Community discussions

MikroTik App
 
RamonetNet
newbie
Topic Author
Posts: 28
Joined: Thu Dec 21, 2017 6:50 pm

is this SRC file "complete" ? (work-able ?)

Fri Dec 24, 2021 2:40 pm

Good morning.

We have a RB2011UiAS-RM we did manage using WebFig.
Now we have to replace it and want to configure it using a simple (short) SRC file (17 lines), attached here at the end.

My question is : is there a tool to verify it is complete, I mean, sufficient to run, complete ?
Or maybe any of you can point me what the script is missing or wrong ...

My concepts about routing are not clear enough -
I supose packets from clients to internet use "out-interface" from IP masquerade,
but packets from internet to clients I just dont know.

Any pointer to any URL (as Mikrotik routing) is welcome.
Today I am reading https://help.mikrotik.com/docs/display/ ... n+RouterOS

Have a nice day !

============================================================

The cabling is as follows :

*) eth1 has a direct cable to the ISP router, whose IP is 192.168.1.1
*) eth9 is where I connect my computer, whose IP is 5.5.5.22
*) eth5 has a cable going to Ubiquity "Rocket M5" controller, whose IP is 172.25.33.10 - this antena is where our clients connect, using Mikrotik LBE_5ac_Gen2
*) eth5 has another IP (10.139.130.65), IP used by our clients as Gateway in their configuration. The user's IP is in the range (10.139.130.66 .. 10.139.130.94).

============================================================
The "mine.rsc" file is - I can FTP it to router and can "/import mine.rsc" it perfectly
# 2021.12.23 - RouterOS 6.47.4
/interface ethernet 
set [ find default-name=ether1 ]  comment="router FO"   speed=100Mbps
set [ find default-name=ether5 ]  comment="user access" speed=100Mbps
set [ find default-name=ether9 ]  comment="console"     speed=100Mbps
/ip address 
add address=192.168.1.254/24   comment="router FO"                 interface=ether1 network=192.168.1.0 
add address=172.25.33.9/30     comment="ubiquity controller"       interface=ether5 network=172.25.33.8
add address=10.139.130.65/27   comment="ubiquity antena"           interface=ether5 network=10.139.130.64
add address=5.5.5.5/24         comment="Port de Gestio"            interface=ether9 network=5.5.5.0
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/system clock
set time-zone-name=Europe/Madrid
/system identity
set name=SAG-a2c
You can see our location here : https://guifi.net/es/node/30648
 
tdw
Forum Guru
Forum Guru
Posts: 1843
Joined: Sat May 05, 2018 11:55 am

Re: is this SRC file "complete" ? (work-able ?)

Fri Dec 24, 2021 10:32 pm

There is no tool to 'verify completness' as nothing would know what you are intending the configuration to do.

The speed=100Mbps statements are unnecessary, the value is only used if autonegotiation is turned off.
None of the subnets will be able to reach the internet as there is no default route specified.
It is not wrong, but unusual, to have multiple IP addresses attached to the same interface (ether5 in this case).
Using public IP addresses (5.5.5.0/24 is assigned to telefonica.de) for internal subnets is stringly discouraged as it will prevent access to anything legitimately using those public addresses
It is good practice to restrict administrative access to those subnets/interfaces which require it and disable any unused services.
 
RamonetNet
newbie
Topic Author
Posts: 28
Joined: Thu Dec 21, 2017 6:50 pm

Re: is this SRC file "complete" ? (work-able ?)

Mon Dec 27, 2021 12:47 pm

Thanks, mr TDW.
*) no tool - I knew it would be dificult
*) "speed=100" - I shall remove that
*) no default route : how it is defined ?
I want all the packets from ether5 (and eth6 and eth7 and eth8 in near future) to jump to ether1 (and backwards, of course)
*) documentation : where can I find the details of a RouteOS sentence as "/ip firewall nat add action=masquerade chain=srcnat out-interface=ether1" ?
Thanks a lot.
 
tdw
Forum Guru
Forum Guru
Posts: 1843
Joined: Sat May 05, 2018 11:55 am

Re: is this SRC file "complete" ? (work-able ?)

Mon Dec 27, 2021 3:18 pm

As the LAN address of your router is 192.168.1.1
/ip route add gateway=192.168.1.1

The default firewall policy is to allow any packets in and out of the the Mikrotik and be forwarded between interfaces. Information about the firewall https://help.mikrotik.com/docs/display/ROS/Firewall and for the masquerade rule in particular https://help.mikrotik.com/docs/display/ ... -SourceNAT
 
RamonetNet
newbie
Topic Author
Posts: 28
Joined: Thu Dec 21, 2017 6:50 pm

Re: is this SRC file "complete" ? (work-able ?)

Fri Dec 31, 2021 2:46 pm

mr TDW - thank you very much
The very basic steps are the must difficult, at the beginning.
And thanks a lot for the URLS - sure I shall be reading them in a minute.
Cheers.

Who is online

Users browsing this forum: No registered users and 19 guests