PinQ | st. Mudo » MikroTik

Mikrotik Two gateways failover

Irving — Thu, 19 Jul 2007 02:44:35 +0000

This example explains how to use multiple gateways with one taking over when first fails. It begins with adding the gateways. Set bigger distance value for the secondary one, and check-gateway for the first one:

/ip route add gateway=192.168.1.1 check-gateway=ping
/ip route add gateway=192.168.2.1 distance=2

That’s all, there are no more steps!

The first gateway will begin as it’s distance is smaller (default 0); the check-gateway will make sure it’s up; when the ping will fail, it will disable the first gateway and the second will take over; when first one comes up, it will return to it’s function.

from wiki dot mikrotik dot com

How to import Mikrotik router configuration

Irving — Mon, 14 May 2007 07:01:45 +0000

The Import Command

Command name: /import

Description

The root level command /import [file_name] restores the exported information from the specified file. This is used to restore configuration or part of it after a /system reset event or anything that causes configuration data loss.

Note that it is impossible to import the whole router configuration using this feature. It can only be used to import a part of configuration (for example, firewall rules) in order to spare you some typing.

Command Description

file=[filename] – loads the exported configuration from a file to router

Example

To load the saved export file use the following command:

[admin@MikroTik] > import address.rsc
Opening script file address.rsc
Script file loaded successfully
[admin@MikroTik] >

(from mikrotik dot com)

How to export Mikrotik router configuration

Irving — Mon, 14 May 2007 06:58:15 +0000

The Export Command

Command name: /export

Description

The export command prints a script that can be used to restore configuration. The command can be invoked at any menu level, and it acts for that menu level and all menu levels below it. If the argument from is used, then it is possible to export only specified items. In this case export does not descend recursively through the command hierarchy. export also has the argument file, which allows you to save the script in a file on the router to retrieve it later via FTP.

Command Description

file=[filename] – saves the export to a filefrom=[number] – specifies from which item to start to generate the export file

Example

[admin@MikroTik] > ip address print
Flags: X – disabled, I – invalid, D – dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 10.1.0.172/24 10.1.0.0 10.1.0.255 bridge1
1 10.5.1.1/24 10.5.1.0 10.5.1.255 ether1
[admin@MikroTik] >

To make an export file:

[admin@MikroTik] ip address> export file=address
[admin@MikroTik] ip address>

To make an export file from only one item:

[admin@MikroTik] ip address> export file=address1 from=1
[admin@MikroTik] ip address>

To see the files stored on the router:

[admin@MikroTik] > file print
# NAME TYPE SIZE CREATION-TIME
0 address.rsc script 315 dec/23/2003 13:21:48
1 address1.rsc script 201 dec/23/2003 13:22:57
[admin@MikroTik] >

To export the setting on the display use the same command without the file argument:

[admin@MikroTik] ip address> export from=0,1
# nov/13/2004 13:25:30 by RouterOS 2.9
# software id = MGJ4-MAN
#
/ ip address
add address=10.1.0.172/24 network=10.1.0.0 broadcast=10.1.0.255 \
interface=bridge1 comment=”" disabled=no
add address=10.5.1.1/24 network=10.5.1.0 broadcast=10.5.1.255 \
interface=ether1 comment=”" disabled=no
[admin@MikroTik] ip address>

(from mikrotik dot com)

Backup & Restore MikroTik Configuration

Irving — Mon, 14 May 2007 06:50:40 +0000

System Backup

Submenu level: /system backup

Description

The save command is used to store the entire router configuration in a backup file. The file is shown in the /file submenu. It can be downloaded via ftp to keep it as a backup for your configuration.

To restore the system configuration, for example, after a /system reset, it is possible to upload that file via ftp and load that backup file using load command in /system backup submenu.

Command Description

load name=[filename] – Load configuration backup from a file

save name=[filename] – Save configuration backup to a file

Example

To save the router configuration to file test:

[admin@MikroTik] system backup> save name=test
Configuration backup saved
[admin@MikroTik] system backup>

To see the files stored on the router:

[admin@MikroTik] > file print
# NAME TYPE SIZE CREATION-TIME
0 test.backup backup 12567 sep/08/2004 21:07:50
[admin@MikroTik] >

Example

To load the saved backup file test:

[admin@MikroTik] system backup> load name=test
Restore and reboot? [y/N]: y
…

(from mikrotik dot com)

Resetting Your Mikrotik RouterOS

Irving — Mon, 14 May 2007 06:36:58 +0000

Configuration Reset

Command name: /system reset

Description

The command clears all configuration of the router and sets it to the default including the login name and password (’admin’ and no password), IP addresses and other configuration is erased, interfaces will become disabled. After the reset command router will reboot.

Command Description

reset – erases router’s configuration

Notes

If the router has been installed using netinstall and had a script specified as the initial configuration, the reset command executes this script after purging the configuration. To stop it doing so, you will have to reinstall the router.

[admin@MikroTik] > system reset
Dangerous! Reset anyway? [y/N]: n
action cancelled
[admin@MikroTik] >

(from mikrotik dot com)

Transparent Traffic Shaper

Irving — Thu, 19 Apr 2007 03:44:43 +0000

Introduction

This example shows how to configure a transparent traffic shaper. The transparent traffic shaper is essentially a bridge that is able to differentiate and prioritize traffic that passes through it.

Consider the following network layout:

We will configure one queue limiting the total throughput to the client and three sub-queues that limit HTTP, P2P and all other traffic separately. HTTP traffic will have priority above all other traffic types.

Quick Start for Impatient

Configuration snippet from the MikroTik router:
/ interface bridge
add name=”bridge1″
/ interface bridge port
add interface=ether2 bridge=bridge1
add interface=ether3 bridge=bridge1

/ ip firewall mangle
add chain=prerouting protocol=tcp dst-port=80 action=mark-connection \
new-connection-mark=http_conn passthrough=yes
add chain=prerouting connection-mark=http_conn action=mark-packet \
new-packet-mark=http passthrough=no
add chain=prerouting p2p=all-p2p action=mark-connection \
new-connection-mark=p2p_conn passthrough=yes
add chain=prerouting connection-mark=p2p_conn action=mark-packet \
new-packet-mark=p2p passthrough=no
add chain=prerouting action=mark-connection new-connection-mark=other_conn \
passthrough=yes
add chain=prerouting connection-mark=other_conn action=mark-packet \
new-packet-mark=other passthrough=no

/ queue simple
add name=”main” target-addresses=10.0.0.12/32 max-limit=256000/512000
add name=”http” parent=main packet-marks=http max-limit=240000/500000
add name=”p2p” parent=main packet-marks=p2p max-limit=64000/64000
add name=”other” parent=main packet-marks=other max-limit=128000/128000

Explanation
Each piece of code is followed by the explanation of what it actually does.

Bridge

/ interface bridge
add name=”bridge1″
/ interface bridge port
add interface=ether2 bridge=bridge1
add interface=ether3 bridge=bridge1

We create a new bridge interface and assign two ethernet interfaces to it. Thus the prospective traffic shaper will be completely transparent to the client.

Mangle

All traffic destined to TCP port 80 is likely to be HTTP traffic and therefore is being marked with the packet mark http. Note, that the first rule has passthrough=yes while the second one has passthrough=no. (You can obtain additional information about mangle at http://www.mikrotik.com/docs/ros/2.9/ip/mangle)

/ ip firewall mangle
add chain=prerouting p2p=all-p2p action=mark-connection \
new-connection-mark=p2p_conn passthrough=yes
add chain=prerouting connection-mark=p2p_conn action=mark-packet \
new-packet-mark=p2p passthrough=no
add chain=prerouting action=mark-connection new-connection-mark=other_conn \
passthrough=yes
add chain=prerouting connection-mark=other_conn action=mark-packet \
new-packet-mark=other passthrough=no

Same as above, P2P traffic is marked with the packet mark p2p and all other traffic is marked with the packet mark other.

Queues

/ queue simple
add name=”main” target-addresses=10.0.0.12/32 max-limit=256000/512000

We create a queue that limits all the traffic going to/from the client (specified by the target-address) to 256k/512k.

/ queue simple
add name=”http” parent=main packet-marks=http max-limit=240000/500000
add name=”p2p” parent=main packet-marks=p2p max-limit=64000/64000
add name=”other” parent=main packet-marks=other max-limit=128000/128000

All sub-queues have the main queue as the parent, thus the aggregate data rate could not exceed limits specified in the main queue. Note, that http queue has higher priority than other queues, meaning that HTTP downloads are prioritized.

(–Eugene Mikrotik wiki)

How to make a Mikrotik HotSpot gateway

Irving — Thu, 19 Apr 2007 03:35:58 +0000

The MikroTik HotSpot Gateway enables providing of public network access for clients using wireless or wired network connections. HotSpot Gateway should have at least two network interfaces:

1. HotSpot interface, which is used to connect HotSpot clients

2. LAN/WAN interface, which is used to access network resources.

The following picture shows wireless HotSpot setup

To setup simple HotSpot Gateway follow the steps below:

1. Configure wireless interface on HotSpot Gateway:

[admin@HotSpot_Gateway]> interface wireless set wlan1 ssid=HotSpot band=2.4ghz-b \ … mode=ap-bridge

2. Configure ip address for HotSpot interface:

[admin@HotSpot_Gateway] > ip add add address=192.168.0.1/24 interface=wlan1

3. Configure ip address for WAN/LAN interface:

[admin@HotSpot_Gateway] > ip add add address=10.5.8.250/24 interface=ether1

4. Add a route on HotSpot Gateway

[admin@HotSpot_Gateway] > ip route add gateway=10.5.8.1

5. Configure Hotspot on wlan1 interface and add user admin with pasword test

[admin@MikroTik] > ip hotspot setup
hotspot interface: wlan1
local address of network: 192.168.0.1/24
masquerade network: yes
address pool of network: 192.168.0.2-192.168.0.254
select certificate: none
ip address of smtp server: 0.0.0.0
dns servers: 10.5.8.2
dns name: hs.example.net
name of local hotspot user: admin
password for the user: test

In order to access network resources HotSpot clients have to configure their wireless interfaces setting proper ssid, band and mode, and enabling dynamic host configuration (dhcp) on the wireless interface.

(mikrotik wiki)

Setup DHCP Server di Mikrotik

Irving — Wed, 18 Apr 2007 12:50:47 +0000

1.Buat IP address pool

/ip pool add name=dhcp-pool ranges=172.16.0.10-172.16.0.20

2. Tambahkan DHCP Network dan gatewaynya yang akan didistribusikan ke client

Pada contoh ini networknya adalah 172.16.0.0/24 dan gatewaynya 172.16.0.1

/ip dhcp-server network add address=172.16.0.0/12 gateway=172.16.0.1

3. Tambahkan DHCP Server ( pada contoh ini dhcp diterapkan pada interface ether2 )

/ip dhcp-server add interface=ether2 address-pool=dhcp-pool

4. Jangan Lupa dibuat enable dulu dhcp servernya

/ip dhcp-server enable 0

5. Tes Dari client

(from internet)

Redirect Mail traffic to a specified Mail Server

Irving — Tue, 17 Apr 2007 04:07:54 +0000

This is if you want to redirect all traffic through your router to your own specified mail server. This is usefull if you have many clients from different locations connecting to your network at different times. (Note that if you are using Hotspot you can do this in the Hotspot settings instead)

ip firewall nat add chain=dstnat protocol=tcp dst-port=25 action=dst-nat to-addresses=10.0.0.1 to-ports=25

This will redirect all smtp (port 25) traffic out the router to ip address 10.0.0.1

(mikrotik wiki)

Setting Mikrotik Wireless Bridge

Irving — Sat, 14 Apr 2007 02:56:02 +0000

Sering kali, kita ingin menggunakan Mikrotik Wireless untuk solusi point to point dengan mode jaringan bridge (bukan routing). Namun, Mikrotik RouterOS sendiri didesain bekerja dengan sangat baik pada mode routing. Kita perlu melakukan beberapa hal supaya link wireless kita bisa bekerja untuk mode bridge.Mode bridge memungkinkan network yang satu tergabung dengan network di sisi satunya secara transparan, tanpa perlu melalui routing, sehingga mesin yang ada di network yang satu bisa memiliki IP Address yang berada dalam 1 subnet yang sama dengan sisi lainnya.

Namun, jika jaringan wireless kita sudah cukup besar, mode bridge ini akan membuat traffic wireless meningkat, mengingat akan ada banyak traffic broadcast dari network yang satu ke network lainnya. Untuk jaringan yang sudah cukup besar, saya menyarankan penggunaan mode routing.

Berikut ini adalah diagram network yang akan kita set.

Konfigurasi Pada Access Point

1. Buatlah sebuah interface bridge yang baru, berilah nama bridge1

2. Masukkan ethernet ke dalam interface bridge

3. Masukkan IP Address pada interface bridge1

4. Selanjutnya adalah setting wireless interface. Kliklah pada menu Wireless (1), pilihlah tab interface (2) lalu double click pada nama interface wireless yang akan digunakan (3). Pilihlah mode AP-bridge (4), tentukanlah ssid (5), band 2.4GHz-B/G (6), dan frekuensi yang akan digunakan (7). Jangan lupa mengaktifkan default authenticated (8) dan default forward (9). Lalu aktifkankanlah interface wireless (10) dan klik OK (11).

5. Berikutnya adalah konfigurasi WDS pada wireless interface yang digunakan. Bukalah kembali konfigurasi wireless seperti langkah di atas, pilihlah tab WDS (1). Tentukanlah WDS Mode dynamic (2) dan pilihlah bridge interface untuk WDS ini (3). Lalu tekan tombol OK.

6. Langkah selanjutnya adalah menambahkan virtual interface WDS. Tambahkan interface WDS baru seperti pada gambar, lalu pilihlah interface wireless yang kita gunakan untuk WDS ini. Lalu tekan OK.

7. Jika WDS telah ditambahkan, maka akan tampak interface WDS baru seperti pada gambar di bawah.

Konfigurasi pada Wireless Station

Konfigurasi pada wireless station hampir sama dengan langkah-langkah di atas, kecuali pada langkah memasukkan IP Address dan konfigurasi wirelessnya. Pada konfigurasi station, mode yang digunakan adalah station-wds, frekuensi tidak perlu ditentukan, namun harus menentukan scan-list di mana frekuensi pada access point masuk dalam scan list ini. Misalnya pada access point kita menentukan frekuensi 2412, maka tuliskanlah scan-list 2400-2500.

Pengecekan link

Jika link wireless yang kita buat sudah bekerja dengan baik, maka pada menu wireless, akan muncul status R (lihat gambar di bawah).

Selain itu, mac-address dari wireless yang terkoneksi juga bisa dilihat pada jendela registration (lihat gambar di bawah).

Konfigurasi keamanan jaringan wireless

Pada Mikrotik, cara paling mudah untuk menjaga keamanan jaringan adalah dengan mendaftarkan mac-address wireless pasangan pada access list. Hal ini harus dilakukan pada sisi access point maupun pada sisi client. Jika penginputan access-list telah dilakukan, maka matikanlah fitur default authenticated pada wireless, maka wireless lain yang mac addressnya tidak terdaftar tidak akan bisa terkoneksi ke jaringan kita.

Jika kita menginginkan fitur keamanan yang lebih baik, kita juga bisa menggunakan enkripsi baik WEP maupun WPA.

(www.mikrotik.co.id)