Community discussions

 
JimF
just joined
Topic Author
Posts: 7
Joined: Sat Nov 28, 2015 6:13 pm

Multiple Network Routing / Isolation

Tue Nov 06, 2018 6:20 pm

Hi Guys,

A couple questions if I may. How does a router determine which public IP is used for masquerading when there is a choice? Also I'm not fully understanding the new bridge concept, as it isn't working on the firewall side of the router.

Consider:
# RouterOS 6.42.7
# model = CRS326-24G-2S+

/ip address
add address=10.100.100.206/26 comment="PUBLIC-EMAIL" interface="Interface WAN" network=10.100.100.192
add address=10.100.100.207/26 comment="PUBLIC-WEB" interface="Interface WAN" network=10.100.100.192
add address=10.100.100.208/26 comment="PUBLIC-SECURE" interface="Interface WAN" network=10.100.100.192

add address=192.168.1.254/24 comment="Local LAN" interface="LAN Bridge" network=192.168.1.0
add address=192.168.0.254/24 comment="Local EMAIL" interface="EMAIL Bridge" network=192.168.0.0
add address=192.168.2.254/24 comment="Local IOT" interface="IOT Bridge" network=192.168.2.0

/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade outbound IP to Public" out-interface="Interface WAN"

/ip route
add distance=1 gateway=10.100.100.193
"Interface WAN" = single Ethernet port #2 on router
"LAN Bridge" = Bridge of Ethernet ports #1, #3, #5, #7 (192.168.1.254/24)
"EMAIL Bridge" = Bridge of Ethernet ports #10, #12, #14, #16 (192.168.0.254/24)
"IOT Bridge" = Bridge of Ethernet ports #9, #11, #13, #15 (192.168.2.254/24)

Three separate internal networks, all isolated. None of my inbounds are DMZ's, all are PORT routed NATs. The inbound ports seem to work, ie: PORT 25 for email has PAT to 192.168.0.100 and that server is connected to router Ethernet port #10. The problem is, I'd like ALL public traffic from each of the various networks to use their own public IP. From the email server (192.168.0.100) a web browser asking for 'What is my IP' returns 10.100.100.206, which is the public IP for the LAN users.

I tried to use mangle and connection/route marking to force local LAN to use a designated IP for outbound. I thought I may need several masquerade settings (one for each LAN), but I'm not sure how to do that when everything is using the same outbound Ethernet and Gateway. I tried to setup another bridge of Ethernet ports #2, #4, #6, #8 and assign Ethernet #2 IP 10.100.100.206, Ethernet #4 IP 10.100.100.207, and Ethernet #6 IP 10.100.100.208; but then the bridge caused all sorts of other issues within the Firewall.

Not sure how to proceed. Originally I had three 750 routers doing this job, but I thought I'd combine them into one rack mountable router.
Suggestions? Thanks.
 
anav
Forum Veteran
Forum Veteran
Posts: 952
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Multiple Network Routing / Isolation

Wed Nov 07, 2018 5:02 am

Good questions......
Are your Public IPs (your WAN given IPs) static or dynamic.

If static, why not try this
/ip firewall nat
add action=srcnat source-address=192.168.1.0/24 action=src-nat to-addresses=10.100.100.206 out-interface=WAN
add action=srcnat source-address=192.168.0.0/24 action=src-nat to-addresses=10.100.100.207 out-interface=WAN
add action=srcnat source-address=192.168.2.0/24 action=src-nat to-addresses=10.100.100.208 out-interface=WAN
 
JimF
just joined
Topic Author
Posts: 7
Joined: Sat Nov 28, 2015 6:13 pm

Re: Multiple Network Routing / Isolation

Thu Nov 08, 2018 6:57 pm

Hello, thanks for the reply.
I thought I had tried that, but to make sure, I did it again. I also found that a router reboot is required or it doesn't seem to apply changes, so it was rebooted for each test below. I used Ethernet port 19 as an individual test.

In addition to previous thread config, I added network 80.252 to port 19 and external Ethernet address 210.
# nov/08/2018 09:16:38 by RouterOS 6.42.7
# model = CRS326-24G-2S+
/ip address
add address=10.100.100.210/26 comment="Test with port 19" interface="Interface WAN" network=10.100.100.192
add address=192.168.80.252/24 comment="Test local port 19" interface=ether19 network=192.168.80.0
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade outbound IP to Public" out-interface="Interface WAN"
# above was router defaulted
add action=src-nat chain=srcnat comment="Return for test port 19" protocol=tcp src-address=192.168.80.0/24 to-addresses=10.100.100.210
add action=src-nat chain=srcnat comment="Return for 192.168.1.x to 10.100.100.206" protocol=tcp src-address=192.168.1.0/24 to-addresses=10.100.100.206
After rebooting, all networks are showing that I am now using 10.100.100.210 as my default router address. (Google, whatismyip.com, whatismyipaddress.com) It is like src-address is being ignored.

So then I thought I would try adding some mangle to force routing...
# nov/08/2018 09:58:00 by RouterOS 6.42.7
# model = CRS326-24G-2S+
/ip firewall mangle
add action=mark-connection chain=prerouting connection-mark=no-mark in-interface=ether19 new-connection-mark=Test passthrough=yes
add action=mark-routing chain=output connection-mark=Test new-routing-mark=Test passthrough=yes
/ip firewall nat
add action=masquerade chain=srcnat comment="Masquerade outbound IP to Public" out-interface="Interface WAN"
add action=src-nat chain=srcnat comment="Return fro 192.168.1.x to 10.100.100.206" protocol=tcp routing-mark=!Test src-address=192.168.1.0/24 to-addresses=10.100.100.206
add action=src-nat chain=srcnat comment="Return for test port 19 now marked" protocol=tcp routing-mark=Test src-address=192.168.80.0/24 to-addresses=10.100.100.210
So I start with anything which has no connection mark already from Ethernet 19 gets "Test" connection mark. Then in output if it had "Test" connection mark, I copy that to routing mark (cause I need routing under NAT). Finally under NAT I try doing the same thing as above, but looking for "Test" and NOT (!) "Test" routing marks; but alas, it appears to just ignore the marks. I even made sure 210 was LAST in the process list opposite order as first test above. I also watch my byte counts in mangle, disconnecting Ethernet 19 to ensure only that port was being marked.
 
anav
Forum Veteran
Forum Veteran
Posts: 952
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Multiple Network Routing / Isolation

Thu Nov 08, 2018 11:43 pm

Post your IP ROUTES segment and also ensure that no DHCP clients have default route selected.
 
JimF
just joined
Topic Author
Posts: 7
Joined: Sat Nov 28, 2015 6:13 pm

Re: Multiple Network Routing / Isolation

Fri Nov 09, 2018 1:22 am

Not much there.
/ip route
add distance=1 gateway=10.100.100.193
No DHCP server, all clients are static. Each using their own gateways 192.168.0.254, 192.168.1.254, 192.168.2.254, and the test notebook on Ethernet 19 is static IP of 192.168.80.226 and GW of 192.168.80.252
 
anav
Forum Veteran
Forum Veteran
Posts: 952
Joined: Sun Feb 18, 2018 11:28 pm
Location: Nova Scotia, Canada

Re: Multiple Network Routing / Isolation

Fri Nov 09, 2018 3:09 am

My bad I should have emphasized, your DHCP client settings (WANIP) under IP DHCP Client. to ensure that default routes were turned off (not selected).

Okay you need to be able to tell the router that you want the lans to go out specific WANIPs, I will try and remember how to do this but it may entail mangling traffic and using in the route menu, the column or entry of "PREFERRED SOURCE"
 
JimF
just joined
Topic Author
Posts: 7
Joined: Sat Nov 28, 2015 6:13 pm

Re: Multiple Network Routing / Isolation

Sat Nov 10, 2018 12:01 am

Ha. Even less there. I don't have client or server configured. Everything is static addressed.
/ip dhcp-server> export
# nov/09/2018 15:57:31 by RouterOS 6.42.7
# model = CRS326-24G-2S+

/ip dhcp-client> export
# nov/09/2018 15:57:46 by RouterOS 6.42.7
# model = CRS326-24G-2S+

Who is online

Users browsing this forum: Frostbyte, Kindis, TurboCow and 37 guests