled 'transparent-proxy' makes the same for HTTP connections (public address of router is used for all customers).
 
Ivoshiee
Member
Member
Topic Author
Posts: 471
Joined: Sat May 06, 2006 4:11 pm

Wed May 09, 2007 8:08 pm

The 192.168.200.94 is a hotspot user, but I do not see what "public" IP-address is in use for this client.
[admin@Jeekim] ip hotspot host> print
Flags: S - static, H - DHCP, D - dynamic, A - authorized, P - bypassed 
 #    MAC-ADDRESS       ADDRESS         TO-ADDRESS      SERVER   IDLE-TIMEOUT
 0  P 00:0C:90:4B:25:35 192.168.29.50   192.168.29.50   hotspot1 5m          
 1  P 00:0C:E5:4C:41:50 192.168.39.12   192.168.39.12   hotspot1 5m          
 2  P 00:0C:E5:4C:41:50 192.168.39.13   192.168.39.13   hotspot1 5m          
 3 HA 00:0C:E5:4D:77:B3 192.168.200.94  192.168.200.94  hotspot1
[admin@Jeekim] ip hotspot host> 
Strangest yet is that this client can access the Internet and I see the connection over "ip firewall connection". As this box isn't the one with internet connection this connection must show up on the main router connection table upstream, but it does not. I see no connections from behind nor from the box itself.

What I am missing here?
 
jarosoup
Long time Member
Long time Member
Posts: 600
Joined: Sun Aug 22, 2004 9:02 am

Thu May 10, 2007 6:25 am

If you have more than one public (WAN) IP it seems Mirkotik picks the "highest number" one - at least after a reboot. Not sure if this is always true though. Have you tried using Torch on both the public and private interfaces to trace a given connection? Note that you have to uncheck the port checkbox in torch to see anything other than tcp/udp.
 
Ivoshiee
Member
Member
Topic Author
Posts: 471
Joined: Sat May 06, 2006 4:11 pm

Thu May 10, 2007 2:30 pm

If you have more than one public (WAN) IP it seems Mirkotik picks the "highest number" one - at least after a reboot. Not sure if this is always true though. Have you tried using Torch on both the public and private interfaces to trace a given connection? Note that you have to uncheck the port checkbox in torch to see anything other than tcp/udp.
The MT box with a hotspot has no interface with a public IP-address - all internal.

The "ip firewall nat" has nothing about hotspot NATs.
Where I should look for the hotspot NAT rule?
 
User avatar
usrox
just joined
Posts: 24
Joined: Sat Sep 17, 2005 7:59 am

Thu May 10, 2007 6:42 pm

Q: are there any default gateway on your hotspot-router (ip-route) ? also check your main router (gateway) are there any NAT rules for your internal-ip (not the hotspot-ip)
 
Ivoshiee
Member
Member
Topic Author
Posts: 471
Joined: Sat May 06, 2006 4:11 pm

Thu May 10, 2007 8:28 pm

I can stop the Hotspot user gaining Internet access by selectively disabling handmade NAT rules and that is what I have found out:
1. Parts of HTTP related traffic and DNS seem to go out with the IP address assigned to gefault gateway of MT Hotspot;
2. ICMP, Telnet, SSH, ... seem to go out with the IP address assigned from the IP-address pool;

At the same time the Mikrotik box making all those NATs does not show any connections/traffic going trough these NAT rules nor the connections list any session (I test with known addresses and there are nothing).

What is going on?

Who is online

Users browsing this forum: Google [Bot], jcpena1, MSN [Bot], xiaotuzi and 135 guests