Community discussions

MikroTik App
 
User avatar
masoudpayment24
just joined
Topic Author
Posts: 3
Joined: Fri May 10, 2019 12:27 am
Location: Iran

Route Specific Local IP Address ( that from Vpn connetion)

Fri May 10, 2019 7:28 am

Hello
I had a laptop that was already in the UAE and connected to a private network with a pptp Vpn connection.
But now it's in the UK, and I want to first connect the laptop to a Mikrotik router in UAE and then connect to that private network with a VPN connection.
I have a Mikrotik router in the UAE.
First, I placed the router in the PPTP Client mode and connected to VPN, and then put the Mikrotik into the PPTP SERVER mode so that my laptop in the UK would connect to Mikrotik with a PPTP Client VPN connection and get the UAE's IP address.
How can I use Mangle now to send this local IP traffic (my labtop in Uk With UAE IP address) to the private network?
Is using Mangle the right one?
Is my scenario correct?
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Route Specific Local IP Address ( that from Vpn connetion)

Fri May 10, 2019 10:41 am

There are two ways to achieve what you want:
  • to use a rule in /ip firewall mangle to assign a routing-mark (which is in fact a name of a routing table)
  • to use rules in /ip route rule for the same purpose.
Using a mangle rule, you can assign the routing mark based on in-interface or src-address or src-address-list and even some other properties of the packets; ip route rules match only on source and destination addresses or subnets but don't interfere with fasttracking which may be a significant advantage if the Mikrotik's CPU is weak.

The common part is
/ip route add dst-address=0.0.0.0/0 gateway=pptp-out1 routing-mark=via-pptp-client

The individual part is
/ip route rule
add action=lookup-only-in-table table=via-pptp-client src-address=the.ip.assigned.to.the.pc

or
/ip firewall mangle
add action=mark-routing new-routing-mark=via-pptp-client chain=prerouting src-address=the.ip.assigned.to.the.pc
/ip route add dst-address=0.0.0.0/0 type=blackhole routing-mark=via-pptp-client distance=2


The additional route is necessary to prevent packets from the PC to use the default routing table (called main) if pptp-out1 is down. With /ip route rule, it is not necessary because action=lookup-only-in-table prevents packets from being routed using the table main (i.e. the one consisting of routes without any routing-mark).

If you need the address of the laptop assigned by the VPN to be accessible as a server to other hosts in the UAE's network as clients, the solution will be a bit more complex.

And one remark regarding terminology, a "local address" is one of device's own ones. The address of your laptop assigned by Mikrotik acting as PPTP server is "an address from a connected subnet" from the perspective of the Mikrotik, not a "local" one. It seems unimportant till the moment you start using a match address-type=local in firewall rules and it does something else than what you expected.
 
User avatar
masoudpayment24
just joined
Topic Author
Posts: 3
Joined: Fri May 10, 2019 12:27 am
Location: Iran

Re: Route Specific Local IP Address ( that from Vpn connetion)

Sun May 12, 2019 11:18 am

There are two ways to achieve what you want:
  • to use a rule in /ip firewall mangle to assign a routing-mark (which is in fact a name of a routing table)
  • to use rules in /ip route rule for the same purpose.
Using a mangle rule, you can assign the routing mark based on in-interface or src-address or src-address-list and even some other properties of the packets; ip route rules match only on source and destination addresses or subnets but don't interfere with fasttracking which may be a significant advantage if the Mikrotik's CPU is weak.

The common part is
/ip route add dst-address=0.0.0.0/0 gateway=pptp-out1 routing-mark=via-pptp-client

The individual part is
/ip route rule
add action=lookup-only-in-table table=via-pptp-client src-address=the.ip.assigned.to.the.pc

or
/ip firewall mangle
add action=mark-routing new-routing-mark=via-pptp-client chain=prerouting src-address=the.ip.assigned.to.the.pc
/ip route add dst-address=0.0.0.0/0 type=blackhole routing-mark=via-pptp-client distance=2


The additional route is necessary to prevent packets from the PC to use the default routing table (called main) if pptp-out1 is down. With /ip route rule, it is not necessary because action=lookup-only-in-table prevents packets from being routed using the table main (i.e. the one consisting of routes without any routing-mark).

If you need the address of the laptop assigned by the VPN to be accessible as a server to other hosts in the UAE's network as clients, the solution will be a bit more complex.

And one remark regarding terminology, a "local address" is one of device's own ones. The address of your laptop assigned by Mikrotik acting as PPTP server is "an address from a connected subnet" from the perspective of the Mikrotik, not a "local" one. It seems unimportant till the moment you start using a match address-type=local in firewall rules and it does something else than what you expected.
Hi
Please briefly describe one of the methods with command.
tnx
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Route Specific Local IP Address ( that from Vpn connetion)

Sun May 12, 2019 11:37 am

Please briefly describe one of the methods with command.
That's what I already did.

The common part (i.e. the one you have to use regardless which method you choose) is to create a specific routing table consisting of a single (default) route, and the command was given there:
/ip route add dst-address=0.0.0.0/0 gateway=pptp-out1 routing-mark=via-pptp-client

What to do next depends on method chosen, that's why I've given it in the form

list-of-commands-for-method-1
or
list-of-commands-for-method-2

What other commands do you ask for?
 
User avatar
masoudpayment24
just joined
Topic Author
Posts: 3
Joined: Fri May 10, 2019 12:27 am
Location: Iran

Re: Route Specific Local IP Address ( that from Vpn connetion)

Sun May 12, 2019 3:13 pm

Please briefly describe one of the methods with command.
That's what I already did.

The common part (i.e. the one you have to use regardless which method you choose) is to create a specific routing table consisting of a single (default) route, and the command was given there:
/ip route add dst-address=0.0.0.0/0 gateway=pptp-out1 routing-mark=via-pptp-client

What to do next depends on method chosen, that's why I've given it in the form

list-of-commands-for-method-1
or
list-of-commands-for-method-2

What other commands do you ask for?
No need NAT ?
 
sindy
Forum Guru
Forum Guru
Posts: 10206
Joined: Mon Dec 04, 2017 9:19 pm

Re: Route Specific Local IP Address ( that from Vpn connetion)

Sun May 12, 2019 3:25 pm

In general you do need NAT so that packets sent via the "outer" VPN would be sent from the address assigned by that VPN, but it is not clear whether you need a separate rule for it and if you do, where exactly to put it. It depends on your overall firewall configuration which you haven't posted, so I cannot give you the proper command.
 
korylus
just joined
Posts: 1
Joined: Tue Dec 07, 2021 11:31 am

Re: Route Specific Local IP Address ( that from Vpn connetion)

Tue Dec 07, 2021 11:34 am

Hi all,
one question :
- how to make it work in RouterOS v7.

Ivan

Who is online

Users browsing this forum: GoogleOther [Bot], ldyte1, msalathe and 77 guests