Community discussions

MikroTik App
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sat Oct 03, 2020 5:11 am

Hi guys, just wondering why i cannot access my access points User Interface / GUI when i set the hs bridge interface to reply only. I have already set a static-arp for my access point and srcnat out masquerade that points to the bridge with my src address also setting a static ip of AP's subnet in the bridge interface and bypassing it at the hotspot binding. I have to set it to enabled first before i could access the GUI's. My understanding right now is that the AP should respond to Mikrotik request.

Help are appreciated thanks.
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sat Oct 03, 2020 11:53 am

My understanding right now is that the AP should respond to Mikrotik request.
Except that the very point of arp=reply-only is that no request ever comes :) This setting is a poor man's substitution of 802.1x. It prevents RouterOS from sending ARP requests on that interface and thus from dynamically populating the ARP table (IP->MAC address translation) on demand; instead, the ARP record is created when a DHCP lease is given to the client (and removed when the lease expires), so devices which manually set the IP from the proper subnet cannot receive any traffic from the Mikrotik. But this must be explicitly enabled in the DHCP server configuration. Or you can create the ARP records manually (using the ones added dynamically while arp=enabled as a base) and then set arp=reply-only if the APs do not obtain their addresses from the Mikrotik.

An eventual attacker may beat arp=reply-only if he first sniffs both the MAC addresses and the IP addresses related to them from live traffic (which is quite simple) and then spoofs them. Only the real 802.1x is secure as the MAC address alone is not enough for authentication, the device must know the proper secret.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 5:35 am

My understanding right now is that the AP should respond to Mikrotik request.
Except that the very point of arp=reply-only is that no request ever comes :) This setting is a poor man's substitution of 802.1x. It prevents RouterOS from sending ARP requests on that interface and thus from dynamically populating the ARP table (IP->MAC address translation) on demand; instead, the ARP record is created when a DHCP lease is given to the client (and removed when the lease expires), so devices which manually set the IP from the proper subnet cannot receive any traffic from the Mikrotik. But this must be explicitly enabled in the DHCP server configuration. Or you can create the ARP records manually (using the ones added dynamically while arp=enabled as a base) and then set arp=reply-only if the APs do not obtain their addresses from the Mikrotik.

An eventual attacker may beat arp=reply-only if he first sniffs both the MAC addresses and the IP addresses related to them from live traffic (which is quite simple) and then spoofs them. Only the real 802.1x is secure as the MAC address alone is not enough for authentication, the device must know the proper secret.
Hi sindy, thanks for the answer. So are there any workaround in this? i cannot create arp records manually (the dynamic way) because the AP's have static ip and the ip subnet of hotspot 10.0.0.0/24 and AP's 192.168.5.0/24 are not the same. I have already set arp-reply only if Ap's do not obtain their addresses from the mikrotik (static ip) and also a static arp. Also i am not using any form radius server that 802.1x you are referring.
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 12:33 pm

So are there any workaround in this?
In our culture, mentalism has no real tradition, so I can't see your network setup clearly. So what I assume is that you run the 192.168.5.0/24 and the 10.0.0.0/24 in the same (V)LAN, and you want to keep the arp=reply-only behavior in place for the hotspot clients. So depending on what type of APs you use, you may
  • use separate VLANs for the wireless interfaces and for the management,
  • use CAPsMAN to let the APs transport the wireless traffic encapsulated into UDP to the hotspot router and land it on a separate bridge there,
  • set arp=enabled for a while, ping all the APs' addresses in 192.168.5.0/24 to obtain the ARP records, and then set arp back to reply-only - this means you have to add the ARP record for each newly added or replaced AP manually,
  • connect the APs to a bridge at the hotspot router side and use /interface bridge filter rules to block ARP requests sent by the Mikrotik to the APs for IP addresses in the 10.0.0.0/24 range (which would selectively substitute the arp=reply-only setting on the bridge so you could put back arp=enabled - but this last option leaves the attacker the possibility to choose an address from 192.168.5.0/24 and bypass the protection.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 7:21 pm

So are there any workaround in this?
In our culture, mentalism has no real tradition, so I can't see your network setup clearly. So what I assume is that you run the 192.168.5.0/24 and the 10.0.0.0/24 in the same (V)LAN, and you want to keep the arp=reply-only behavior in place for the hotspot clients. So depending on what type of APs you use, you may
  • use separate VLANs for the wireless interfaces and for the management,
  • use CAPsMAN to let the APs transport the wireless traffic encapsulated into UDP to the hotspot router and land it on a separate bridge there,
  • set arp=enabled for a while, ping all the APs' addresses in 192.168.5.0/24 to obtain the ARP records, and then set arp back to reply-only - this means you have to add the ARP record for each newly added or replaced AP manually,
  • connect the APs to a bridge at the hotspot router side and use /interface bridge filter rules to block ARP requests sent by the Mikrotik to the APs for IP addresses in the 10.0.0.0/24 range (which would selectively substitute the arp=reply-only setting on the bridge so you could put back arp=enabled - but this last option leaves the attacker the possibility to choose an address from 192.168.5.0/24 and bypass the protection.
You have a nice concept there just similar to mine. 192.168.5.0/24 and 10.0.0.0/24 in the same interface bridged. Current setup follows in the picture diagram. Correction there are actually 12 PC.
Last edited by Wangz on Mon Oct 12, 2020 4:04 pm, edited 1 time in total.
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 7:34 pm

This way, the clients can access the management interface of the APs if they manually assign themselves addresses from 192.168.5.0/24, and the arp=reply-only cannot prevent that, as ARP is only used when routing is necessary to deliver a packet, which is not the case to a client associated to one of the APs if he uses a 192.168.5.x address. There is no problem to use the CAPsMAN or VLAN approach for the hAP lite, but I know nothing at all about the Comfast box. Decent devices allow to link a wireless interface to a VLAN on the Ethernet port so the management interface is not in the same VLAN like the one to which clients connect, but if the Comfast cannot do that, the only security measure left beyond username and password is that it allows to restrict access to management functions to a list of IP addresses or subnets.

What was the question you forgot to add to you delaration?
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 7:42 pm

This way, the clients can access the management interface of the APs if they manually assign themselves addresses from 192.168.5.0/24.
Hmm i see so even with the firewall rule that i have set in filter rule forward chain that will only allow the admin to access it. It's still futile and yes i have confirmed it now that i could actually access them. I'll just set a robust password then.
I have an anti NMAP scanner that i have set in the filter rule. That should do the job in scanning but theres still many holes i supposed..

What was the question you forgot to add to you delaration?
What do you mean?
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 7:47 pm

What was the question you forgot to add to you delaration?
What do you mean?
In the post to which I've replied this, you've provided the information about the current topology, but you wrote nothing that would require any reaction. So I was assuming that, once you've shown the topology, there was some related question - otherwise, what would be the purpose of posting it?
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 8:09 pm

What was the question you forgot to add to you delaration?
What do you mean?
In the post to which I've replied this, you've provided the information about the current topology, but you wrote nothing that would require any reaction. So I was assuming that, once you've shown the topology, there was some related question - otherwise, what would be the purpose of posting it?
Yeah you were right about that. The thing is I was just showing what my current setup is in my overall network maybe there is needed to be improve or something?
This way, the clients can access the management interface of the APs if they manually assign themselves addresses from 192.168.5.0/24, and the arp=reply-only cannot prevent that, as ARP is only used when routing is necessary to deliver a packet, which is not the case to a client associated to one of the APs if he uses a 192.168.5.x address.
Is there a way to counter that static in client? or maybe i think VLAN can do that? I am planning to move all of hotspot setup into a VLAN interface and maybe possibly use a radius server.

I am very confused about with vlan rn... and still trying to understand it.
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Sun Oct 04, 2020 8:21 pm

I am very confused about with vlan rn... and still trying to understand it.
VLAN implementation on Mikrotik or VLAN as a concept? Have you seen the @pcunite's textbook on that already?
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Thu Oct 08, 2020 6:46 am

I am very confused about with vlan rn... and still trying to understand it.
VLAN implementation on Mikrotik or VLAN as a concept? Have you seen the @pcunite's textbook on that already?
Both. Yeah i have seen that but i did not finished reading the thread. Also i am confused why there are so many vlan in RouterOS. It must be that the vlan in the switch is hardware related while the bridge vlan is the Software and in the interface vlan idk.
-Home NA
 
sindy
Forum Guru
Forum Guru
Posts: 6941
Joined: Mon Dec 04, 2017 9:19 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Thu Oct 08, 2020 1:06 pm

Also i am confused why there are so many vlan in RouterOS. It must be that the vlan in the switch is hardware related while the bridge vlan is the Software and in the interface vlan idk.
Correct. The switch chip is quite a separate entity, and if you don't need hardware forwarding between its ports, you may deactivate it let the sowftare bridge do everything on its own. Another point is that the VLANs exist independently on each bridge, so you can have VLAN 27 at bridge A and VLAN 27 on bridge B and they don't leak to each other (this is not the case on the switch chip if hardware forwarding is enabled). That's a huge advantage in complex topologies. And VLAN interfaces attached directly to physical interfaces are also completely independent.

If you simplify that a small bit, you can look at the VLAN ID as just an extension of the MAC address, or as a logical address of a sub-interface on a physical interface, whichever is more illustrative for you. So what you would normally attach to ether1 (like IP address or dhcp client), you can attach to /interface vlan name=ether1.27 vlan-id=27 interface=ether1 instead; the /interface vlan is a stupid pipe which adds VLAN tags to those L2 frames carrying L3 packets which it receives from the system on its tagless end (referred to as the pipe's name), and removes VLAN tags from frames which it can see at the underlying interface if the VID in the tag matches the vlan-id, and outputs only these frames after untagging from its name end.

So if you just need to separate traffic on a single cable, you can attach as many /interface vlan as you need to the Ethernet interfaces at each end; if the Ethernet port is a member port of a bridge, you must attach the /interface vlan(s) to that bridge instead.
Instead of writing novels, post /export hide-sensitive. Use find&replace in your favourite text editor to systematically replace all occurrences of each public IP address potentially identifying you by a distinctive pattern such as my.public.ip.1.
 
User avatar
Wangz
newbie
Topic Author
Posts: 30
Joined: Wed Apr 15, 2020 4:41 pm

Re: Cannot access Access Points GUI when Arp Reply-only is Set in Hotspot

Tue Oct 13, 2020 4:03 am

Also i am confused why there are so many vlan in RouterOS. It must be that the vlan in the switch is hardware related while the bridge vlan is the Software and in the interface vlan idk.
Correct. The switch chip is quite a separate entity, and if you don't need hardware forwarding between its ports, you may deactivate it let the sowftare bridge do everything on its own. Another point is that the VLANs exist independently on each bridge, so you can have VLAN 27 at bridge A and VLAN 27 on bridge B and they don't leak to each other (this is not the case on the switch chip if hardware forwarding is enabled). That's a huge advantage in complex topologies. And VLAN interfaces attached directly to physical interfaces are also completely independent.

If you simplify that a small bit, you can look at the VLAN ID as just an extension of the MAC address, or as a logical address of a sub-interface on a physical interface, whichever is more illustrative for you. So what you would normally attach to ether1 (like IP address or dhcp client), you can attach to /interface vlan name=ether1.27 vlan-id=27 interface=ether1 instead; the /interface vlan is a stupid pipe which adds VLAN tags to those L2 frames carrying L3 packets which it receives from the system on its tagless end (referred to as the pipe's name), and removes VLAN tags from frames which it can see at the underlying interface if the VID in the tag matches the vlan-id, and outputs only these frames after untagging from its name end.

So if you just need to separate traffic on a single cable, you can attach as many /interface vlan as you need to the Ethernet interfaces at each end; if the Ethernet port is a member port of a bridge, you must attach the /interface vlan(s) to that bridge instead.
Just did the /interface vlan id 120 on my port 4 and I downloaded a realtek ethernet diagnostic utility and set a VLAN ID on my pc. I have set a static IP on the VLAN adapter then the VLAN did work immediately. Then the second thing that I did is block all routings in layer 3 in filter rule and allow only my server where I can print. Then I set a static ARP of my VLAN then setting the interface in arp-reply only. I did encounter few problems though, one of my servers won't respond to my ping thus I cannot print and it turns out the firewall of the pc itself was the problem. Then my pc and the other pc, I set the firewall to allow incoming connections in different subnet. On my pc it was a default already but in my server it was a different one... Anyways thanks for all of your explanation that did help me setting up my first VLAN and printing did work after that..
-Home NA

Who is online

Users browsing this forum: Baidu [Spider], Bing [Bot] and 183 guests