Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us $3,400 per month for bandwidth bills alone, and since we don't believe in shoving popup ads to our registered users, we try to make the money back through forum registrations.
«58 »
  • Post
  • Reply
R1CH
Apr 7, 2002

The Ron Jeremy of the coding world

Isn't port forwarding under NAT?

Adbot
ADBOT LOVES YOU

CuddleChunks
Sep 18, 2004



mono posted:

Here's all I got when I did that (I X'd out part of the ID since I'm not sure if

oops, try: ip fir nat export

NOTinuyasha
Oct 17, 2006

 


The Great Twist

mono posted:

I'm delving into the MikroTik world and I'm having a hell of a time with port forwarding. I followed the Anypony guide and although the forwarding works fine (I started with 80 and 443 to an SBS 2011 box and I can access it from the outside no problem) it kills any outgoing traffic to 80 and 443 from inside the network. I'm wondering if I screwed something up elsewhere in Winbox, or if I'm missing something. I'm running 5.5 on an RB750G (it had the same behavior before upgrading it to 5.5). Any help is appreciated.

the rule either needs to filter traffic by destination address or in. interface

mono
Jul 18, 2003

It's toe-tapping-ly tragic!


CuddleChunks posted:

oops, try: ip fir nat export

Here you go:

code:
/ip firewall nat
add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1-gateway
add action=dst-nat chain=dstnat disabled=no dst-port=3389 protocol=tcp to-addresses=10.10.1.16 to-ports=3389
add action=dst-nat chain=dstnat disabled=no dst-port=902 protocol=tcp to-addresses=10.10.1.245 to-ports=902
add action=dst-nat chain=dstnat disabled=no dst-port=443 protocol=tcp to-addresses=10.10.1.16 to-ports=443
add action=dst-nat chain=dstnat disabled=no dst-port=80 protocol=tcp to-addresses=10.10.1.16 to-ports=80

CuddleChunks
Sep 18, 2004



Those rules NAT everything hitting the ports. You need one more condition for them to trigger selectively. In my case, I put in my static IP from the WAN side so my rule looks like this:

/ip firewall nat add action=dst-nat chain=dstnat comment="" \
disabled=no dst-address=XX.XX.XX.XX dst-port=80 protocol=tcp \
to-addresses=192.168.17.3 to-ports=80


I've bolded the dst-address field to make it stand out more.

mono
Jul 18, 2003

It's toe-tapping-ly tragic!


CuddleChunks posted:

Those rules NAT everything hitting the ports. You need one more condition for them to trigger selectively. In my case, I put in my static IP from the WAN side so my rule looks like this:

/ip firewall nat add action=dst-nat chain=dstnat comment="" \
disabled=no dst-address=XX.XX.XX.XX dst-port=80 protocol=tcp \
to-addresses=192.168.17.3 to-ports=80


I've bolded the dst-address field to make it stand out more.

Awesome, looks like that's all I needed. Thanks!

pubic void nullo
May 17, 2002


I read a rumour about a unit like the RB750G but with a built-in N wireless card coming out soon. Unfortunately, I can't remember where I read it.

Although I do see this on page 1:

Nubile Cactus posted:

Also looks like they will be releasing a 750G with wireless built in soon as a sort of more advanced home AP. Should be pretty awesome once it comes out.

Would love to know how long I'd have to wait for this to come out.

CuddleChunks
Sep 18, 2004



Arnika - they announced it in their product brochure but the release date keeps slipping. RB751G I think is the model number or something like that. It looks sexy as hell but we still have to wait for now.

krackpot
Apr 24, 2011


Does anyone have QOS setup? Just wondering if there are any good setups to throttle down torrent/newsgroup traffic and prioritize web/gaming etc?

falz
Jan 29, 2005

01100110 01100001 01101100 01111010


There's a lot of QoS info on their wiki. The layer 7 page links to these importable layer7 rules that you can use in QoS for app layer control. I did this as a test with torrent traffic at work and while it wasn't 100%, it was quite effective. Torrent, NNTP, HTTP are on there. "Gaming" probably depends on the game. Quake and doom are there!

NOTinuyasha
Oct 17, 2006

 


The Great Twist

krackpot posted:

Does anyone have QOS setup? Just wondering if there are any good setups to throttle down torrent/newsgroup traffic and prioritize web/gaming etc?

the way to do it is specify mangle rules to mark the packets, and then create a queue tree to limit and distribute bandwidth based on that marking. layer7 tagging works too, but at a higher cpu cost, and certain services may be untaggable.

queue trees will do exactly what you tell them, so it's easy to create (subtly) broken setups if you aren't familiar with HTB.

edit: the *only* way to do it

NOTinuyasha fucked around with this message at Jul 11, 2011 around 04:37

mono
Jul 18, 2003

It's toe-tapping-ly tragic!


Another fairly basic problem here:

I setup another 750G router with a static WAN address, and although the router can connect to the Internet fine (pinging 4.2.2.2 from Winbox responds) I can't get out with any other devices attached. I can ping the router fine, but nothing beyond it (cable modem IP, gateway, etc).

Any ideas?

falz
Jan 29, 2005

01100110 01100001 01101100 01111010


Is it doing NAT?

mono
Jul 18, 2003

It's toe-tapping-ly tragic!


I haven't changed any NAT rules, so whatever's there with a stock configuration is it (masquerade rule?)

falz
Jan 29, 2005

01100110 01100001 01101100 01111010


I don't recall there being any default NAT rules unless you enabled a basic firewall set from the web interface. Either way nat/firewall are likely the issue.

Weird Uncle Dave
Sep 2, 2003

I could do this all day.

Buglord

mono posted:

I haven't changed any NAT rules, so whatever's there with a stock configuration is it (masquerade rule?)

By default, there's no NAT. You can get that, though, with a one-liner. Something like:

/ip firewall nat add action=masquerade chain=srcnat disabled=no out-interface=ether1

(Obviously you change that to reflect the interface that faces "outside.")

Methylethylaldehyde
Oct 23, 2004

BAKA BAKA


Welp, my old router was taking a poo poo, so I decided that gently caress everything, it's time to get a big boy router. So I bought a 493G with a R2N wireless card, and two 7 dBi omni antennas.

Now it's time to figure out how to do multi-queue QoS on two or more connections with different link speeds and throughput caps.

CuddleChunks
Sep 18, 2004



Methylethylaldehyde posted:

Now it's time to figure out how to do multi-queue QoS on two or more connections with different link speeds and throughput caps.

Hahaha I love Mikrotiks. The very idea that you can consider doing this kind of nonsense without paying thousands of dollars is a real joy. Good luck to you!

Methylethylaldehyde
Oct 23, 2004

BAKA BAKA


CuddleChunks posted:

Hahaha I love Mikrotiks. The very idea that you can consider doing this kind of nonsense without paying thousands of dollars is a real joy. Good luck to you!

Yeah, they're powerful little devices. Hopefully doing that won't be akin to striking myself repeatedly in the dick with a hammer.

ManicJason
Oct 27, 2003

He doesn't really stop the puck, but he scares the hell out of the other team.

This thread is awesome. I work for a small ISP that uses a lot of Mikrotik stuff. I do mostly tech support and PC repair but this thread has helped me start getting my nose dirty when stuff breaks or needs to be reconfigured when our network dude isn't available. Also I acquired a 450G to play around with on my desk.

Question: We use hotspot authentication through a web interface in a couple apartment buildings we provide with wireless. The problem is game consoles. Right now the only way to get them to work is to manually plug in MAC addresses. There has to be a way to get the Mikrotiks to recognize console traffic and let it bypass authentication. I couldn't find any info though.

falz
Jan 29, 2005

01100110 01100001 01101100 01111010


Does the mac address registration stuff do any wildcarding? If so you could try to determine a valid range that may mean 'Sony', 'Microsoft', 'Nintendo'. If you did get that to work it would be extremely easy to bypass, but hey it's something.

OR possibly setup a virtual AP with a different SSID and have completely different authentication settings?

CuddleChunks
Sep 18, 2004



ManicJason posted:

Question: We use hotspot authentication through a web interface in a couple apartment buildings we provide with wireless. The problem is game consoles. Right now the only way to get them to work is to manually plug in MAC addresses. There has to be a way to get the Mikrotiks to recognize console traffic and let it bypass authentication. I couldn't find any info though.

There is a scripting section to use for the hotspot but as far as I've ever done, I just added folks to the Bypassed section under IP Bindings. Yes, it's manual and tedious but that's what we've done at hotels and spots with Hotspot running.

The official forums may have more help in that regard since loads of folks do crazy things with their hotspot services that we haven't tried.

falz
Jan 29, 2005

01100110 01100001 01101100 01111010


I've just started using my first outdoor Mikrotik, a RB/SXT. Set them up on the roof of some office buildings that are about 3500' apart and they're work quite well thus far. I've had the bandwidth test running for two days now and it's 60mbps TX/RX simultaneously even though some rain over night.

It's 5ghz unlicensed so I could run into interference problems but I just wanted to chime in to say that I'm surprised by the throughput that these can get at such a cheap price (~$90/each). The real test will be getting through a Wisconsin winter.

I'd be curious to hear what type of success any of you have had with any of their equipment outdoors and for longer distances.

Weird Uncle Dave
Sep 2, 2003

I could do this all day.

Buglord

I haven't used that specific unit, but I have a couple dozen backhaul links, that can push 30-40Mbps (depending on band, channel width, whether the climber put up a dual-polarity antenna) over ten miles or more, and one link that gets about 50Mbps over 23 miles (with a little ACK tuning to account for the distance of the link).

Interference in the 5GHz bands rarely is an issue, because there isn't (yet) as much other junk in that band. Everyone has a 2.4 router or a cordless phone, but 5GHz gear seems to be a lot less common. The short distance of your link, combined with a couple decent antennas, should mitigate most of your concerns.

CuddleChunks
Sep 18, 2004



falz - We use RB1xx, RB2xx, RB4xx, RB5xx, RB7xx, RB1000's and probably a few other boards I can't remember. The RB100 series and RB411's are setup with panel antennas in little outdoor cases. For the last several years we've had them in all the nasty weather the West can throw at them and they have held up remarkably well.

It's been a very good fit for us and the extra features they offer has made them extremely powerful for building out our network.

krackpot
Apr 24, 2011


If I want to place an OpenVPN server behind a NAT'd firewall, I just use port mapping to have the RouterOS firewall push all data destined for a certain port to the internal LAN IP (and port) of the OVPN server, right?

I made a new NAT rule:
/ip firewall nat add chain=dstnat dst-port=1194 action=dst-nat protocol=udp to-address=10.0.1.100 to-port=1194

It connects fine, but I can't ping from the connected client to the Mikrotik LAN. And from the Mikrotik LAN I can't ping the OVPN server or the connected client.

Any ideas?

On a 493G with RouterOS 5.6.

NOTinuyasha
Oct 17, 2006

 


The Great Twist

It's probably unrelated to the Mikrotik but it would be helpful if you could post both the client/server config files and the log from both ends.

PuTTY riot
Nov 16, 2002


I've got a pptp VPN set up here at work that I created a few weeks ago. When I connect to the VPN from home, I can browse the internet fine, and my IP shows up as my work's IP. Problem is, I can't see any of the 10.0.1.x stuff. What am I forgetting to do or doing improperly?

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE


Your work has a firewall?

PuTTY riot
Nov 16, 2002


Nitr0 posted:

Your work has a firewall?

the firewall/router/whatever is the mikrotik which is also running the vpn

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE


Nothing silly like overlapping ip ranges?

PuTTY riot
Nov 16, 2002


Nitr0 posted:

Nothing silly like overlapping ip ranges?

I don't think so, originally I setup the Local/Remote addresses under the secrets tab under PPP using 10.0.0.20 and 10.0.0.21, but I changed it to 10.0.1.20 and 10.0.1.21 thinking that might be my issue. Didn't seem to affect anything, still can't ping 10.0.1.99 as a vpn client outside of the office. DHCP could potentially overlap since it's set to 10.0.1.0/24 (which I can change I guess), but i'm looking at leases and they're all in the 10.0.1.100-254 range.


e: would changing it to 10.0.1.0/25 be a good idea? That should keep the range between 10.0.1.128 and 10.0.1.255

e2: 'IP-->Pool' in winbox is the thing keeping the dhcp range between 10.0.1.100-199 I guess

PuTTY riot fucked around with this message at Sep 15, 2011 around 20:54

CuddleChunks
Sep 18, 2004



American Jello posted:

e: would changing it to 10.0.1.0/25 be a good idea? That should keep the range between 10.0.1.128 and 10.0.1.255
Bad idea.

If you do an ipconfig on your vpn-connected computer what IP address do you get? What does it show for the gateway? Can you ping that? Can you ping any of the machines within that subnet (assuming they are pingable)?

Your initial config looks like you're on a different network than the other machines assuming a /24 subnet. Now, with you in the same subnet things should be much better. One curiosity, what's the IP address you have on the machine before bringing up PPTP? I want to make sure you're in a 192.168.x range or something like that so that your computer knows where to send packets.

PuTTY riot
Nov 16, 2002


before connecting to vpn:

after:



I'm assuming it has something to do with the subnet mask being 255.255.255.255.

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE


lol. Are you on telus?

Looks like multiple problems. You have no gateway so that's not going to work. If you're on telus then check this thread

http://www.dslreports.com/forum/r26...-through-Telus.

That thread looks like it fails before gre authentication though so I don't think it's your problem.

Nitr0 fucked around with this message at Sep 15, 2011 around 22:07

PuTTY riot
Nov 16, 2002


Nitr0 posted:

lol. Are you on telus?

Looks like multiple problems. You have no gateway so that's not going to work. If you're on telus then check this thread

http://www.dslreports.com/forum/r26...-through-Telus.

That thread looks like it fails before gre authentication though so I don't think it's your problem.

I'm in the US, uverse at home metro-e AT&T at work. Why is the gateway relevant for LAN traffic and if it wouldn't work why does WAN traffic across the VPN work? I am getting a work ip from home according to whatismyip.com.

CuddleChunks
Sep 18, 2004



I just set this up at home as a test. Follow the instructions in the Mikrotik Wiki and make sure you are in the same network range as your other network devices AND that you setup Proxy-ARP on the ethernet interface hosting those other connections. That's the missing step I needed in order to start talking to machines on my remote LAN.

code:
[admin@RemoteOffice] /interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] /interface ethernet> print
Flags: X - disabled, R - running
  #    NAME                 MTU   MAC-ADDRESS         ARP
  0  R ether1              1500  00:30:4F:0B:7B:C1 enabled
  1  R ether2              1500  00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>
That's pasted from the wiki.

PuTTY riot
Nov 16, 2002


CuddleChunks posted:

I just set this up at home as a test. Follow the instructions in the Mikrotik Wiki and make sure you are in the same network range as your other network devices AND that you setup Proxy-ARP on the ethernet interface hosting those other connections. That's the missing step I needed in order to start talking to machines on my remote LAN.

code:
[admin@RemoteOffice] /interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] /interface ethernet> print
Flags: X - disabled, R - running
  #    NAME                 MTU   MAC-ADDRESS         ARP
  0  R ether1              1500  00:30:4F:0B:7B:C1 enabled
  1  R ether2              1500  00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>
That's pasted from the wiki.

This is exactly what I was missing. It's working like it should now, thanks a bunch.

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE


Just out of curiosity could you do a route print from your windows machine while connected to the vpn.

Nitr0 fucked around with this message at Sep 16, 2011 around 06:03

Adbot
ADBOT LOVES YOU

PuTTY riot
Nov 16, 2002


  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply
«58 »