Community discussions

MikroTik App
 
Mike94
just joined
Topic Author
Posts: 2
Joined: Tue Aug 17, 2021 1:19 pm

RB750Gr3 - Small ISP setup

Mon Nov 07, 2022 2:00 pm

Hi,

I have the following router, which is RB750Gr3.

I have a fibre broadband coming to the premises, which comes with a subnet mask of /27. What I am trying to achieve is to use the RB750Gr3 to split the broadband across three different firewalls.

My ISP router would be connected to ETH1 and each subsequent firewall representing a separate customer would be connected to the next available port, meaning Firewall 1 would go to ETH2, Firewall 2 would go to ETH3, etc.. Each firewall would have its own dedicated public IP address from my /27 ISP subnet, and I would not use NAT at all.

I am also trying to use this mini project as a great place to explore the MT world and learn more about their products. With that being said, I would like to ask for your advice regarding the following things below:

1. I thought it would be nice to isolate all three independent firewalls at Layer2 by implementing VLANs. Would you recommend using bridge VLAN filtering, or perhaps shall I try to implement any other approach? With bridge VLAN filtering I would basically create an untagged VLAN per each port to isolate all firewalls.

2. If using a bridge, should WAN interface be out of the bridge or should it be a part of it?

3. I also want to assign ETH5 as a management port, so if using a bridge, should I remove ETH5 from the bridge, or shall I just create another untagged VLAN on this port, solely for the management purpose?

4. Does using a bridge affect the performance of the router or shall I just utilise a switch chip, since this model of MikroTik includes one?

I would like to kindly ask for your understanding as I am new to MikroTik and I have already spent, so much time exploring YouTube, Google and MikroTik Wiki, but we all know how it all can be vague and strange at the first time.

I look forward to hearing back from you soon.

Mike
 
User avatar
smyers119
Member Candidate
Member Candidate
Posts: 232
Joined: Sat Feb 27, 2021 8:16 pm
Location: USA

Re: RB750Gr3 - Small ISP setup

Mon Nov 07, 2022 2:30 pm

My ISP router would be connected to ETH1 and each subsequent firewall representing a separate customer would be connected to the next available port, meaning Firewall 1 would go to ETH2, Firewall 2 would go to ETH3, etc.. Each firewall would have its own dedicated public IP address from my /27 ISP subnet, and I would not use NAT at all.
Let's take a step back, and explain what exactly your trying to do, the big picture.

If you don't want to use NAT then the public IP's need to go to the customer devices as well, and that isn't straightforward when your public subnet is not routed to you, but still doable.
 
seriquiti
just joined
Posts: 19
Joined: Wed May 11, 2022 12:55 pm

Re: RB750Gr3 - Small ISP setup  [SOLVED]

Mon Nov 07, 2022 3:59 pm

From what I understand:

1.
I thought it would be nice to isolate all three independent firewalls at Layer2 by implementing VLANs. Would you recommend using bridge VLAN filtering, or perhaps shall I try to implement any other approach? With bridge VLAN filtering I would basically create an untagged VLAN per each port to isolate all firewalls.
VLANS would work, but in no means necessary. Firewall rules work just as well if referring to normal interfaces - VLANS are just another interface.

2.
If using a bridge, should WAN interface be out of the bridge or should it be a part of it?
Same as 1. WAN can be a VLAN in the bridge or just referred to by the interface. Makes no real difference for firewall etc.

3.
"I also want to assign ETH5 as a management port, so if using a bridge, should I remove ETH5 from the bridge, or shall I just create another untagged VLAN on this port, solely for the management purpose?"
Same as above - your choice makes no difference.

4.
Does using a bridge affect the performance of the router or shall I just utilise a switch chip, since this model of MikroTik includes one?
As far as I understand all traffic moving through the ports is going to be routed (L3) and looking at the diagram for the router you will probably see more speed with switching disabled.

Who is online

Users browsing this forum: rarlup and 43 guests