Community discussions

MikroTik App
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Help with Routing

Fri Apr 19, 2013 1:10 am

Good day,

I have come across a rather odd network configuration that i need some help with routing traffic.

I have attached a image of the current layout, i thinks its best if you have a look at it first as to get and idea of what i am trying to do.
Mune Net diagram.jpg
Ok so an explanation of the two networks..

Network A:
the network with ip range 192.168.1.0/24 is currently setup at a students Resistance. all the computers on it have access to the internet via the hotpot if they have a login. We have a server running centos with SAMBA and a few other things on it. All computers can access one another, it is just a local network. We want to extend this network by adding on network B.

Netowrk B:
10.5.50.0/24
Now we have put up a nano station facing a block of flats, out intentions is to create a small public WUG (wireless user group) . Just for people to connect to and possibly game over it etc. I want them to have to login to a hotspot before they have access to the WUG. The RB2 will be controlling all the traffic on the WUG side.


So now I need to setup RB2 to route traffic between these two networks. But this i am not exactly sure how to do. partly because im not exactly sure what i want. I can only think to explain it as I want both networks to be able to see each other fully. But at the same time I almost want network A to be projected from network B, as there will be members of the public connecting to the WUG and after all it will be an open wireless network. And i don't want to put the local network and its users at risk. Also network B must not have internet access. But it should be able to access certain things like the dc++ server on the server and the team speak server. It should also be able to see hosted games on network A. and network A should be able to see all services and hosted games etc on network B.

If you look at my diagram you will see a red connection from rb2 to rb1 instead of rb2 to the switch. This is just a link that i was thinking might be an alternative setup.

I was thinking of maybe making the WUG upstream from network A by putting in a nat firewall between the two networks so that all computers on network A can see all the computers on network B. But the computers on network B can only access what we have allowed in the firewall. and then in the case when a LAN game is hosted on a pc in network A it should open up the NAT for clients to connect??? Or not im not entirely sure. I don't think this solution would be really what i want. Additionalty i would rather not like to change to much on RB1. i don't mind adding a route or the odd setup to point data to RB2, but i dont want to structully modify the setup of rb1 as it is using all its Ethernet interfaces..

Im sorry for my confusion but i really don't know which direction to start looking at. I would greatly appreciate it if any one could set me in the right direction or give me any suggestions. maybe ask some questions to help me clarify what i am trying to achieve.

Thanks
You do not have the required permissions to view the files attached to this post.
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Sat Apr 20, 2013 2:36 pm

Any one?
 
SurferTim
Forum Guru
Forum Guru
Posts: 4636
Joined: Mon Jan 07, 2008 10:31 pm
Location: Miramar Beach, Florida

Re: Help with Routing

Sat Apr 20, 2013 2:44 pm

I haven't tried this (yet), but if I were to try it, I think I would put both hotspots on separate interfaces on RB1, and replace RB2 with a switch (edit: or remove RB2 and run the wireless unit directly to RB1). I think it would be easier to route this in one router.
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Sat Apr 20, 2013 2:54 pm

Why do you need the second RB? It's not possible to plug the WUG AP into the first RB? That would simplify things a bit.

As for the routing: I'm assuming that you're using the 10.5.50.1 address on RB2 as the gateway for the clients through DHCP. That would mean that, together with the masquerading it does, all traffic they're doing seems to originate from RB2's 192.168.1.125 address. It also means that you should be able to use RB2's firewall to filter access from network B to network A (and vice versa).

For network B to be 'visible' from network A, you'd need to add a static route for it on RB1 (under IP -> Routes), using RB2's 192.168.1.125 address as the gateway. You can also choose some dynamic routing protocol to take care of the routing, but if this is all you have that would be overkill. RB2 already has a route for both networks, but it would also need to get a default route pointing to RB1 (192.168.1.1) so RB2 knows where to direct the internet-bound traffic. To do this, set up a route for 0.0.0.0/0 with gateway 192.168.1.1 on RB2 (again, under IP -> Routes).

If you're able to take away RB2, things become really simple since RB1 then becomes the router for both networks and its firewall can filter between them (and the internet of course).

Hope that helps!
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Sat Apr 20, 2013 10:09 pm

Thanks for your replies.

RB2 does not HAVE to be there. But i would like to keep it there if possible. As I dont want to integrate the two networks cause after all the primary network is network A. and it is only a Rb750 it already sits on 50% cpu usage. Now we going to be transferring probably a constant 54mb/s through it as well. Also the two hot spots should be separate as with the users. Yes it would be possible to combine them into just RB1. But i do think that could cause some additional problems as well.


Yes network B gets its ip address from dhcp on hotspot on RB2 (right now). I have not setup NAT or masquerade yet as i was hoping to be able to router it so it behaved like a switch ie. not act as if all traffic is coming from 192.16.1.125 but im not sure if you can do that? Im not very experienced in the routing of traffic. (do you have to masquerade when routeing from one ip range to another?)

Ok so i have put a static route in RB1:
dest 10.5.50.0/24
gateway: 192.168.1.125

Now how does RB2 know to take those requests and send them across to ether 2?

Ok well i think for a start it would be to just get the routing working. not filtering or firewalls yet. once every one can see every one then i can do the security.
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Sun Apr 21, 2013 1:38 am

No, you don't have to masquerade, I assumed you were already doing that since it's listed in the picture. You can just route normally without masquerading.

If traffic is going from network A to network B the ip packets will have the destination ip in them and the router will know where to send the packets to. If there's traffic coming in directly from the internet you'll have to do NAT as you would have to do for your server if it's serving anything on the internet. If the traffic is just a response from some host in network B (say, when browsing) then RB1 will have seen the traffic going out and will match the return traffic with the originating traffic and it will know where to send the return traffic to. I hope you can follow that :)

RB2 knows about all connected networks already, but needs a default route to point to RB1 else traffic going to ip addresses on the internet will be dropped by RB2 since it doesn't know what to do with the traffic.
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Sun Apr 21, 2013 2:51 am

RB2 needs a default route to point to RB1 else traffic going to ip addresses on the internet will be dropped by RB2 since it doesn't know what to do with the traffic.
Network B shouldn't have any access to the internet anyway ( so its probably good if there is no router for that.) even if there was they would still just get the hotspot login page.
If there's traffic coming in directly from the internet you'll have to do NAT as you would have to do for your server if it's serving anything on the internet.
There will be no access of network B from the internet. Only network A will access network B.

Ok, I kind of follow you. So what should my configuration be?

on RB2:
RB2_Routes.jpg
One route pointing all traffic looking for 10.5.50.0/24 to the bridge1 interface (bridge1 is WUG interface, same as ether2 in network diagram)
so basically pointing network A >> network B

One Route pointing traffic looking for 192.168.1.0/24 to ether1 interface (the lan interface)
so basically pointing network B >> network A

and then in RB1:
RB1_Routes.jpg
Pointing traffic from network A that is looking for network B to RB2 (192.168.1.125/24)

Can you confirm that my routes are correct? Or am i on the wrong track ?

If so what must i do with the firewall now? Must i have masquerade or not?
You do not have the required permissions to view the files attached to this post.
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Sun Apr 21, 2013 2:31 pm

The routes look ok. Are you sure network B isn't allowed to browse the internet at all? It's only allowed to reach network A and nothing else? Remember, many games (since that's what you mention) need access to the internet so people can connect to multiplayer game rooms and such. If they do need to reach the internet (how about updates for OS and games?) then you'll need that default route I mentioned earlier.

You don't need to masquerade on RB2, so you can just delete or disable those rules (they're present by default in the NAT chain). If you want the networks to communicate through the firewall, you'll need to make some rules allowing traffic through.

If you do masquerade and you want network A to be able to reach hosts in network B then you'll have to set up some NAT rules on RB2. Network B will be able to reach hosts in network A without further configuration as that's what the masquerading is meant to do. My advice would be not to masquerade (keeps things simpler) but to use RB2's firewall for some protection between the networks.

If you don't want to bother with the firewall (might be useful for testing) you can just make a rule to allow everything through on the forward chain. This means that both networks can see each other fully, no protection on either side is present, which may not be good if people you don't know will be using network B.
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Sun Apr 21, 2013 2:45 pm

OK so right now.

I have to config as displayed above. But it does not work,
If i attempt to ping a pc on network A from network B it doesn't work. however when i add the route for 0.0.0.0/24 i can ping RB1 (192.168.1.1).
if i have the 0.0.0.0/24 route on rb 2 pointing to 192.168.1.1/24 and i try and access the internet then i get rb1 hotspot page which is correct (So I could give them internet). But does that route not mean that when a pc on network B wants to access 192.168.1.0/24 pc then it will be routed to rb1 as its gateway?

If i try access a pc on network B from network A i cant access them either. but if i tracert it, it does go to RB1 then it cant find its way.

With the routes in RB2, does the fact that they are blue mean any thing? Also with the routes set up as they are. will the firewall be inbetween the two networks? Or could this currently be my problem right now? That the routes are fine but the firewall isn't allowing any thing though? Remember i do still have a hotspot on RB2. So it has its firewall rules in there as well?

So right now i addedd the 0.0.0.0/24 route on rb2.

And network B can access rb1 hotspot (once logged into hotspot on RB2) but thats about it.
A cant see B . and B cant see any computers on A
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Sun Apr 21, 2013 3:26 pm

OK so right now.

I have to config as displayed above. But it does not work,
If i attempt to ping a pc on network A from network B it doesn't work. however when i add the route for 0.0.0.0/24 i can ping RB1 (192.168.1.1).
The route you're quoting here should be 0.0.0.0/0 (meaning all the internet, not just the 0.0.0.0/24 network itself). As for the ping: it should reach the target host on network A just fine (through RB2), with a source address on network B. Then the host in A should send its answer to RB1 since that is its default gateway. RB1 should then forward the ping to RB2 and then on to network B. Maybe RB1 is blocking the ping in its firewall, or RB2 is not allowing the ping back in to network B.
if i have the 0.0.0.0/24 route on rb 2 pointing to 192.168.1.1/24 and i try and access the internet then i get rb1 hotspot page which is correct (So I could give them internet). But does that route not mean that when a pc on network B wants to access 192.168.1.0/24 pc then it will be routed to rb1 as its gateway?
That should not be the case. RB2 knows how to reach hosts in network A just fine (since it's a member of network A), so it can send the traffic on to the host in A directly. As above though, the answer should come through RB1 since that is network A's gateway. RB1's firewall is therefore quite important! Then, after passing through RB1'1 firewall, the traffic will be forwarded to RB2, sent through its firewall, and then on to network B.
If i try access a pc on network B from network A i cant access them either. but if i tracert it, it does go to RB1 then it cant find its way.
That's either the routing's fault or the firewall on RB1 again. See below for an explanation.
With the routes in RB2, does the fact that they are blue mean any thing? Also with the routes set up as they are. will the firewall be inbetween the two networks? Or could this currently be my problem right now? That the routes are fine but the firewall isn't allowing any thing though? Remember i do still have a hotspot on RB2. So it has its firewall rules in there as well?
I don't know the significance of the color, sorry. As for the firewalls, yes, they're relevant. The problem here is that you've got asymmetric routing and the firewalls have difficulty with that setup. Right now, traffic flows like this: Network B -> RB2 -> network A -> RB1 -> RB2 -> network B. And of course: Network A -> RB1 -> RB2 -> network B -> RB2 -> network A.

RB2 sees everything, but RB1 sees only some of the traffic (either the return traffic from A to B or the initial traffic from A to B). The return traffic would seem to come out of the blue for RB1, so it might block it out of hand. RB1's firewall should really be configured to allow everything through between networks A and B. RB2 can then do any filtering.
So right now i addedd the 0.0.0.0/24 route on rb2.

And network B can access rb1 hotspot (once logged into hotspot on RB2) but thats about it.
A cant see B . and B cant see any computers on A
Again: it should be 0.0.0.0/0, not 0.0.0.0/24 for the default route (basically, you're telling RB2 "If you don't know, just send the traffic to RB1 and RB1 will take care of it.").

First: set RB1's firewall to allow any traffic between A and B. Then make sure RB2's firewall lets pings and some other stuff through between A and B so you can test things, or use the same rules as for RB1 while testing.

Then make sure you can ping between A and B, the try some other services on your server for instance.

Lastly, tune RB2's firewall.

Maybe it would help you if you looked at this site with some training video's (some are more general, but many are specific to mikrotiks): http://gregsowell.com/?page_id=951
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Sun Apr 21, 2013 3:53 pm

Ok great thanks for that.

That gives me a good understanding of the config.
Can i ask one thing?

How would i setup a firewall rule to allow all traffic through from network A to network b on RB1!
and Then i would also need to do that same for RB2 (for now, until i want to implement the firewall.)

Thanks
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Sun Apr 21, 2013 4:30 pm

/ip firewall add chain=forward dst-address=10.5.50.0/24 src-address=192.168.1.0/24
/ip firewall add chain=forward dst-address=192.168.1.0/24 src-address=10.5.50.0/24

That should do the trick, I think. Same thing if you want RB1 to allow traffic to itself, just substitute 'input' for 'forward' in the rules above. Should not be necessary unless you want to ping or ssh or whatever to RB1.
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Mon Apr 22, 2013 12:18 am

Ok so im having some trouble. its not working as planned.

Lets just try and get some basic access first before any thing fancy.
Ok so now all RB2 has is the two default routes for each interface. 192.168.1.0.24 and 10.5.50.0/24 (i have disabled the internet route for now) asi i just want local traffic at first.
I have added the firewall bypass rules in both RB1 and RB2.
I have disabled RB2s hotspot for now to eliminate errors.

Now i have plugged my laptop into ether2 (bridge1) on RB2 to act as a pc on the WUG it has an ip of: 10.5.50.247 , and ether1 on RB2 is plugged into my network (network A) with ip 192.168.1.125
RB1 still has route pointing 10.5.50.0/24 traffic to gateway 192.168.1.125, and the firewall bypass rules.

Now these are my test results:
PC on network B:
if i open up chrome on the laptop and go to google.com i get RB1 hotspot at 192.168.1.1
I cant ping 192.1681.1 it says: Destination net not available.
I cant ping a windows pc (192.168.1.20) on network A, But I can ping that ip from RB2 in winbox.
Also cant ping another windows pc 192.168.1.30
So it seems as if i am not getting and throughput on RB2. I don't think the routing is working.
ping 192.168.1.100 (server) : it works 1ms
I can also access webpage on server 192.168.1.100:80 in browser, Can also access 192.168.1.1/login webpage
I can access samba file share on server.
(Now this seems to me as it might turn out to be a windows issue????) I can access the linux box fine but cant access any windows pc at all????

PC on network A:
ping 192.168.1.125 i get a constant 1ms
tracert 192.168.1.125 gives me: 1 <1 ms <1 ms <1 ms wug.com [192.168.1.125]
ping 10.5.50.247: Request Timed out.
tracert 10.5.50.247:
1 <1 ms <1 ms <1 ms hotspot.com [192.168.
2 * * * Request timed out.

So from this side I am not getting any throughput to network B either.

So from the looks of things. RB2 is not working correctly? Rb1 seems to be re routing traffic destined for 10.5.50.0/24 but RB2 isn't accepting it and then routign it to network B.

any suggestions?
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Mon Apr 22, 2013 1:05 am

Ok i have been doing some more debugging.

If i put my desktop (192.168.1.30) default ip settings and if i put its default gateway to 192.168.1.125 i can then ping my wifi AP on network B. (10.5.50.99) But i still cannot ping laptop (10.5.50.247).

So this says 2 things to me.
1. That RB1 is not correctly routing 10.5.50.0/24 requests to 192.168.1.125 because if i put my desktop gateway to 192.168.1.1 i cant ping/access 10.5.50.99.
2. I still cant access any windows computers? Could windows for some reason not accept packets from networks besides its own?
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Mon Apr 22, 2013 5:59 pm

Ok so im having some trouble. its not working as planned.
Now these are my test results:
PC on network B:
if i open up chrome on the laptop and go to google.com i get RB1 hotspot at 192.168.1.1
I cant ping 192.1681.1 it says: Destination net not available.
I cant ping a windows pc (192.168.1.20) on network A, But I can ping that ip from RB2 in winbox.
Also cant ping another windows pc 192.168.1.30
So it seems as if i am not getting and throughput on RB2. I don't think the routing is working.
ping 192.168.1.100 (server) : it works 1ms
I can also access webpage on server 192.168.1.100:80 in browser, Can also access 192.168.1.1/login webpage
I can access samba file share on server.
(Now this seems to me as it might turn out to be a windows issue????) I can access the linux box fine but cant access any windows pc at all????
If this is the PC on network B itself that can access the linux server at 192.168.1.100, then I'd say that routing and firewalling between the networks is working properly, especially if you're not masquerading, since then you'll have that whole asymmetric thing to work with and that seems to work fine since you get a response from 192.168.1.100.

The other issues you're seeing would then likely be local to the pc's involved, perhaps their local firewall is tricking you here? I'm not very knowledgeable on windows pc's though.

From network A, can you ping 10.5.50.1? If not, then maybe the firewall on RB2 is blocking your ping (input chain here). If it does work, then you can reach the network, but the pc on network B may not answer - firewall maybe?

On your latest post: when your gateway is set to 192.168.1.125, not being able to ping the laptop is clearly the laptop's issue unless you're doing something in your firewall on RB2.

Not being able to ping with the gateway set to 192.168.1.1 seems weird if the route to 10.5.50.0/24 on RB1 is correct. Can you ping from RB1 itself?
 
Zapnologica
Long time Member
Long time Member
Topic Author
Posts: 594
Joined: Fri Sep 25, 2009 8:15 pm
Location: South frica

Re: Help with Routing

Mon Apr 22, 2013 6:20 pm

Ok so i think i am going to disable both pc's firewalls and test again.

I can ping 192.168.1.1 when my gateway is set to 1.1 and when i tracrt 10.5.50.1 it goes to RB1 but then gets lost. The route looks correct and has an 'A' next to it for active.
 
User avatar
Pellaeon
just joined
Posts: 15
Joined: Mon Mar 25, 2013 2:09 pm

Re: Help with Routing

Mon Apr 22, 2013 10:58 pm

Perhaps if you make that red link between RB1 and RB2 (use a small subnet between them for routing, say 10.2.2.0/29 or so) the situation will be somewhat simpler. If you then remove the link between RB2 and the switch (and RB2's 192.168.1.125 address of course), the asymmetric routing will be gone. RB2 should then use RB1's address on the routing subnet as the default route destination (make a default route). This would at least let RB1 see all the traffic, so the setup is cleaner.

Who is online

Users browsing this forum: No registered users and 82 guests