الأربعاء، 18 سبتمبر 2013
الاثنين، 9 سبتمبر 2013
امر المايكروتك لاضافة جميع الاسماء في السيرفر القديم الي الجديد بدون عناء او تعب
دلوقتي انا عندي سيرفرين مايكروتك 2.9 وعايز ابدل السيرفرين ببعض فانا قبل
ما انقلهم عرفت ان فيه امر بادخله للقايمة يطلع كل بيانات المشتركين الي
عندي وبعد كده ادخل امر تاني يضيف كل المشتركين
بس المشكلة اني مش عارف الاوامر دي يريت حد يعرفهملي لأني محتجهم جدا
ip hotspot user profile export
ip hotspot user profile export
ip hotspot user export
او تختصر وتجيب كله
ip hotspot export
بس المشكلة اني مش عارف الاوامر دي يريت حد يعرفهملي لأني محتجهم جدا
ip hotspot user profile export
ip hotspot user profile export
ip hotspot user export
او تختصر وتجيب كله
ip hotspot export
أوامر الميكروتيك - تعامل مع الميكروتيك بلغة الكتابة مثل الدوس
السلام عليكم ورحمة الله وبركاته
النهاردة معانا حاجات مش جديدة بس مهمة للبعض وخاصة المبتدئين فى الميكروتيك أمثالى
اللى خلانى فكرت فى الموضوع ده هو انى عايز اجمع اكبر عدد من الاوامر المعروفة للميكروتيك والاكواد طبعا الكثير يعرفها وناس متعرفاش فعايزين الموضوع ده يكون فيه كل الاوامر والاكواد الخاصة بالميكروتيك
وانا هابدا بكام كود وامر كده ومستنى منكم المزيد
المهم عايزينه موضوع شامل ومفيد
********************
إليكم الاوامر والكواد
1-عمل ريسيت او ضبط مصنع
sys reset أو system reset
2-إعادة التشغيل
sys reboot أو system reboot
3-إغلاق السيرفر
sys shutdown أو system shutdown
4-عمل باك اب او نسخة احتياطية من اليوزرز والبروفايلز
ip hotspot user export
5-ضبط الساعة اتوماتيك بعد اعادة التشغيل
/system ntp client set enabled=yes mode=unicast primary-ntp=192.43.244.18 secondary-ntp=0.0.0.0 /system clock set time-zone-name=Africa/Cairo
6-عمل بيكب من الادريسس
ip address export
7-الأمر export يستخدم لاخذ بيكب من معظم الحاجات وعلى ما اعتقد انهم بيستخدموه لاخذ الرولات والاكواد من السيرفر
*****************
بكده اكون شاركت باللى اعرفه مستنى منكم المزيد واتمنى من الموضوع يقدم ولو معلومة لمحتاج
النهاردة معانا حاجات مش جديدة بس مهمة للبعض وخاصة المبتدئين فى الميكروتيك أمثالى
اللى خلانى فكرت فى الموضوع ده هو انى عايز اجمع اكبر عدد من الاوامر المعروفة للميكروتيك والاكواد طبعا الكثير يعرفها وناس متعرفاش فعايزين الموضوع ده يكون فيه كل الاوامر والاكواد الخاصة بالميكروتيك
وانا هابدا بكام كود وامر كده ومستنى منكم المزيد
المهم عايزينه موضوع شامل ومفيد
********************
إليكم الاوامر والكواد
1-عمل ريسيت او ضبط مصنع
sys reset أو system reset
2-إعادة التشغيل
sys reboot أو system reboot
3-إغلاق السيرفر
sys shutdown أو system shutdown
4-عمل باك اب او نسخة احتياطية من اليوزرز والبروفايلز
ip hotspot user export
5-ضبط الساعة اتوماتيك بعد اعادة التشغيل
/system ntp client set enabled=yes mode=unicast primary-ntp=192.43.244.18 secondary-ntp=0.0.0.0 /system clock set time-zone-name=Africa/Cairo
6-عمل بيكب من الادريسس
ip address export
7-الأمر export يستخدم لاخذ بيكب من معظم الحاجات وعلى ما اعتقد انهم بيستخدموه لاخذ الرولات والاكواد من السيرفر
*****************
بكده اكون شاركت باللى اعرفه مستنى منكم المزيد واتمنى من الموضوع يقدم ولو معلومة لمحتاج
الأحد، 8 سبتمبر 2013
كيفة زيادة سرعة التصفح في المايكروتك
اخي الفاضل يمكنك زيادة سرعة التصفح بعدة طرق لمشاهدة المزيد من هنا كيفة زيادة سرعة التصفح في المايكروتك
الاولى هي كما قرأتها في هذا المنتدى وهي استخدام سكريبت يقوم بفصل الدونلود عن التصفح بحيث انك تحدد سرعة الدونلود وتترك سرعة التصفح مفتوحة او على سرعات عالية محددة وهذا الموضوع يمكنك ان تجده في المواضيع المثبتة ويمكنك ان ترجع الى اصحاب الخبرة فيه لاني مجرد قرأت الموضوع وليس لي خبرة فيه
الثانية انه عند تحديد السرعة للعميل يجب ان تحدد له ايضا شئ اسمه BURST (بيرست) والبيرست عبارة عن سرعة عالية لفترة زمنية قصيرة فمثلا عندما تفتح صفحة معينة تكون السرعة ا ميجا لمدة اربع ثواني مثلا ثم تنخفض بعد ذلك الى السرعة العادية المحددة له اما كيف تقوم بتحديد البيرست فهو كما يلي وانا استخدم هنا هوت سبوت :
اذهب الى hotspot userprofile Rate limit (rx/tx) وادخل ما يشبه الارقام التالية وهي التي استخدمها انا للمشتركين بسرعة 512 كيلوبت
Rate limit(tx/rx) : 64k/512k 96k/1M 32k/300k 8/8 8 16k/64k
الرقم باللون الاخضر هو سرعة التحميل والتنزيل اي 512كيلو داونلود و 6كيلو ابلود
الرقم باللونالاحمر هو سرعة البيرست تحميل ا ميجا وتنزيل 96كيلو وكما قلت هذه السرعة تحدث عند بداية اي كونكشن لفترة زمينة قيصرة
الرقم باللون البرتقالي معناه ان سرعة الداونلود اذا قلت عن 300 كيلو فان البيرست سيشتغل وترتفع السرعة اي ان هذا الرقم كانه مفتاح لتشغيل البيرست وتعطيله بحيث اذا زادت السرعة عن 300كيلو لفترة زمنية محدد يتوقف البيرست
اما الرقم باللون الازرق معناه انه يستخدم 8 ثواني لحساب سرعة المشترك
اما الرقم باللون الزهري وهو 8 فانه يعبر عن الفترة الزمنية التي سيشتغل بها البيرست وهي هنا 8 ثواني
اما الرقم الاخير من اليمني باللون البنفسجي فانه يعبر عن اقل سرعة مضمونة يجب ان تصل المشترك
فعندما يفتح العميل صفحة فان السرعة اول ثماني ثواني تكون ا ميجا وبعدها تنزل الى 512 كيلو وهذا الزمن كافي لتفتح اي صفحة تقريبا وهذا الامر يتكرر عند فتح اي صفحة اخرى
اما في حالة الداونلود فان سرعة الدونلود ستكون ا ميجا اول 8 ثواني وبعدها يستمر الدونلود على سرعة 512 كيلو حتى ينتهي
وبهذا اخي تستطيع ان ترفع سرعة التصفح بطريقة سهلة
كما انه يمكنك ان تضع السرعات التي تريدها وذلك حسب سرعة خطك وبما يناسبك
وهذه روابط ذات صلة بالموضوع موجدة في موفع ميكروتيك الرسمي
http://wiki.mikrotik.com/wiki/Manual:Queues_-_Burst
http://wiki.mikrotik.com/wiki/Hotspo...fic_priorities
الاولى هي كما قرأتها في هذا المنتدى وهي استخدام سكريبت يقوم بفصل الدونلود عن التصفح بحيث انك تحدد سرعة الدونلود وتترك سرعة التصفح مفتوحة او على سرعات عالية محددة وهذا الموضوع يمكنك ان تجده في المواضيع المثبتة ويمكنك ان ترجع الى اصحاب الخبرة فيه لاني مجرد قرأت الموضوع وليس لي خبرة فيه
الثانية انه عند تحديد السرعة للعميل يجب ان تحدد له ايضا شئ اسمه BURST (بيرست) والبيرست عبارة عن سرعة عالية لفترة زمنية قصيرة فمثلا عندما تفتح صفحة معينة تكون السرعة ا ميجا لمدة اربع ثواني مثلا ثم تنخفض بعد ذلك الى السرعة العادية المحددة له اما كيف تقوم بتحديد البيرست فهو كما يلي وانا استخدم هنا هوت سبوت :
اذهب الى hotspot userprofile Rate limit (rx/tx) وادخل ما يشبه الارقام التالية وهي التي استخدمها انا للمشتركين بسرعة 512 كيلوبت
Rate limit(tx/rx) : 64k/512k 96k/1M 32k/300k 8/8 8 16k/64k
الرقم باللون الاخضر هو سرعة التحميل والتنزيل اي 512كيلو داونلود و 6كيلو ابلود
الرقم باللونالاحمر هو سرعة البيرست تحميل ا ميجا وتنزيل 96كيلو وكما قلت هذه السرعة تحدث عند بداية اي كونكشن لفترة زمينة قيصرة
الرقم باللون البرتقالي معناه ان سرعة الداونلود اذا قلت عن 300 كيلو فان البيرست سيشتغل وترتفع السرعة اي ان هذا الرقم كانه مفتاح لتشغيل البيرست وتعطيله بحيث اذا زادت السرعة عن 300كيلو لفترة زمنية محدد يتوقف البيرست
اما الرقم باللون الازرق معناه انه يستخدم 8 ثواني لحساب سرعة المشترك
اما الرقم باللون الزهري وهو 8 فانه يعبر عن الفترة الزمنية التي سيشتغل بها البيرست وهي هنا 8 ثواني
اما الرقم الاخير من اليمني باللون البنفسجي فانه يعبر عن اقل سرعة مضمونة يجب ان تصل المشترك
فعندما يفتح العميل صفحة فان السرعة اول ثماني ثواني تكون ا ميجا وبعدها تنزل الى 512 كيلو وهذا الزمن كافي لتفتح اي صفحة تقريبا وهذا الامر يتكرر عند فتح اي صفحة اخرى
اما في حالة الداونلود فان سرعة الدونلود ستكون ا ميجا اول 8 ثواني وبعدها يستمر الدونلود على سرعة 512 كيلو حتى ينتهي
وبهذا اخي تستطيع ان ترفع سرعة التصفح بطريقة سهلة
كما انه يمكنك ان تضع السرعات التي تريدها وذلك حسب سرعة خطك وبما يناسبك
وهذه روابط ذات صلة بالموضوع موجدة في موفع ميكروتيك الرسمي
http://wiki.mikrotik.com/wiki/Manual:Queues_-_Burst
http://wiki.mikrotik.com/wiki/Hotspo...fic_priorities
طريقه لزياده سرعه التصفح بنسبه 40%
بصو يا جماعه دى طريقه لزياده سرعه التصفح بنسبه معقوله يعنى للناس الى بتعاننى من بطىء التصفح
افتح ip===firewal===layer7
و اعمل نيو رول +
وبعدين حط الاسكربت ده وسميه pic
وبعيدنن كوبى وباسط للرول دهكود PHP:^.*(get|GET).+(jpg|png|swf|gif|ico).*$
وكوبى وباست للاسكربت ده كمانكود PHP:ip firewall mangle
add action=mark-connection chain=prerouting comment=pic disabled=no layer7-protocol=pic new-connection-mark=pic passthrough=yes protocol=tcp
add action=mark-packet chain=postrouting comment="" connection-mark=pic disabled=no new-packet-mark=pic passthrough=no protocol=tcp
بس وكده هتحس بتغير فى السرعه ملحوظكود PHP:queue tree
add burst-limit=0 burst-threshold=0 burst-time=0s disabled=no limit-at=0 max-limit=0 name=pic packet-mark=pic parent=global-out priority=8 queue=default
الموضوع ياجماعه منقول من واحد محترم جدا بس انا حبيبت انى زى ماستفدت الناس تستفيد
الجمعة، 6 سبتمبر 2013
Firefox 21.0 Beta 4
اهم البرامج لجهاز الكمبيوتر بروابط مباشرة 2013
Firefox 21.0 Beta 4
متصفح فيرفوكس اصدار 21
الحجم 21 ميجا رابط مباشر
اللغة انجلش
تحميل من هنااا
للغة العربية
تحميل من هناا
Skype 6.3.0.105
اهم البرامج لجهاز الكمبيوتر بروابط مباشرة 2013
Skype 6.3.0.105
برنامج شان سكايبي
حجم البرنامج
2 ميجا
تحميل من هناا
NET Framework
هم البرامج لجهاز الكمبيوتر بروابط مباشرة 2013
NET Framework
برنامج هام لتشغيل ملفات النظام
نسخة رقم 4
حجم البرنامج 48 ميجا
تحميل من هناا
10. Flash Player 11.7.700.169 (IE
اهم البرامج لجهاز الكمبيوتر بروابط مباشرة 2013
10. Flash Player 11.7.700.169 (IE
برنامج مشغل ملفات الفلاش فديو
حجم البرنامج 16 ميجا
تحميل من هنااا
internetdownloadmanager
اهم البرامج لجهاز الكمبيوتر بروابط مباشرة 2013
internetdownloadmanager
برنامج التحميل الشهير انترنت دونلود منجر
نسخة كاملة لا تحتاج تسجيل او كراك
حجم البرنامج 5 ميجا
تحميل من هنااا
طرق تسريع الانترنت عن طريق الرجسيري الي اقصي سرعة
طرق تسريع الانترنت عن طريق الرجسيري الي اقصي سرعة
Posted: Sat, 27 Jul 2013 12:40:00 +0000
طرق تسريع الانترنت عن طريق الرجسيري الي اقصي سرعة
و التى ملأت صفحات المنتديات والمواقع ...لقد قمت بتجربة 12 برنامج والنتائج تكاد تكون معدومة
ولعلم حضراتكم أن هذه الطرق كانت لدى منذ زمن ولكننى تجاهلت تجربتها إلا أننى قررت تجربتها
أخيرا لتجبرنى نتائجها أن اكتب هذا الموضوع...وانا على علم أن هذه الطرق متداولة منذ زمن على
صفحات النت ولكن بشكل متناثر كما لم تاخذ حقها فى الشرح وها أنا أعيد كتابتها لكم بشكل منظم
وبشرح مدعوم بالصور من مجهودى الشخصى داعيا المولى عز وجل أن ينال هذا المجهود رضاكم
والأهم أن تصلوا لنفس النتائج التى وصلت إليها إن شاء الله
نبدأ على بركة الله
الطريقة الأولى
1 - من قائمة ابدأ STRTاختر تشغيل RUN و اكتب Regedit ثم OK
واذهب الى التالي:
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Explorer
RemoteComputer
NameSpace
وهذا المجلد الأخير تجد أسفله مجلدين فقم بحذف المجلد التالى
{D6277990-4C6A-11CF-8D87-00AA0060F5BF}
احذفه وذلك بالضغط عليه بالزر الأيمن للفأرة واختيار Delete.
ستلاحظ سرعة في التصفح.
والسؤالهنا والذي يجب على الجميع أن يسأله : لماذا صار المتصفح أسرع ؟والجواب هو : لأن هذا الريجستري يوجه المتصفح للبحث عن ملفات مشتركة هي :
shared (remote) folders/files
والتي تكون موجودة في الشبكة مما يؤدي الى بطء المتصفح , وبازالتها من الرجستري يصبح المتصفح أسرعوالجديربالذكر في هذه الطريقة البسيطةوالفعالة :
1- أنه يمكن تطبيقها على كل اصدارات الويندوز وعلى كل المتصفحات
2- أنه عند ترقية المتصفح قد تعود هذه القيمة الى الريجستري مرة أخرى لذلك قم بحذفها مرة ثانية بعد الترقية .
وإليكم الشرح بالصور
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 598x405 .
قم بإعادة التشغيل
الطريقة الثانية
2- من قائمة ابدأ STRTاختر تشغيل RUN و اكتب gpedit.msc ثم OK.من) local computer policy النهج الكمبيوتر المحلي)
اذهب الى) administrative templates قوالب الإدارة)
ثم الى network ثم اضغط على QoS Packet Scheduler
ومن النافذة المقابلة انقر مرتين على limit reservable bandwidth
و اخترتمكين enabled
ومن Bandwidth limit % غير الرقم من 20 الى 0 ثم موافق و أعد تشغيلالجهاز
وها هو الشرح بالصور
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 597x473 .
ستظهر النافذة التالية طبق مابها من شرح
لا تنسى إعادة التشغيل
الطريقة الثالثة
3- إنشاء مستند جديد من نوع Text ********و كتابة الأسطرالتالية:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Dnscache\Parameters] "CacheHashTableBucketSize"=dword:00000001
"CacheHashTableSize"=dword:00000180
"MaxCacheEntryTtlLimit"=dword:0000fa00
"MaxSOACacheEntryTtlLimit"=dword:0000012d
ثم حفظ الملف باسم : dnscache.reg
بعد حفظ الملف دبل كليك عليه ثم اضغط موافق عند ظهور رسالة تبلغك بإضافة الملف الى سجل النظام ثم ok.
ثم قم بإعادة الشغل
وإليكم رابط تحميل ملف الريجسترى لمن لم يستطع انشائه
الطريقة الرابعة1- إبداء-->تشغيل--> إكتب REGEDIT -->موافق
2- من القائمة إختر HKEY_CURRENT_USER
3- ثم إختر Software
4- من أسفلها إختر Microsoft
ثم Windows
ثم Current Version
أسفلها كلك على Internet Settings
5- من النافذة المقابلة دبل كلك على كل من المفتاحين
MaxConnectionsPer1_0Server
و MaxConnectionsPerServer
وغير بيانات القيمة لكليهما لـ10
وهنا الشرح بالصور
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
غير قيمة كل مفتاح إلى 10 كما يلى
وقم بإعادة التشغيل
الطريقة الخامسة
أدخل الى ابدا --> تشغيل
واكتب system.ini
ستفتح لك مفكره
وهذا شكلها قبل التعديل
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
الان نضيف اليها بعض الاسطر
أولا
قم بالتغيير الارقام 386 بالارقام 30000
ومباشرة تكتب اسفلها هذين السطرين
LoadLocalHigh=1
ConservativeSwaPfileUsage=1ثانيا
وفي اخر سطر تضع هذا ولا تترك اي فراغ
page buffer=100000kbps
load=100000kbps
Download=100000kbps
save=100000kbps
back=100000kbps
بعد ذلك اذهب الى
ملف
حفظ
ثم اغلق الصفحه
و اعمل ريستارت
وهذا الشكل النهائي
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 600x404 .
قم بإعادة التشغيل
ولو انك صاحب المودم اقرأ ما يلى
-أجعل المودم لديك يتصل بسرعة أعلى
أذهب الى أبدا -- لوحة التحكم -- وقمبالنقر مرتين على المودم -- ثم أختار خصائص وأذّهب الى الأتصال -- ثم أختار خياراتمتقدمة -- ثم قم بأضافة السطر التالي في مربع الأعداداتالأضافية
s11=40
والرقم 40 يشير الى سرعة الاتصال بالتون Tone بالملي ثانيةاي الوقت بين كل دقة وأخرى وهذا التعديل سيجعل جهازك يتصل بالسبع ارقام وكأنها رقمواحد من سرعته وبعض اجهزة المودم لا تدعم السرعة العالية فيمكنك زيادة عدد المليثانية لكي تحصل على النتيجة المرجوة
والان مع علاج فعال لمشكلة انقطاع الاتصال بالنت
اذهب الى سجل النظام و ذلك من ابدأ ثم تشغيل ثم كتابة regedit ثم اضغط OKموافق
اذهب إلى
HKEY_LOCAL_MACHINE\System\CurrectControlSet\Servic es\Tcpip\Parameters
اضغط على أيكونة أخر مجلد أو اسمه وفى النافذة المقابلة قم بتغيير قيمة المفتاح التالي من 240 الى 30 :
TcpTimedWaitDelay
اذا لم تجد المفتاح السابق فقم بإنشائه و هو من النوع DWORD Value
و لإنشائه :
كليك يمين فى أى مكان فاضى بالنافذة فتظهر كلمة New واختار من القائمة
DWORD Value
أو من شريط القائمة اذهب الى Edit ثم New ثم DWORD Value
و قم بتسميته TcpTimedWaitDelay و أعطه القيمة 30
وأليكم الشرح بالصور
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 604x402 .
تظهر النافذة التالية ضع القيمة 30
وإذا لم تجد هذا المفتاح قم أولا بنسخ الاسم من أعلى ثم كليك يمين فى أى مكان فاضى بالنافذة ثم New
وتابع كما بالصورة التالية
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 597x405 .
بعدما يظهر مفتاح جديد قم بلصق اسم المفتاح الذى نسخته كما يلى:
هذه الصورة تم تصغيرها . إضغط على هذا الشريط لرؤية الصورة بحجمها الطبيعي . أبعاد الصورة الأصلية 609x401 .
الجمعة، 9 أغسطس 2013
MikroTik RouterOS Training
MikroTik RouterOS Training
Advanced Class
© Ufoakses 2008
Routing
Simple Routing, ECMP, OSPF, Policy
Routing,
© Ufoakses 2008 1
Simple Static Route
Only one gateway for
a single network
More specific routes
in the routing table
have higher priority
than less specific
Route with destination
network 0.0.0.0/0
basically means
“everything else”
© Ufoakses 2008 2
Simple Routing Lab
Ask teacher to join you in a group of 4 and
assign specific group number “Z”
Use any means necessary (cables, wireless) to
create IP network structure from the next slide
Remove any NAT (masquerade) rules from your
routers
By using simple static routes only ensure
connectivity between laptops, and gain access
to the internet.
© Ufoakses 2008 3
IP Network Structure
192.168.Z.192/26
192.168.Z.64/26
192.168.Z.128/26
192.168.Z.0/26
10.1.Z.0/30
To Main AP
To Laptop To Laptop
To Laptop
To Laptop
Z – your group number
© Ufoakses 2008 4
ECMP Routes
ECMP (Equal Cost
Multi Path) routes
have more than one
gateway to the same
remote network
Gateways will be
used in Round Robin
per SRC/DST
address combination
© Ufoakses 2008 5
“Check-gateway” option
It is possible to force router to check gateway
reachability using ICMP (ping) or ARP protocols
If gateway is unreachable in a simple route –
the route will become inactive
If one gateway is unreachable in an ECMP
route, only the reachable gateways will be used
in the Round Robin algorithm
© Ufoakses 2008 6
“Distance” option
It is possible to prioritize one route over another
if they both point to the same network using
“distance” option.
When forwarding a packet, the router will use
the route with the lowest distance and
reachable gateway
© Ufoakses 2008 7
ECMP Routing Lab
Remake your previously created routes, so that
there are two gateways to each of the other
participant's local networks 192.168.XY.0/24
and to the Internet
Also ensure that “backup link” (next slide) will
be used only when all other ways are not
accessible
© Ufoakses 2008 8
Advanced Routing
To Main AP
To Laptop
To Laptop
To Laptop
To Laptop
BACKUP
LINK
© Ufoakses 2008
Open Shortest Path First
(OSPF)
Areas, Costs, Virtual links,
Route Redistribution and Aggregation
© Ufoakses 2008 10
OSPF Protocol
Open Shortest Path First protocol uses a
link-state and Dijkstra algorithm to build and
calculate the shortest path to all known
destination networks
OSPF routers use IP protocol 89 for
communication with each other
OSPF distributes routing information between the
router
s
belonging to a single autonomous system (AS)
© Ufoakses 2008 11
Autonomous System (AS)
An autonomous system is a collection of IP
networks and routers under the control of one
entity (OSPF, iBGP ,RIP) that presents a
common routing policy to rest of the network
AS is identified by 16 bit number (0 - 65535)
Range from 1 to 64511 for use in the Internet
Range from 64512 to 65535 for private use
© Ufoakses 2008 12
OSPF Areas
OSPF allows collections of routers to be
grouped together (<80 routers in one group)
The structure of an area is invisible from the
outside of the area.
Each area runs a separate copy of the basic
link-state routing algorithm
OSPF areas are identified by
32
-
bit (4-byte) number (0.0.0.0 – 255.255.255.255)
Area ID must be unique within the AS
© Ufoakses 2008 13
OSPF AS
Area Area
Area Area
© Ufoakses 2008 14
Router Types
Autonomous System Border Router (ASBR) - a
router that is connected to more than one AS.
An ASBR is used to distribute routes received from
other ASes throughout its own AS
Area Border Router (ABR) - a router that is
connected to more than one OSPF area.
An ABR keeps multiple copies of the link-state
database in memory, one for each area
Internal Router (IR) – a router that is connected
only to one area
© Ufoakses 2008 15
Area Area
Area Area
ABR
ASBR
ABR
ASBR
ABR
OSPF AS
© Ufoakses 2008 16
Backbone Area
The backbone area (area-id=0.0.0.0) forms the
core of an OSPF network
The backbone is responsible for distributing
routing information between non-backbone
areas
Each non-backbone area must be connected to
the backbone area (directly or using virtual
links)
© Ufoakses 2008 17
Virtual Links
Also Used to connect two parts of a partitioned
backbone area through a non-backbone area
Used to connect
remote areas to
the backbone
area through a
non-backbone
area
© Ufoakses 2008 18
Virtual Link
ASBR
area-id=0.0.0.1
area-id=0.0.0.0
area-id=0.0.0.2 area-id=0.0.0.3
OSPF AS
© Ufoakses 2008 19
OSPF Areas
© Ufoakses 2008 20
OSPF Networks
You should use exact networks from router
interfaces (do not aggregate them)
It is necessary
to specify
networks and
associated
areas where to
look for other
OSPF routers
© Ufoakses 2008 21
OSPF Neighbour States
Full: link state
databases
completely
synchronized
2-Way:
bidirectional
communication
established
Down,Attempt,Init,Loading,ExStart,Exchange:
not completely running!
© Ufoakses 2008 22
OSPF Area Lab
Create your own area
area name «Area<Z>»
area-id=0.0.0.<Z>
Assign networks to the areas
Check your OSPF neighbors
Owner of the ABR should also configure
backbone area and networks
Main AP should be in ABR's OSPF neighbor list
© Ufoakses 2008 23
OSPF Settings
Router ID can be left as 0.0.0.0 then largest IP
address assigned to the router will be used
Router ID
must be
unique
within the
AS
© Ufoakses 2008 24
What to Redistribute?
1
3
{
5
2
}
4
Default route is not considered as static route
© Ufoakses 2008 25
Redistribution Settings
if-installed - send the default route only if it has
been installed (static, DHCP, PPP, etc.)
always - always send the default route
as-type-1 – remote routing decision to this
network will be made based on the sum of the
external and internal metrics
as-type-2 – remote routing decision to this
network will be made based only on external
metrics (internal metrics will become trivial)
© Ufoakses 2008 26
ASBR
Cost=10
Cost=10
Cost=10
Cost=10
Cost=10
Source
Cost=10
Cost=9 Destination
Total Cost=40
Total Cost=49
External Type 1 Metrics
© Ufoakses 2008 27
ASBR
Cost
trivial
Cost
trivial
Cost
trivial
Cost
trivial
Cost
trivial
Source
Cost=10
Cost=9 Destination
Total Cost=10
Total Cost=9
External Type 2 Metrics
© Ufoakses 2008 28
Redistribution Lab
Enable type 1 redistribution for all connected
routes
Take a look at the routing table
Add one static route to 172.16.XY.0/24 network
Enable type 1 redistribution for all static routes
Take a look at the routing table
© Ufoakses 2008 29
Interface Cost
Choose correct network type for the interface
All interfaces
have default
cost of 10
To override
default setting
you should add
new entry in
interface menu
© Ufoakses 2008 30
Designated Routers
To reduce OSPF traffic in NBMA and broadcast
networks, a single source for routing updates
was introduced - Designated Router (DR)
DR maintains a complete topology table of the
network and sends the updates to the others
Router with the highest priority (previous slide)
will be elected as DR
Router with next priority will be elected as
Backup DR (BDR)
Router with priority 0 will never be DR or BDR
© Ufoakses 2008 31
OSPF Interface Lab
Choose correct network type for all OSPF
interfaces
Assign costs (next slide) to ensure one way
traffic in the area
Check your routing table for ECMP routes
Assign necessary costs so backup link will be
used only when some other link fails
Check OSPF network redundancy!
Ensure ABR to be DR your area, but not in
backbone area
© Ufoakses 2008 32
Costs
To Main AP
To Laptop
To Laptop
To Laptop
To Laptop
ABR
BACKUP
LINK
100
100
100
100
10
10
10
10
???
???
© Ufoakses 2008 33
NBMA Neighbors
For non-broadcast
networks it is
necessary to
specify neighbors
manually
The priority determines the neighbor chance to
be elected as a Designated router
© Ufoakses 2008 34
Stub Area
A stub area is an area
which does not
receive AS external
routes.
Typically all routes to
external AS networks
can be replaced by
one default route. -
this route will be
created automatically
distributed by ABR
© Ufoakses 2008 35
Stub area (2)
«Inject Summary LSA» option allows to collect
separate backbone or other area router Link
State Advertisements (LSA) and inject it to the
stub area
Enable «Inject Summary LSA» option only on
ABR
«Inject Summary LSA» is not a route
aggregation
«Inject Summary LSA» cost is specified
by«Default area cost» option
© Ufoakses 2008 36
Not-So-Stubby Area (NSSA)
NSSA is a type of stub
area that is able to
transparently inject AS
external routes to the
backbone.
«Translator role» option
allow to control which
ABR of the NSSA area
will act as a relay from
ASBR to backbone
area
© Ufoakses 2008 37
Virtual Link
ASBR
area-id=0.0.0.1
area-id=0.0.0.0
area-id=0.0.0.2 area-id=0.0.0.3
NSSA Stub
default default
OSPF AS
© Ufoakses 2008 38
Area Type Lab
Set your area type to «stub»
Check your routing table for changes!
Make sure that default route redistribution on
the ABR is set to «never»
Set «Inject Summary LSA» option
on the ABR to «enable»
on the IR to «disable»
© Ufoakses 2008 39
Passive interface
Passive option allow you to disable OSPF
“Hello” protocol on client interfaces
It is necessary to
assign client
networks to the
area or else stub
area will consider
those networks as
external.
It is a security
issue!!!
© Ufoakses 2008 40
Area Ranges
Address ranges are used to aggregate
(replace) network routes from within the area
into one single route
It is possible
then to advertise
this aggregate
route or drop it
It is possible to
assign specific
cost to
aggregate route
© Ufoakses 2008 41
Route Aggregation Lab
Advertise only one 192.168.Z.0/24 route
instead of four /26 (192.168.Z.0/26, 192.168.Z.64/26,
192.168.Z.128/26, 192.168.Z.192/26) into the backbone
Stop advertising backup network to the
backbone
Check the Main AP's routing table
© Ufoakses 2008 42
Summary
For securing your OSPF network
Use authentication keys (for interfaces and areas)
Use highest priority (255) to designated router
Use correct network types for the area
To increase performance of OSPF network
Use correct area types
Use “Summary LSA” for stub areas
Use route aggregation as much as possible
© Ufoakses 2008 43
OSPF and Dynamic VPN Interfaces
Each dynamic VPN interface
creates a new /32 Dynamic, Active, Connected
(DAC) route in the routing table when appears
removes that route when disappears
Problems:
Each of these changes results in OSPF update, if
redistribute-connected is enabled (update flood in
large VPN networks)
OSPF will create and send LSA to each VPN
interface, if VPN network is assigned to any OSPF
area (slow performance)
© Ufoakses 2008 44
ABR
PPPoE
server
PPPoE
server
Area type = stub
Area1
~250 PPPoE clients
~ 100 PPPoE
clients
Type stub “PPPoE area”
© Ufoakses 2008 45
ABR
PPPoE
server
PPPoE
server
Area type = default
Area1
~250 PPPoE
clients
~ 100 PPPoE
clients
Type default “PPPoE area”
© Ufoakses 2008 46
“PPPoE area” Lab (discussion)
Give a solution for each problem mentioned
previously if used area type is “stub”
Try to find a solution for each problem
mentioned previously if used area type is
“default”
© Ufoakses 2008 47
OSPF Routing Filters
The routing filters may be applied to incoming
and outgoing OSPF routing update messages
Chain “ospf-in” for all incoming routing update
messages
Chain “ospf-out” for all outgoing routing update
messages
Routing filters can manage only external OSPF
routes (routes for the networks that are not
assigned to any OSPF area)
© Ufoakses 2008 48
Routing Filters
© Ufoakses 2008 49
Routing Filters and VPN
It is possible to create a routing filter rule to
restrict all /32 routes from getting into the OSPF
It is necessary to have one aggregate route to
this VPN network :
By having address from the aggregate VPN network
to the any interface of the router
Suggestion: place this address on the interface where
VPN server is running
Suggestion: use network address, the clients will not be
able to avoid your VPN service then
By creating static route to the router itself
© Ufoakses 2008 50
Routing filters Rule
© Ufoakses 2008
Bridging
Bridge, Admin MAC, Bridge ports, Bridge
firewall, STP and RSTP
© Ufoakses 2008 51
Bridge
Ethernet-like networks can be connected
together using OSI Layer 2 bridges
The bridge feature allows interconnection of
hosts connected to separate LANs as if they
were attached to a single LAN segment
Bridges extend the broadcast domain and
increase the network traffic on bridged LAN
© Ufoakses 2008 52
Bridge Configuration
Bridge is a virtual interface in RouterOS
Several bridges can be created
/interface bridge add name=bridge1
Interfaces are assigned as ports to a bridge
/interface bridge port add interface=ether1
bridge=bridge1
/interface bridge port add interface=ether2
bridge=bridge1
© Ufoakses 2008 53
Creating a Bridge
© Ufoakses 2008 54
Assigning Ports to the Bridge
© Ufoakses 2008 55
Spanning Tree Protocol
The Spanning Tree Protocol (STP)
is defined by IEEE Standard 802.1D
provides a loop free topology for any bridged LAN
discovers an optimal spanning tree within the mesh
network and disables the links that are not part of
the tree, thus eliminating bridging loops
© Ufoakses 2008 56
STP in Action
A
B
C
D
E F
Root
Bridge
© Ufoakses 2008 57
STP Root Bridge
Lowest priority
Lowest ID (MAC address)
Central point of the topology
Each bridge calculates shortest path to the Root
Bridge
© Ufoakses 2008 58
Spanning Tree
B A
C
D
E
F
Root
Bridge
© Ufoakses 2008 59
Rapid Spanning Tree Protocol
Rapid Spanning Tree Protocol (RSTP)
is an evolution of the STP
provides for faster spanning tree convergence after
a topology change than STP
rstp-bridge-test package is required for the
RSTP feature to be available in RouterOS
© Ufoakses 2008 60
RSTP Bridge Port Roles
Lowest priority for looped ports
Root port – a path to the root bridge
Alternative port – backup root port
Designated port – forwarding port
Backup port – backup designated port
© Ufoakses 2008 61
Routed Networks vs Bridging
Routers do not forward broadcast frames
Communication loops and their resultant
broadcast storms are no longer a design issue
in routed networks
Redundant media and meshed topologies can
offer traffic load sharing and more robust fault
tolerance than bridged network topologies
© Ufoakses 2008 62
Bridge Firewall
The bridge firewall implements packet filtering
and thereby provides security functions that are
used to manage data flow to, from and through
bridge
Elements of bridge firewall are:
Bridge Filter
Bridge Network Address Translation (NAT)
Bridge Broute
© Ufoakses 2008 63
Bridge Filter
Bridge filter has three predefined chains, input,
forward, and output
Example application is filtering broadcast traffic
© Ufoakses 2008 64
Bridge NAT
Bridge network address translation (NAT)
provides ways for changing source/destination MAC
addresses of the packets traversing a bridge
has two built-in chains
src-nat
dst-nat
Bridge NAT can be used for ARP
© Ufoakses 2008 65
Bridge Broute
Bridge Broute
makes bridge a brouter - router that performs
routing on some of the packets, and bridging - on
others
has one predefined chain, brouting, which is
traversed right after a packet enters an enslaved
interface before "Bridging Decision"
For example, IP can be routed, and everything
else bridged (IPX)
© Ufoakses 2008
Firewall
Firewall filters,
Network Intrusion Detection System (NIDS),
Network Address Translation (NAT)
© Ufoakses 2008 67
Firewall Filters Structure
Firewall filter rules are organized in chains
There are default and user-defined chains
There are three default chains
input – processes packets sent to the router
output – processes packets sent by the router
forward – processes packets sent through the
router
Every user-defined chain should subordinate to
at least one of the default chains
© Ufoakses 2008 68
Firewall Filter Structure Diagram
© Ufoakses 2008 69
Firewall Filters
The firewall filter facility is a tool for packet
filtering
Firewall filters consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 70
Filter Rules – Winbox View
© Ufoakses 2008 71
Firewall Filter Chains
You can direct traffic to user-defined chains
using action jump (and direct it back to the
default chain using action return)
Users can add any number of chains
User-defined chains are used to optimize the
firewall structure and make it more readable
and manageable
User-defined chains help to improve
performance by reducing the average number
of processed rules per packet
© Ufoakses 2008 72
User-Defined Chains
© Ufoakses 2008 73
Firewall Building Tactics
Accept only needed,
drop everything else
Drop all unneeded,
accept everything else
© Ufoakses 2008 74
Connection Tracking
Connection Tracking (or Conntrack) system is
the heart of firewall, it gathers and manages
information about all active connections.
By disabling the conntrack system you will lose
functionality of the NAT and most of the filter
and mangle conditions.
Each conntrack table entry represents
bidirectional data exchange
Conntrack takes a lot of CPU resources (disable
it, if you don't use firewall)
© Ufoakses 2008 75
Conntrack Placement
© Ufoakses 2008 76
Conntrack – Winbox View
© Ufoakses 2008 77
Condition: Connection State
Connection state is a status assigned to each
packet by conntrack system:
New – packet is opening a new connection
Related – packet is also opening a new connection,
but it is in some kind of relation to an already
established connection
Established – packet belongs to an already known
connection
Invalid – packet does not belong to any of the
known connections
Connection state ≠ TCP state
© Ufoakses 2008 78
Connection State
© Ufoakses 2008 79
First Rule Example
© Ufoakses 2008
Chain Input
Protecting the router – allowing only necessary
services from reliable source addresses with
agreeable load
© Ufoakses 2008 81
Chain Input Lab
Create 3 rules to ensure that only connectionstate
new packets will proceed through the
input filter
Drop all connection-state invalid packets
Accept all connection-state established packets
Accept all connection-state related packets
Create 2 rules to ensure that only you will be
able to connect to the router
Accept all packets from your laptop IP
Drop everything else
© Ufoakses 2008 82
Firewall Maintenance
Write comment for each firewall rule, to make
your firewall more manageable
Look at the rule counters, to determine rule
activity
Change rule position to get necessary order
Use action “passthrough” to determine amount
of traffic before applying any action
Use action “log” to collect detailed information
about traffic
© Ufoakses 2008 83
Action “log”
© Ufoakses 2008 84
RouterOS Services
© Ufoakses 2008 85
RouterOS Services Lab
Create rules to allow only necessary RouterOS
services to be accessed from the public network
Use action “log” to determine those services
Create rule to allow winbox, ssh and telnet
connection from the teacher's network
(10.1.2.0/24)
Arrange rules accordingly
Write comment for each firewall rule
© Ufoakses 2008 86
Important Issue
Firewall filters do not filter MAC level
communications
You should turn off MAC-telnet and MACWinbox
features at least on the public interface
You should disable network discovery feature,
so that the router do not reveal itself anymore
(“/ip neighbor discovery” menu)
© Ufoakses 2008 87
MAC-telnet and MAC-winbox
© Ufoakses 2008
Chain Forward
Protecting the customers from viruses and
protecting the Internet from the customers
© Ufoakses 2008 89
Chain Forward Lab
Create 3 rules to ensure that only connectionstate
new packets will proceed through the
chain forward (same as in the Chain Input Lab)
Create rules to close most popular ports of
viruses
Drop TCP and UDP port range 137-139
Drop TCP and UDP port 445
© Ufoakses 2008 90
Virus Port Filter
At the moment the are few hundreds active
trojans and less than 50 active worms
You can download the complete “virus port
blocker” chain (~330 drop rules with ~500
blocked virus ports) from
ftp://admin@10.1.1.254
Some viruses and trojans use standard services
ports and can not be blocked.
© Ufoakses 2008 91
Bogon IPs
There are ~4,3 billion IPv4 addresses
There are several IP ranges restricted in public
network
There are several of IP ranges reserved (not
used at the moment) for specific purposes
There are lots of unused IP ranges!!!
You can find information about all unused IP
ranges at:
http://www.cidr-report.org/as2.0/#Bogons
© Ufoakses 2008 92
Address List Lab
Make an address list of the most common
bogon IP addresses
© Ufoakses 2008 93
Address List Options
Instead of creating one
filter rule for each IP
network address, you
can create only one
rule for IP address list.
Use “Src./Dst. Address
List” options
Create an address list
in “/ip firewall addresslist”
menu
© Ufoakses 2008 94
Address Filtering Lab
Allow packets to enter your network only from
the valid Internet addresses
Allow packets to enter your network only to the
valid customer addresses
Allow packets to leave your network only from
the valid customers addresses
Allow packets to leave your network only to the
valid Internet addresses
© Ufoakses 2008 95
User-defined Chains
Firewall structure, chain reusability
© Ufoakses 2008 96
ICMP Protocol
Internet Control Message Protocol (ICMP) is
basic network troubleshooting tool, it should be
allowed to bypass the firewall
Typical IP router uses only five types of ICMP
messages (type:code)
For PING - messages 0:0 and 8:0
For TRACEROUTE – messages 11:0 and 3:3
For Path MTU discovery – message 3:4
Any other type ICMP messages should be
blocked
© Ufoakses 2008 97
ICMP Message Rule Example
© Ufoakses 2008 98
ICMP Chain Lab
Make a new chain – ICMP
Accept 5 necessary ICMP messages
Drop all other ICMP packets
Move all ICMP packets to the ICMP chain
Create an action “jump” rule in the chain Input
Place it accordingly
Create an action “jump” rule in the chain Forward
Place it accordingly
© Ufoakses 2008 99
ICMP Jump Rule
© Ufoakses 2008 100
Network Intrusion Types
Network intrusion is a serious security risk that
could result not only in temporary service
denial, but also in total refusal of network
service
We can point out 4 major network intrusion
types:
Ping flood
Port scan
DoS attack
DDoS attack
© Ufoakses 2008 101
Ping Flood
Ping flood usually
consists of loads of
random ICMP
messages
With “limit” condition it
is possible to bound
the rule match rate to
a given limit
This condition is often
used with action “log”
© Ufoakses 2008 102
Port Scan
Port Scan is sequential
TCP (UDP) port probing
PSD (Port scan
detection) works only for
TCP protocol
Low ports
From 0 to 1023
High ports
From 1024 to 65535
© Ufoakses 2008 103
Intrusion Protection Lab
Adjust all 5 accept rules in the chain ICMP to
match rate 5 packets per second with 5 packet
burst possibility
Create PSD protection
Create a PSD drop rule in the chain Input
Place it accordingly
Create a PSD drop rule in the chain Forward
Place it accordingly
© Ufoakses 2008 104
DoS Attacks
Main target for DoS attacks is consumption of
resources, such as CPU time or bandwidth, so
the standard services will get Denial of Service
(DoS)
Usually router is flooded with TCP/SYN
(connection request) packets. Causing the
server to respond with a TCP/SYN-ACK packet,
and waiting for a TCP/ACK packet.
Mostly DoS attackers are virus infected
customers
© Ufoakses 2008 105
DoS Attack Protection
All IP's with more than 10 connections to the
router should be considered as DoS attackers
With every dropped TCP connection we will
allow attacker to create new connection
We should implement DoS protection into 2
steps:
Detection - Creating a list of DoS attackers on the
basis of connection-limit
Suppression – applying restrictions to the detected
DoS attackers
© Ufoakses 2008 106
DoS Attack Detection
© Ufoakses 2008 107
DoS Attack Suppression
To bound the attacker
from creating a new
connections, we will
use action“tarpit”
We must place this
rule before the
detection rule or else
address-list entry will
rewrites all the time
© Ufoakses 2008 108
DDoS attacks
A Distributed Denial of
Service attack is very
similar to DoS attack
only it occurs from
multiple
compromised
systems
Only thing that could
help is “TCPSyn
Cookie” option in
conntrack system
© Ufoakses 2008
Network Address Translation
(NAT)
Destination NAT, Source NAT, NAT traversal
© Ufoakses 2008 110
NAT Types
As there are two IP addresses and ports in an
IP packet header, there are two types of NAT
The one, which rewrites source IP address and/or
port is called source NAT (src-nat)
The other, which rewrites destination IP address
and/or port is called destination NAT (dst-nat)
Firewall NAT rules process only the first packet of
each connection (connection state “new” packets)
© Ufoakses 2008 111
NAT Type Diagrams
SRC
NAT SRC DST NEW SRC DST
DST
NAT SRC DST SRC NEW DST
© Ufoakses 2008 112
Firewall NAT Structure
Firewall NAT rules are organized in chains
There are two default chains
dstnat – processes traffic sent to and through the
router, before it divides in to “input” and “forward”
chain of firewall filter.
srcnat – processes traffic sent from and through the
router, after it merges from “output” and “forward”
chain of firewall filter.
There are also user-defined chains
© Ufoakses 2008 113
IP Firewall Diagram
© Ufoakses 2008 114
Firewall NAT
The firewall NAT facility is a tool for rewriting
packet's header information.
Firewall NAT consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 115
NAT Rules - Winbox View
© Ufoakses 2008 116
NAT Actions
There are 6 specific actions in the NAT
dst-nat
redirect
src-nat
masquarade
netmap
same
There are 7 more actions in the NAT, but they
are exactly the same as in firewall filters
© Ufoakses 2008 117
Src-nat
Action “src-nat” changes packet's source
address and/or port to specified address and/or
port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources
behind specific public IP address
© Ufoakses 2008 118
Src-nat Rule Example
© Ufoakses 2008 119
Masquerade
Action “masquerade” changes packet's source
address router's address and specified port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources
behind one dynamic public IP address
© Ufoakses 2008 120
Masquerade Rule Example
© Ufoakses 2008 121
Source NAT Issues
Hosts behind a NAT-enabled router do not have
true end-to-end connectivity:
connection initiation from outside is not possible
some TCP services will work in “passive” mode
src-nat behind several IP addresses is
unpredictable
some protocols will require so-called NAT helpers to
to work correctly (NAT traversal)
© Ufoakses 2008 122
NAT Helpers
You can specify ports for existing NAT helpers,
but you can not add new helpers
© Ufoakses 2008 123
Src-nat Lab
You have been assigned one “public” IP
address 172.16.0.XY/32
Assign it to the wireless interface
Add src-nat rule to “hide” your private network
192.168.XY.0/24 behind the “public” address
Connect from your laptop using winbox, ssh, or
telnet via your router to the main gateway
10.1.1.254
Check the IP address you are connecting from
(use “/user active print” on the main gateway)
© Ufoakses 2008 124
Dst-nat
Action “dst-nat” changes packet's destination
address and port to specified address and port
This action can take place only in chain dstnat
Typical application: ensure access to local
network services from public network
© Ufoakses 2008 125
Dst-nat Rule Example
© Ufoakses 2008 126
Redirect
Action “redirect” changes packet's destination
address to router's address and specified port
This action can take place only in chain dstnat
Typical application: transparent proxying of
network services (DNS,HTTP)
© Ufoakses 2008 127
Redirect Rule Example
© Ufoakses 2008 128
Redirect Lab
Capture all TCP and UDP port 53 packets
originated from your private network
192.168.XY.0/24 and redirect them to the router
itself.
Set your laptop's DNS server to some random
IP address
Clear your router's DNS cache
Try to open a previously unseen Internet page
Take a look at the DNS cache of the router
© Ufoakses 2008 129
Dst-nat Lab
Capture all TCP port 80 (HTTP) packets
originated from your private network
192.168.XY.0/24 and change destination
address to 10.1.2.1 using dst-nat rule
Clear your browser's cache on the laptop
Try browsing the Internet
© Ufoakses 2008 130
Netmap and Same
Netmap - creates a static 1:1 mapping of one
set of IP addresses to another one. Often used
to distribute public IP addresses to hosts on
private networks
Same - gives a particular client the same
source/destination IP address from the supplied
range for any connection. Used for services that
expect constant IP address for multiple
connections from the same client
© Ufoakses 2008
Firewall Mangle
IP packet marking and IP header fields adjustment
© Ufoakses 2008 132
What is Mangle?
The mangle facility allows to mark IP packets
with special marks.
These marks are used by other router facilities
to identify the packets.
Additionally, the mangle facility is used to
modify some fields in the IP header, like TOS
(DSCP) and TTL fields.
© Ufoakses 2008 133
Firewall Mangle
The firewall filter facility is a tool for packet
marking
Firewall filters consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 134
Firewall Mangle
© Ufoakses 2008 135
Mangle Structure
Mangle rules are organized in chains
There are five built-in chains:
Prerouting- making a mark before Global-In queue
Postrouting - making a mark before Global-Out
queue
Input - making a mark before Input filter
Output - making a mark before Output filter
Forward - making a mark before Forward filter
New user-defined chains can be added, as
necessary
© Ufoakses 2008 136
Mangle and Queue Diagram
(simple)
© Ufoakses 2008 137
Mangle actions
There are 7 more actions in the mangle:
mark-connection – mark connection (from a
single packet)
mark-packet – mark a flow (all packets)
mark-routing - mark packets for policy routing
change MSS - change maximum segment size of
the packet
change TOS - change type of service
change TTL - change time to live
strip IPv4 options
© Ufoakses 2008 138
Marking Connections
Use mark connection to identify one or group of
connections with the specific connection mark
Connection marks are stored in the connection
tracking table
There can be only one connection mark for one
connection.
Connection tracking helps to associate each
p
acket to a specific connection (connection mark)
© Ufoakses 2008 139
Mark Connection Rule
© Ufoakses 2008 140
Marking Packets
Packets can be marked
Indirectly. Using the connection tracking facility,
based on previously created connection marks
(faster)
Directly. Without the connection tracking - no
connection marks necessary, router will compare
each packet to a given conditions (this process
imitates some of the connection tracking features)
© Ufoakses 2008 141
Mark Packet Rule
© Ufoakses 2008 142
Mangle Lab
Mark all HTTP connections
Mark all packets from HTTP connections
Mark all ICMP packets
Mark all other connections
Mark all packets from other connections
Check the configuration
© Ufoakses 2008 143
Mangle Lab Result
© Ufoakses 2008
MikroTik RouterOS - QoS
Quality of Service
Simple limitation using Simple Queues.
Traffic marking using Firewall Mange.
Traffic prioritization using Queue Tree.
© Ufoakses 2008 145
Speed Limiting
Forthright control over data rate of inbound
traffic is impossible
The router controls the data rate indirectly by
dropping incoming packets
TCP protocol adapts itself to the effective
connection speed
Simple Queue is the easiest way to limit data
rate
© Ufoakses 2008 146
Simple Queues
Simple queues make data rate limitation easy.
One can limit:
Client's rx rate (client's download)
Client's tx rate (client's upload)
Client's tx + rx rate (client's aggregate)
While being easy to configure, Simple Queues
give control over all QoS features
© Ufoakses 2008 147
Simple Limitation
© Ufoakses 2008 148
Simple Queue Lab
Restore configuration backup (slide 12)
Create on simple queue to limit your local
network's upload/download data rate to
256Kbps/512Kbps
Check the limitation!
Create another simple queue to limit your
laptop's upload/download data rate to 64Kbps/
128Kbps
Check the limitation!
Reorder queues
© Ufoakses 2008 149
Limitation and QoS
QoS is not only limitation!
QoS is an attempt to use the existing resources
rationally (it is not of an interest not to use all
the available speed)
QoS balances and prioritizes the traffic flow and
prevents monopolizing the (always too narrow)
channel. That is why it is called “Quality of
Service”
© Ufoakses 2008 150
QoS Basic Principles
QoS is implemented not only by limitations, but
by additional queuing mechanism like:
Burst
Dual limitation
Queue hierarchy
Priority
Queue discipline
Queuing disciplines control the order and speed
of packets going out through the interface
© Ufoakses 2008 151
Burst
Burst is one of the means to ensure QoS
Bursts are used to allow higher data rates for a
short period of time
If an average data rate is less than burstthreshold,
burst could be used (actual data rate
can reach burst-limit)
Average data rate is calculated from the last
burst-time seconds
© Ufoakses 2008 152
Average Data Rate
Average data rate is calculated as follows:
burst-time is being divided into 16 periods
router calculates the average data rate of each
class over these small periods
Note, that the actual burst period is not equal
to the burst-time. It can be several times shorter
than the burst-time depending on the max-limit,
burst-limit, burst-threshold, and actual data rate
history (see the graph example on the next
slide)
© Ufoakses 2008 153
Limitation with Burst
© Ufoakses 2008 154
Limitation with Burst
© Ufoakses 2008 155
Burst Lab
Delete all previously created queues
Create a queue to limit your laptop upload/
download to 64Kbps/128Kbps
Set burst to this queue
burst-limit up to 128Kbps/256Kbps
burst-threshold 32Kbps/64Kbps
burst-time 20 seconds
Use bandwidth-test to test the limitations
© Ufoakses 2008 156
Advanced Burst Lab
Try to set burst-threshold for this queue to the
128Kbps/256Kbps
Try to set burst-threshold for this queue to the
64Kbps/128Kbps
Try to set burst-threshold for this queue to the
16Kbps/32Kbps
State the optimal burst configuration
© Ufoakses 2008 157
Interface Traffic Monitor
Open up interface menu in WinBox to see tx/rx
rates per interface
Open up any interface and select the “Traffic”
tab to see the graphs
Use the “monitor-traffic” command in terminal to
get the traffic data per one or more interfaces,
for example:
/interface monitor-traffic ether1
/interface monitor-traffic ether1,ether2,ether3
© Ufoakses 2008 158
Interface Traffic Monitor
© Ufoakses 2008 159
Torch Tool
Torch tool offers more detailed actual traffic
report for the interface
It's easier to use the torch in WinBox:
Go to “Tools” > “Torch”
Select an interface to monitor and click “Start”
Use “Stop” and “Start” to freeze/continue
Refine the output by selecting protocol and port
Double-click on specific IP address to fill in the Src.
Or Dst. Address field (0.0.0.0/0 is for any address)
© Ufoakses 2008 160
Torch Tools
© Ufoakses 2008 161
Dual Limitation
Advanced, better QoS
Dual limitation has two rate limits:
CIR (Committed Information Rate) – in worst case
scenario a flow will get its limit-at no matter what
(assuming we can actually send so much data)
MIR (Maximal Information Rate) – in best case
scenario a flow can get up to max-limit if there is
spare bandwidth
© Ufoakses 2008 162
Dual Limitation Example
MIR 1
MIR 2
Mbps
sec
Client1 traffic
Client2 traffic
MIR 1
MIR 2
Mbps
sec
CIR 1
CIR 2
Before After
© Ufoakses 2008 163
Dual Limitation Lab
Create one queue for limiting your laptop's
communication with the first test server
limit-at 86Kbps/172Kbps
max-limit to 172Kbps/384Kbps
dst-address <first test server>
Create one queue for limiting your laptop's
communication with the second test server
limit-at 86Kbps/172Kbps
max-limit to 172Kbps/384Kbps
dst-address <second test server>
© Ufoakses 2008 164
Parent Queue
It is hard for the router to detect exact speed of
Internet connection
To optimize usage of your Internet resources
and to ensure desired QoS operation you
should assign maximal available connection
speed manually
To do so, you should create one parent queue
with strict speed limitation and assign all your
queues to this parent queue
© Ufoakses 2008 165
Parent Queue
© Ufoakses 2008 166
Dual Limitation Lab
Create a parent queue
max-limit to 256Kbps/512Kbps
Assign both previously created queues to the
parent queue
Set parent option to “main_queue”
Test the limitations
© Ufoakses 2008 167
First Child Queue
© Ufoakses 2008 168
Second Child Queue
© Ufoakses 2008 169
Priority
8 is the lowest priority, 1 is the highest
Numeric difference between priorities is
irrelevant (two queues with priorities 1 and 8,
will have same relation as two queues with
priorities 1 and 2)
Queue with higher priority will reach its CIR
before the queue with lower priority
Queue with higher priority will reach its MIR
before the queue with lower priority
© Ufoakses 2008 170
Priority Lab
Adjust priorities in the “Dual Limitation Lab”
Check the limitations!
© Ufoakses 2008 171
Queue Disciplines
Queuing disciplines can be classified into two
groups by their influence on the traffic flow –
schedulers and shapers
Scheduler queues reorder the packet flow.
These disciplines limit the number of waiting
packets, not the data rate
Shaper queues control data flow speed. They
can also do a scheduling job
© Ufoakses 2008 172
Idealized Shapers
© Ufoakses 2008 173
Idealized Schedulers
© Ufoakses 2008 174
Queue types
Scheduler queues
BFIFO
PFIFO
RED
SFQ
Shaper queues
PCQ
© Ufoakses 2008 175
FIFO algorithm
PFIFO and BFIFO
FIFO queuing
disciplines do not
change packet order,
instead they
accumulate packets
until a defined limit is
reached
© Ufoakses 2008 176
RED algorithm
Random Early Detect (Random Early Drop)
Does not limit the speed; indirectly equalizes
users' data rates when the channel is full
When the average queue size reaches minthreshold,
RED randomly chooses which
arriving packet to drop
If the average queue size reaches maxthreshold,
all packets are dropped
Ideal for TCP traffic limitation
© Ufoakses 2008 177
RED algorithm
If real queue size is
much greater than maxthreshold,
then all excess
packets are dropped
© Ufoakses 2008 178
SFQ algorithm
Stochastic Fairness Queuing (SFQ) cannot limit
traffic at all. Its main idea is to equalize traffic
flows when your link is completely full.
The fairness of SFQ is ensured by hashing and
round-robin algorithms
Hashing algorithm is able to divides the session
traffic in up to 1024 sub queues. It can hold up
to 128 packets in memory simultaneously
The round-robin algorithm dequeues allot bytes
from each sub queue in a turn
© Ufoakses 2008 179
SFQ algorithm
After perturb seconds
the hashing algorithm
changes and divides
the session traffic to
different subqueues
© Ufoakses 2008 180
SFQ Example
SFQ should be used for equalizing similar
connection
Usually used to manage information flow to or
from the servers, so it can offer services to
every customer
Ideal for p2p limitation - it is possible to place
strict limitation without dropping connections
© Ufoakses 2008 181
PCQ algorithm
Per Connection Queue allows to choose
classifiers (one or more of src-address, dstaddress,
src-port, dst-port)
PCQ does not limit the number of sub flows
It is possible to limit the maximal data rate that
is given to each of the current sub flows
PCQ is memory consumptive!!
© Ufoakses 2008 182
PCQ algorithm
If you classify the
packets by srcaddress
then all
packets with different
source IP addresses
will be grouped into
different subqueues
© Ufoakses 2008 183
PCQ example
If ‘limit-at’ and ‘max-limit’ are set to ‘0’, then the
subqueues can take up all bandwidth available
for the parent
Set the PCQ Rate to ‘0’, if you do not want to
limit subqueues, i.e, they can use the bandwidth
up to ‘max-limit’, if available
© Ufoakses 2008 184
PCQ in Action
pcq-rate=128000
© Ufoakses 2008 185
PCQ in Action (cont.)
pcq-rate=0
© Ufoakses 2008 186
Queue Type Lab
Try RED algorithm in the last configuration
Check the limitations!
Try SFQ algorithm
Check the limitations!
Watch the teachers demonstration about
PCQ
© Ufoakses 2008
HTB
Hierarchical Token Bucket
© Ufoakses 2008 188
HTB
HTB mentioned before is not managed like
other queues
HTB is a hierarchical queuing discipline.
HTB is able to prioritize and group traffic flows
HTB is not co-existing with another queue on an
interface – there can only be one queue and
HTB is the one.
© Ufoakses 2008 189
HTB Algorithm
All the circles are queuing disciplines – a packet storage with
a
flow management algorithm (FIFO, RED, SFQ or PCQ)
© Ufoakses 2008 190
HTB
There are 3 HTB trees maintained by
RouterOS:
global-in
global-total
global-out
And one more for each interface
© Ufoakses 2008 191
Mangle and HTB
© Ufoakses 2008 192
HTB (cont.)
When packet travels through the router, it
passes all 4 HTB trees
When packet travels to the router, it passes only
global-in and global-total HTB.
When packet travels from the router, it passes
global-out, global-total and interface HTB.
© Ufoakses 2008 193
HTB Algorithm
In order of priority HTB satisfies all “limit-at”s for
leaf classes
When the “limit-at” is reached the class
becomes “yellow”
When the “max-limit” is reached the class
becomes “red”
© Ufoakses 2008 194
HTB Algorithm
Some attributes of HTB classes :
limit-at
max-limit
priority
Simple queues are executed by the HTB facility
in “global-out” ('direct' queue), “globalin”
('reverse' queue) and “global-total” ('total'
queue) trees
© Ufoakses 2008 195
Queue Tree
Another way to manage the traffic
© Ufoakses 2008 196
Tree Queue
© Ufoakses 2008 197
Queue Tree and Simple Queues
Tree queue can be placed in 4 different places:
Global-in (“direct” part of simple queues are placed
here automatically)
Global-out(“total” part of simple queues are placed
here automatically)
Global-total (“reverse” part simple queues are
placed here automatically)
Interface queue
If placed in same place Simple queue will take
traffic before Queue Tree
© Ufoakses 2008 198
Queue Tree
Queue tree is only one directional. There must
be one queue for download and one for upload
Queue tree queues work only with packet
marks. These marks should be created in the
firewall mangle
Queue tree allows to build complex queue
hierarchies
© Ufoakses 2008 199
Queue Tree Lab
Create queue tree:
Create a main queue
Create child queue for ICMP
Create child queue for HTTP
Create child queue for OTHER
Consume all the available traffic using
bandwidth-test and check the ping response
times
Set highest priority to ICMP
Check the ping response times
© Ufoakses 2008 200
Queue Tree Lab Result
© Ufoakses 2008 201
Wireless and Tunnels
Wireless Concepts, Encryption, User Manager,
WDS and Mesh, nStreme Protocol, VLAN,
PPPoE, PPTP, L2TP, IPSec
© Ufoakses 2008
MikroTik RouterOS - Wireless
Wireless Concepts, Encryption, WDS and Mesh,
NStreme Protocol
© Ufoakses 2008 203
Wireless Interface Mode Settings
bridge/ap-bridge – AP mode; bridge mode supports only one
client
station – a regular client (can not be bridged)
station-pseudobridge/station-pseudobridge-clone – client, which
can be bridged (implements MAC address translation)
alignment-only – for positioning antennas
nstreme-dual-slave – card will be used in nstreme-dual interface
wds-slave – works as ap-bridge mode but adapts to the WDS
peers frequency
station-wds – client, which can be bridged (AP should support
WDS feature)
© Ufoakses 2008 204
Wireless Station
Joins a Service Set
Follows the Access Point within the Scan List
Restrictions based on Connect List
© Ufoakses 2008 205
Finding Access Points
© Ufoakses 2008 206
Alignment Tool
© Ufoakses 2008 207
Wireless Sniffer Tool
© Ufoakses 2008 208
Wireless Standards
IEEE 802.11b
2.4GHz, 22MHz bandwidth
11Mbit max air rate
IEEE 802.11g
2.4GHz, 22MHz bandwidth
802.11b compatibility mode
54Mbit max air rate
IEEE 802.11a
5GHz, 20MHz bandwidth
54Mbit max air rate
© Ufoakses 2008 209
Band Variations
Double channel (40MHz) – 108Mbit max air rate
2.4ghz-g-turbo
5ghz-turbo
Half channel (10MHz) – 27Mbit max air rate
2ghz-10mhz
5ghz-10mhz
Quarter channel (5MHz) – 13.5Mbit max air rate
2ghz-5mhz
5ghz-5mhz
© Ufoakses 2008 210
Supported Frequencies
Wireless cards usually support the following
frequencies:
For all 2.4GHz bands: 2192-2539MHz
For all 5GHz bands: 4920-6100MHz
Your country regulations allow only particular
frequency ranges
Custom frequency license unlocks all
frequencies supported by the wireless hardware
© Ufoakses 2008 211
Channels- 802.11b/g
11 channels (US), 22 MHz wide
3 non-overlapping channels
3 Access Points can occupy same area without
interfering
1 2 3 4 5 6 7 8 9 10 11
2400
2483
© Ufoakses 2008 212
Channels- 802.11a
12 channels, 20 MHz wide
5 turbo channels, 40MHz wide
36 40
5150
44 48 52 56 60 64
5180 5200 5220 5240 5260 5280 5300 5320 5350
5210 5250 5290
149 153
5735
157 161
5745 5765 5785 5805 5815
5760 5800
42 50 58
152 160
© Ufoakses 2008 213
Winbox: Wireless Regulations
© Ufoakses 2008 214
Wireless Regulations
To follow all the regulations in your wireless
communication domain you must specify:
Country where wireless system will operate
Frequency mode as regulatory domain – you will
be able to use only allowed channels with allowed
transmit powers
Antenna gain of antenna attached to this router
DFS mode – periodically will check for less used
frequency and change to it
(Proprietary-extensions to post-2.9.25)
© Ufoakses 2008 215
Wireless Country Settings Lab
Open terminal
Issue “/interface wireless info print” command
Change country to “australia”
Issue “/interface wireless info print” command
Compare results
Set country back to 'no_country_set'
© Ufoakses 2008 216
Access Point
Creates wireless infrastructure
Participates in Wireless Area
Expects stations to follow its frequency (DFS)
Authentication based on Access List
© Ufoakses 2008 217
Frequency Usage Tool
Frequency Usage
Monitor looks only for
IEEE 802.11 frames
Interface is disabled
during the Frequency
usage monitor
© Ufoakses 2008 218
Wireless Snooper Tool
© Ufoakses 2008 219
Wireless AP/Station Lab
Work in pairs to make AP/Station connection
with your neighbor's router
Create a AP on the wlan1 interface in 5Ghz
band with SSID “apXY” where XY is your
number
On wlan2 interface create a station to connect
to your neighbor's AP (you need to know the
neighbor's AP SSID)
Make a backup from this configuration
© Ufoakses 2008 220
Registration Table
© Ufoakses 2008 221
Access Management
default-forwarding (on AP) – whether the
wireless clients may communicate with each
other directly (access list may override this
setting for some particular clients)
default-authentication – enables AP to register
a client even if it is not in access list. In turn for
client it allows to associate with AP not listed in
client's connect list
© Ufoakses 2008 222
Wireless Access List
Individual settings for each client in access list
will override the interface default settings
Access list entries can be made from the
registration table entries by using action 'Copy
to Access List'
Access list entries are ordered, just like in
firewall
Matching by all interfaces “interface=all”
“Time” - works just like in firewall
© Ufoakses 2008 223
Wireless Access list
© Ufoakses 2008 224
Wireless Access List
© Ufoakses 2008 225
Wireless Access List Lab
Check if the neighbor's wireless router is
connected to your AP interface (wlan1)
Disable the default interface settings on wlan1:
default-forwarding, default-authentication
Make sure that nobody is connected to your AP
Add access list entry with your neighbor's MAC
address and make sure it connects
© Ufoakses 2008 226
Wireless RADIUS Authentication
© Ufoakses 2008 227
Wireless Connect List
Allow or deny clients from connecting to specific
AP by using Connect list
Connect list entries can be made from the
registration table entries by using action 'Copy to
Access List'
Connect list entries are ordered, just like in
firewall
Used also for WDS links
© Ufoakses 2008 228
Wireless Connect List
1 2
3
© Ufoakses 2008 229
Wireless Connect List
© Ufoakses 2008 230
Wireless Connect List Lab
On the AP interface (wlan1) set SSID to
“CHAOS”
On the Station interface (wlan2) leave the SSID
field empty
Add connect list entry for wlan2 interface to
connect to your neighbor's AP (you will need
the neighbor's AP MAC address)
© Ufoakses 2008 231
Rate Dependency from Signal Level
Rates,
6 Mbps
Signal,
dBm
18 36 48
Card Receive
Sensitivity
9 12 24 54
-100
-60
Link signal
level
© Ufoakses 2008 232
Rate Jumping
You can optimize link performance, by avoiding
rate jumps, in this case link will work more
stable at 36Mbps rate
54Mbps
36Mbps
48Mbps
Recalibration Recalibration
5% of time
15% of time
80% of time
© Ufoakses 2008 233
Basic and Supported Rates
Supported rates –
client data rates
Basic rates – link
management data
rates
If router can't send
or receive data at
basic rate – link
goes down
© Ufoakses 2008 234
Wireless MultiMedia (WMM)
4 transmit queues with priorities:
1,2 – background
0,3 – best effort
4,5 – video
6,7 – voice
Priorities set by
Bridge or IP firewall
Ingress (VLAN or WMM)
DSCP
© Ufoakses 2008 235
Wireless Encryption
© Ufoakses 2008 236
Wireless Encryption
© Ufoakses 2008 237
Wireless Encryption Lab
Create a new security profile with options:
mode=dynamic-keys
authentication-type=wpa2-psk
group/unicast ciphers=aes-ccm
wpa2-key=wireless
Apply the new profile to wlan1 and check if the
neighbors wireless client connects
© Ufoakses 2008 238
Wireless Distribution System
WDS (Wireless Distribution System) allows
packets to pass from one AP to another, just as
if the APs were ports on a wired Ethernet switch
APs must use the same band and SSID and
operate on the same frequency in order to
connect to each other
WDS is used to make bridged networks across
the wireless links and to extend the span of the
wireless network
© Ufoakses 2008 239
Wireless Distribution System
WDS link can be created between wireless
interfaces in several mode variations:
bridge/ap-bridge – bridge/ap-bridge
bridge/ap-bridge – wds-slave
bridge/ap-bridge – station-wds
You must disable DFS setting when using WDS
with more than one AP
© Ufoakses 2008 240
Simple WDS Topologies
© Ufoakses 2008 241
Dynamic WDS Interface
It is created 'on the fly' and appears
u
nder wds menu as a dynamic interface ('D' flag)
When the link between WDS devices goes
down, attached IP addresses will slip off from
WDS interface
Specify “wds-default-bridge” parameter and
attach IP addresses to the bridge
© Ufoakses 2008 242
Dynamic WDS Configuration
WDS can be created between two APs, both
must have WDS (static or dynamic) feature
enabled
APs must have
same SSID or the
“WDS ignore SSID”
feature enabled
We must create a
bridge to use
dynamic wds feature
© Ufoakses 2008 243
Bridge Creation
© Ufoakses 2008 244
Dynamic WDS Lab
Create a bridge interface with protocol-mode=rstp
Make sure that wlan1 interface is set to “ap-bridge” mode
and choose with your neighbor an equal SSID
Enable the dynamic WDS mode on the wlan1 and specify
the default-wds-bridge option to use bridge1
Add 10.1.1.XY/24 IP to the bridge interface
Check your network: From Your router try to ping neighbors
router
Optional: Add ether1 to the bridge and change laptops IP to
10.1.1.1XY/24
© Ufoakses 2008 245
Static WDS
It should be created manually
It requires the destination MAC address and
master interface parameters to be specified
manually
Static WDS interfaces never disappear, unless
you disable or remove them
© Ufoakses 2008 246
Static WDS
To use static WDS
use “ap-bridge” mode
Set WDS mode to
“static” and WDS
default bridge to
“none”
Create static WDS
interfaces
© Ufoakses 2008 247
Static WDS Interface
© Ufoakses 2008 248
Static WDS Lab
Adjust setup from the previous lab, to use WDS
static mode
Configure your wireless card accordingly
Create the static WDS interface
Add necessary ports to the bridge
Optional: Add ether1 to the bridge and change
laptops IP to 10.1.1.1XY/24
© Ufoakses 2008 249
Station-WDS
© Ufoakses 2008 250
Station-WDS
Use station-wds
mode to create clients
with WDS capabilities
WDS-mode must be
disabled on the
wireless card
Now your wireless
interface will work in
the bridge
© Ufoakses 2008 251
Station-WDS Lab
Adjust setup from the previous lab, to use only
one router as access point and other router as
station with WDS capability
Optional: Switch places (AP becomes client,
client becomes AP) and repeat the setup.
Optional: Add ether1 to the bridge and change
laptops IP to 10.1.1.1XY/24
© Ufoakses 2008 252
Simple MESH using WDS
© Ufoakses 2008 253
WDS MESH
© Ufoakses 2008 254
Simple MESH
© Ufoakses 2008 255
Dual Band MESH
© Ufoakses 2008 256
MESH Network
© Ufoakses 2008 257
MikroTik Nstreme
Nstreme is MikroTik's
proprietary (i.e.,
incompatible with
other vendors)
wireless protocol
created to improve
point-to-point and
point-to-multipoint
wireless links.
© Ufoakses 2008 258
Nstreme Protocol
Benefits of Nstreme protocol:
Client polling
Very low protocol overhead per frame allowing
super-high data rates
No protocol limits on link distance
No protocol speed degradation for long link
distances
Dynamic protocol adjustment depending on
traffic type and resource usage
© Ufoakses 2008 259
Nstreme Protocol: Frames
framer-limit - maximal frame size
framer-policy - the method how to combine frames.
There are several methods of framing:
none - do not combine packets
best-fit - put as much packets as possible in one frame,
until the limit is met, but do not fragment packets
exact-size - same as best-fit, but with the last packet
fragmentation
dynamic-size - choose the best frame size dynamically
© Ufoakses 2008 260
Nstreme Lab
Restore configuration backup file
Route your private network together with your
neighbor's network
Enable N-streme and check link productivity
with different framer polices
© Ufoakses 2008 261
Nstreme Dual Protocol
MikroTik proprietary (i.e., incompatible with other vendors)
wireless protocol that works with a pair of wireless cards
(Atheros chipset cards only) – one transmitting, one
receiving
© Ufoakses 2008 262
Nstreme Dual Interface
Set both wireless cards
into
“nstreme_dual_slave”
mode
Create Nstreme dual
interface (press “plus”
button in wireless
interface window)
Use framer policy only if
necessary
© Ufoakses 2008
VPN
Virtual Private Networks
EoIP
PPTP, L2TP
PPPoE
© Ufoakses 2008 264
VPN Benefits
Enable communications between corporate
private LANs over
Public networks
Leased lines
Wireless links
Corporate resources (e-mail, servers, printers)
can be accessed securely by users having
granted access rights from outside (home, while
travelling, etc.)
© Ufoakses 2008
EoIP
Ethernet over IP
© Ufoakses 2008 266
EOIP (Ethernet Over IP) tunnel
MikroTik proprietary protocol.
Simple in configuration
Don't have authentication or data encryption
capabilities
Encapsulates Ethernet frames into IP protocol
47/gre packets, thus EOIP is capable to carry
MAC-addresses
EOIP is a tunnel with bridge capabilities
© Ufoakses 2008 267
Creating EoIP Tunnel
© Ufoakses 2008 268
Creating EoIP Tunnel
Check that you are able to ping remote address
before creating a tunnel to it
Make sure that your EOIP tunnel will have
unique MAC-address (it should be from
EF:xx:xx:xx:xx:xx range)
Tunnel ID on both ends of the EOIP tunnel must
be the same – it helps to separate one tunnel
from other
© Ufoakses 2008 269
EoIP and Bridging
EoIP Interface can be bridged with any other
EoIP or Ethernet-like interface.
Main use of EoIP tunnels is to transparently
bridge remote networks.
EoIP protocol does not provide data encryption,
therefore it should be run over encrypted tunnel
interface, e.g., PPTP or PPPoE, if high security
is required.
© Ufoakses 2008 270
EOIP and Bridging
Any IP network
(LAN, WAN, Internet)
Bridge
Local network
192.168.0.101/24 - 192.168.0.255/24
Local network
192.168.0.1/24 - 192.168.0.100/24
Bridge
© Ufoakses 2008 271
EoIP Lab
Restore default system backup
Create EOIP tunnel with your neighbor(s)
Transfer to /22 private networks – this way you
will be in the same network with your neighbor,
and local addresses will remain the same
Bridge your private networks via EoIP
© Ufoakses 2008 272
/32 IP Addresses
IP addresses are added to the tunnel interfaces
Use /30 network to save address space, for
example:
10.1.6.1/30 and 10.1.6.2/30 from network
10.1.6.0/30
It is possible to use point to point addressing,
for example:
10.1.6.1/32, network 10.1.7.1
10.1.7.1/32, network 10.1.6.1
© Ufoakses 2008 273
EoIP and /30 Routing
Tunnel1: 1.1.1.1/30
Any IP
network
(LAN, WAN, Internet)
Tunnel2: 2.2.2.1/30
Tunnel3: 3.3.3.1/30
Tunnel3: 3.3.3.2/30
Tunnel2: 2.2.2.2/30
Tunnel1: 1.1.1.2/30
© Ufoakses 2008 274
EoIP and /32 Routing
Any IP network Tunnel1: 1.1.1.1/32
(LAN, WAN, Internet)
Tunnel2: 1.1.1.1/32
Tunnel3: 1.1.1.1/32
Tunnel3: 3.3.3.2/32
Tunnel2: 2.2.2.2/32
Tunnel1: 1.1.1.2/32
Network: 1.1.1.1
Network: 1.1.1.1
Network: 1.1.1.1
Network: 1.1.1.2
Network: 2.2.2.2
Network: 3.3.3.2
© Ufoakses 2008
Local User Database
PPP Profile, PPP Secret
© Ufoakses 2008 276
Point-to-Point protocol tunnels
A little bit sophisticated in configuration
Capable of authentication and data encryption
Such tunnels are:
PPPoE (Point-to-Point Protocol over Ethernet)
PPTP (Point-to-Point Tunneling Protocol)
L2TP (Layer 2 Tunneling Protocol)
You should create user information before
creating any tunnels
© Ufoakses 2008 277
PPP Secret
PPP secret (aka local PPP user database)
stores PPP user access records
Make notice that user passwords are displayed
in the plain text – anyone who has access to the
router are able to see all passwords
It is possible to assign specific /32 address to
both ends of the PPTP tunnel for this user
Settings in /ppp secret user database override
corresponding /ppp profile settings
© Ufoakses 2008 278
PPP Secret
© Ufoakses 2008 279
PPP Profile and IP Pools
PPP profiles define default values for user
access records stored under /ppp secret
submenu
PPP profiles are used for more than 1 user so
there must be more than 1 IP address to give
out - we should use IP pool as “Remote
address” value
Value “default” means – if option is coming from
RADIUS server it won't be overrided
© Ufoakses 2008 280
PPP Profile
© Ufoakses 2008 281
Change TCP MSS
Big 1500 byte packets have problems going
trought the tunnels because:
Standard Ethernet MTU is 1500 bytes
PPTP and L2TP tunnel MTU is 1460 bytes
PPPOE tunnel MTU is 1488 bytes
By enabling “change TCP MSS option, dynamic
mangle rule will be created for each active user
to ensure right size of TCP packets, so they will
be able to go through the tunnel
© Ufoakses 2008
PPTP and L2TP
Point-to-Point Tunnelling Protocol and
Layer 2 Tunnelling Protocol
© Ufoakses 2008 283
PPTP Tunnels
PPTP uses TCP port 1723 and IP protocol 47/
GRE
There is a PPTP-server and PPTP-clients
PPTP clients are available for and/or included
in almost all OS
You must use PPTP and GRE “NAT helpers” to
connect to any public PPTP server from your
private masqueraded network
© Ufoakses 2008 284
L2TP Tunnels
PPTP and L2TP have mostly the same
functionality
L2TP traffic uses UDP port 1701 only for link
establishment, further traffic is using any
available UDP port
L2TP don't have problems with NATed clients –
it don't required “NAT helpers”
Configuration of the both tunnels are identical in
RouterOS
© Ufoakses 2008 285
Creating PPTP/L2TP Client
© Ufoakses 2008 286
PPTP Client Lab
Restore system backup (slide 12)
Create PPTP client
Server Address:10.1.2.1
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the
internet
© Ufoakses 2008 287
Creating PPTP/L2TP server
© Ufoakses 2008 288
PPTP Server Lab
Create a PPTP server
Create one user in PPP Secret
Configure your laptop to connect to your PPTP
server
Make necessary adjustments to access the
Internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPTP-client on the laptop accordingly
© Ufoakses 2008 289
Optional: Advanced VPN Lab
Restore system backup (slide 12)
Create secure L2TP tunnel with your neighbor
Create EoIP tunnel over the L2TP tunnel
Bridge your networks together!
© Ufoakses 2008 290
User Access Control
Controlling the Hardware
Static IP and ARP entries
DHCP for assigning IP addresses and managing
ARP entries
Controlling the Users
PPPoE requires PPPoE client configuration
HotSpot redirects client request to the sign-up page
PPTP requires PPTP client configuration
© Ufoakses 2008
PPPoE
Point-to-Point Protocol over Ethernet
© Ufoakses 2008 292
PPPoE tunnels
PPPoE works in OSI 2nd (data link) layer
PPPoE is used to hand out IP addresses to
clients based on the user authentication
PPPoE requires a dedicated access
concentrator (server), which PPPoE clients
connect to.
Most operating systems have PPPoE client
software. Windows XP has PPPoE client
installed by default
© Ufoakses 2008 293
PPPoE client
© Ufoakses 2008 294
PPPoE Client Lab
Restore default system backup
Create PPTP client
Interface: wlan1
Service:pppoe
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the
internet
© Ufoakses 2008 295
PPPoE Client Status
Check your PPPoE connection
Is the interface enabled?
Is it “connected” and running (R)?
Is there a dynamic (D) IP address assigned to the
pppoe client interface in the IP Address list?
What are the netmask and the network address?
What routes do you have on the pppoe client
interface?
See the “Log” for troubleshooting!
© Ufoakses 2008 296
* PPPoE Lab with Encryption *
The PPPoE access concentrator is changed to
use encryption now
You should use encryption, either
change the ppp profile used for the pppoe client to
'default-encryption', or,
modify the ppp profile used for the pppoe client to
use encryption
See if you get the pppoe connection running
© Ufoakses 2008 297
PPPoE Server
PPPoE server accepts PPPoE client
connections on a given interface
Clients can be authenticated against
the local user database (ppp secrets)
a remote RADIUS server
a remote or a local MikroTik User Manager
database
Clients can have automatic data rate limitation
according to their profile
© Ufoakses 2008 298
Creating PPPoE server (service)
© Ufoakses 2008 299
PPPoE Server Lab
Create a PPPoE server
Create one user in PPP Secret
Configure your laptop to connect to your PPPoE
server
Make necessary adjustments to access the
internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPPoE-client on the laptop
accordingly
© Ufoakses 2008
PPP interface Bridging
PPP BCP (Bridge Control Protocol)
PPP MP (Multi-link Protocol)
© Ufoakses 2008 301
PPP Bridge Control Protocol
RouterOS now have BCP support for all async.
PPP, PPTP, L2TP & PPPoE (not ISDN)
interfaces
If BCP is established, PPP tunnel does not
require IP address
Bridged Tunnel IP address (if present) does not
applies to whole bridge – it stays only on PPP
interface (routed IP packets can go through the
tunnel as usual)
© Ufoakses 2008 302
Setting up BCP
You must specify bridge
option in the ppp profiles
on both ends of the
tunnel.
The bridge must have
manually set MAC
address, or at least one
regular interface in it,
because ppp interfaces
do not have MAC
addresses.
© Ufoakses 2008 303
PPP Bridging Problem
PPP interface MTU is smaller than standard
Ethernet interface
It is impossible to fragment Ethernet frames –
tunnels must have inner algorithm how to
encapsulate and transfer Ethernet frames via
link with smaller MTU
EOIP have encapsulation algorithm enabled by
default, PPP interfaces doesn't
PPP interfaces can utilize PPP Multi-link
Protocol to encapsulate Ethernet frames
© Ufoakses 2008 304
PPP Multi-link Protocol
PPP Multi-link Protocol allows to open multiple
simultaneous channels between systems
It is possible to split and recombine packets,
between several channels – resulting in
increase the effective maximum receive unit
(MRU)
To enable PPP Multi-link Protocol you must
specify MRRU option
In MS Windows you must enable "Negotiate
multi-link for single link connections" option
© Ufoakses 2008 305
PPP Multi-link Protocol
© Ufoakses 2008 306
PPP Bridging Lab
Restore default system backup
Create PPP tunnel with your neighbor(s)
Bridge PPP tunnels with your local interface
Ensure that MTU and MRU of the PPP link is at
least 1500 byte
Check the configuration using ping tool with
different packet size
BTW – using PPP MP (even without bridging) it is possible
to avoid MSS changes and all MSS related problems
© Ufoakses 2008
HotSpot
Plug-and-Play Access
© Ufoakses 2008 308
HotSpot
HotSpot is used for authentication in local
network
Authentication is based on HTTP/HTTPS
protocol meaning it can work with any Internet
browser
HotSpot is a system combining together
various independent features of RouterOS to
provide the so called ‘Plug-and-Play’ access
© Ufoakses 2008 309
How does it work?
User tries to open a
web page
Router checks if the
user is already
authenticated in the
HotSpot system
If not, user is redirected
to the HotSpot login
page
User specifies the login
information
© Ufoakses 2008 310
How does it work?
If the login information
is correct, then the
router
authenticates the client in the
Hotspot system;
opens the requested web
page;
opens a status pop-up
window
The user can access
the network through the
HotSpot gateway
© Ufoakses 2008 311
HotSpot Features
User authentication
User accounting by time, data transmitted/
received
Data limitation
by data rate
by amount
Usage restrictions by time
RADIUS support
Walled garden
© Ufoakses 2008 312
HotSpot Setup Wizard (Step 1)
© Ufoakses 2008 313
HotSpot Setup Wizard
Start the HotSpot setup wizard and select
interface to run the HotSpot on
Set address on the HotSpot interface
Choose whether to masquerade hotspot
network or not
Select address pool for the HotSpot
Select HotSpot SSL certificate if HTTPS is
required
© Ufoakses 2008 314
HotSpot Setup Wizard (Step 2-5)
© Ufoakses 2008 315
HotSpot Setup Wizard
Select SMTP server to automatically redirect
outgoing mails to local SMTP server, so the
clients need not to change their outgoing mail
settings
Specify DNS servers to be used by the router
and HotSpot users
Set DNS name of the local HotSpot server
Finally the wizard allows to create one HotSpot
user
© Ufoakses 2008 316
HotSpot Setup Wizard (Step 5-8)
© Ufoakses 2008 317
HotSpot Setup Wizard Lab
Create simple Hotspot server for your private
network using HotSpot Setup Wizard
Login and check the setup!
Logout
Type any random IP, netmask, gateway, DNS
values on your Laptop network configuration
Login and check the setup!
© Ufoakses 2008 318
HotSpot Server Setup Wizard
The preferred way to configure HotSpot server
Automatically creates configuration entries in
/ip hotspot
/ip hotspot profile
/ip hotspot users
/ip pool
/ip dhcp-server
/ip dhcp-server networks
/ip firewall nat (dynamic rules)
/ip firewall filter (dynamic rules)
© Ufoakses 2008 319
HotSpot Servers
© Ufoakses 2008 320
HotSpot Servers Profiles
HotSpot server profiles are used for
common server settings. Think of profiles
as of server groups
You can choose 6 different authentication
methods in profile settings
© Ufoakses 2008 321
HotSpot Server Profiles
© Ufoakses 2008 322
HotSpot Authentication Methods
HTTP PAP - simplest method, which shows the
HotSpot login page and expects to get the user
credentials in plain text (maximum compatibility
mode)
HTTP CHAP - standard method, which includes
CHAP computing for the string which will be sent to
the HotSpot gateway.
HTTPS – plain text authentication using SSL
protocol to protect the session
© Ufoakses 2008 323
HotSpot Authentication Methods
HTTP cookie - after each successful login, a
cookie is sent to the web browser and the same
cookie is added to active HTTP cookie list. This
method may only be used together with HTTP PAP,
HTTP CHAP or HTTPS methods
MAC address - authenticates clients as soon as
they appear in the hosts list, using client's MAC
address as user name
Trial - does not require authentication for a certain
amount of time
© Ufoakses 2008 324
HotSpot Users
© Ufoakses 2008 325
HotSpot Users
Bind username, password and profile for a
particular client
Limit a user by uptime, bytes-in and bytes-out
Assign an IP address for the client
Permit user connections only from particular
MAC address
© Ufoakses 2008 326
HotSpot User Profiles
© Ufoakses 2008 327
HotSpot User Profiles
Store settings common to groups of users
Allow to choose firewall filter chains for
incoming and outgoing traffic check
Allow to set a packet mark on traffic of every
user of this profile
Allow to rate limit users of the profile
© Ufoakses 2008 328
HotSpot IP Bindings
© Ufoakses 2008 329
HotSpot IP Bindings
Setup static NAT translations based on either
the original IP address (or IP network),
the original MAC address.
Allow some addresses to bypass HotSpot
authentication. Usefully for providing IP
telephony or server services.
Completely block some addresses.
© Ufoakses 2008 330
HotSpot HTTP-level Walled Garden
© Ufoakses 2008 331
HotSpot HTTP-level Walled Garden
Walled garden allows to bypass HotSpot
authentication for some resources
HTTP-level Walled Garden manages HTTP
and HTTPS protocols
HTTP-level Walled Garden works like Webproxy
filtering, you can use the same HTTP
methods and same regular expressions to
make an URL string
© Ufoakses 2008 332
HotSpot IP-level Walled Garden
IP-level Walled Garden works on the IP level,
use it like IP firewall filter
© Ufoakses 2008 333
HotSpot IP-level Walled Garden
© Ufoakses 2008 334
Hotspot Lab
Allow access to the www.mikrotik.com without
the Hotspot authentication
Allow access to your router's IP without the
Hotspot authentication
Create another user with 10MB download
limitation.
Check this user!
Allow your laptop to bypass the Hotspot.
© Ufoakses 2008 335
Login Page Customization
There are HTML template pages on the router
FTP for each active HotSpot profile
Those HTML pages contains variables which
will be replaced with the actual information by
the HotSpot before sending to the client
It is possible to modify those pages, but you
must directly download HTML pages from the
FTP to modify them correctly
© Ufoakses 2008 336
Customized Page Example
© Ufoakses 2008 337
User Manager for HotSpot
Centralized Authorization and Accounting
system
Works as a RADIUS server
Built in MikroTik RouterOS as a separate
package
© Ufoakses 2008 338
Requirements for User Manager
x86 based router with MikroTik RouterOS
v2.9.x
Router with at least 32MB RAM
Free 2MB of HDD space
RouterOS Level 4 license for
mo
re than 10 active sessions (in RouterOS v2.9.x)
© Ufoakses 2008 339
Features
User Authorization using PAP,CHAP
Multiple subscriber support and permission
management
Credits/Prepaid support for users
Rate-limit attribute support
User friendly WEB interface support
Report generation by time/amount
Detailed sessions and logs support
Simple user adding and voucher printing support
© Ufoakses 2008 340
New Features
User Authorization using MSCHAPv1,MSCHAPv2
User status page
User sign up system
Support for decimal places in credits
Authorize.net and PayPal payment gateway support
Database backup feature
License changes in RouterOS v3.0 for active users:
Level3 – 10 active users
Level4 – 20 active users
Level5 – 50 active users
Level6 – Unlimited active users
© Ufoakses 2008 341
Supported Services
Hotspot user authorization
PPP/PPtP/PPPoE users authorization,
Encryption also supported
DHCP MAC authorization
Wireless MAC authorization
RouterOS users authorization
© Ufoakses 2008 342
User Manager Usage
Hotels
Airports
Cafés
Universities
Companies
ISPs
© Ufoakses 2008 343
User Signup
User can create a new
account by filling out
the form. An account
activation email will be
sent to the users email
address
© Ufoakses 2008 344
Buying Prepaid Credit Time
Authorize.net/PayPal payment
support for buying a credit
Payment data (such as credit
card number and expiry date) is
sent directly from user's computer
to payment gateway and is not
captured by User Manager. User
Manager processes only
response about the payment
result from the payment gateway.
© Ufoakses 2008 345
Future plans
Still in development – BETA
New improved User Manager WEB interface
Radius Incoming (RFC3576)
Your suggestions are welcome...
support@mikrotik.com
Advanced Class
© Ufoakses 2008
Routing
Simple Routing, ECMP, OSPF, Policy
Routing,
© Ufoakses 2008 1
Simple Static Route
Only one gateway for
a single network
More specific routes
in the routing table
have higher priority
than less specific
Route with destination
network 0.0.0.0/0
basically means
“everything else”
© Ufoakses 2008 2
Simple Routing Lab
Ask teacher to join you in a group of 4 and
assign specific group number “Z”
Use any means necessary (cables, wireless) to
create IP network structure from the next slide
Remove any NAT (masquerade) rules from your
routers
By using simple static routes only ensure
connectivity between laptops, and gain access
to the internet.
© Ufoakses 2008 3
IP Network Structure
192.168.Z.192/26
192.168.Z.64/26
192.168.Z.128/26
192.168.Z.0/26
10.1.Z.0/30
To Main AP
To Laptop To Laptop
To Laptop
To Laptop
Z – your group number
© Ufoakses 2008 4
ECMP Routes
ECMP (Equal Cost
Multi Path) routes
have more than one
gateway to the same
remote network
Gateways will be
used in Round Robin
per SRC/DST
address combination
© Ufoakses 2008 5
“Check-gateway” option
It is possible to force router to check gateway
reachability using ICMP (ping) or ARP protocols
If gateway is unreachable in a simple route –
the route will become inactive
If one gateway is unreachable in an ECMP
route, only the reachable gateways will be used
in the Round Robin algorithm
© Ufoakses 2008 6
“Distance” option
It is possible to prioritize one route over another
if they both point to the same network using
“distance” option.
When forwarding a packet, the router will use
the route with the lowest distance and
reachable gateway
© Ufoakses 2008 7
ECMP Routing Lab
Remake your previously created routes, so that
there are two gateways to each of the other
participant's local networks 192.168.XY.0/24
and to the Internet
Also ensure that “backup link” (next slide) will
be used only when all other ways are not
accessible
© Ufoakses 2008 8
Advanced Routing
To Main AP
To Laptop
To Laptop
To Laptop
To Laptop
BACKUP
LINK
© Ufoakses 2008
Open Shortest Path First
(OSPF)
Areas, Costs, Virtual links,
Route Redistribution and Aggregation
© Ufoakses 2008 10
OSPF Protocol
Open Shortest Path First protocol uses a
link-state and Dijkstra algorithm to build and
calculate the shortest path to all known
destination networks
OSPF routers use IP protocol 89 for
communication with each other
OSPF distributes routing information between the
router
s
belonging to a single autonomous system (AS)
© Ufoakses 2008 11
Autonomous System (AS)
An autonomous system is a collection of IP
networks and routers under the control of one
entity (OSPF, iBGP ,RIP) that presents a
common routing policy to rest of the network
AS is identified by 16 bit number (0 - 65535)
Range from 1 to 64511 for use in the Internet
Range from 64512 to 65535 for private use
© Ufoakses 2008 12
OSPF Areas
OSPF allows collections of routers to be
grouped together (<80 routers in one group)
The structure of an area is invisible from the
outside of the area.
Each area runs a separate copy of the basic
link-state routing algorithm
OSPF areas are identified by
32
-
bit (4-byte) number (0.0.0.0 – 255.255.255.255)
Area ID must be unique within the AS
© Ufoakses 2008 13
OSPF AS
Area Area
Area Area
© Ufoakses 2008 14
Router Types
Autonomous System Border Router (ASBR) - a
router that is connected to more than one AS.
An ASBR is used to distribute routes received from
other ASes throughout its own AS
Area Border Router (ABR) - a router that is
connected to more than one OSPF area.
An ABR keeps multiple copies of the link-state
database in memory, one for each area
Internal Router (IR) – a router that is connected
only to one area
© Ufoakses 2008 15
Area Area
Area Area
ABR
ASBR
ABR
ASBR
ABR
OSPF AS
© Ufoakses 2008 16
Backbone Area
The backbone area (area-id=0.0.0.0) forms the
core of an OSPF network
The backbone is responsible for distributing
routing information between non-backbone
areas
Each non-backbone area must be connected to
the backbone area (directly or using virtual
links)
© Ufoakses 2008 17
Virtual Links
Also Used to connect two parts of a partitioned
backbone area through a non-backbone area
Used to connect
remote areas to
the backbone
area through a
non-backbone
area
© Ufoakses 2008 18
Virtual Link
ASBR
area-id=0.0.0.1
area-id=0.0.0.0
area-id=0.0.0.2 area-id=0.0.0.3
OSPF AS
© Ufoakses 2008 19
OSPF Areas
© Ufoakses 2008 20
OSPF Networks
You should use exact networks from router
interfaces (do not aggregate them)
It is necessary
to specify
networks and
associated
areas where to
look for other
OSPF routers
© Ufoakses 2008 21
OSPF Neighbour States
Full: link state
databases
completely
synchronized
2-Way:
bidirectional
communication
established
Down,Attempt,Init,Loading,ExStart,Exchange:
not completely running!
© Ufoakses 2008 22
OSPF Area Lab
Create your own area
area name «Area<Z>»
area-id=0.0.0.<Z>
Assign networks to the areas
Check your OSPF neighbors
Owner of the ABR should also configure
backbone area and networks
Main AP should be in ABR's OSPF neighbor list
© Ufoakses 2008 23
OSPF Settings
Router ID can be left as 0.0.0.0 then largest IP
address assigned to the router will be used
Router ID
must be
unique
within the
AS
© Ufoakses 2008 24
What to Redistribute?
1
3
{
5
2
}
4
Default route is not considered as static route
© Ufoakses 2008 25
Redistribution Settings
if-installed - send the default route only if it has
been installed (static, DHCP, PPP, etc.)
always - always send the default route
as-type-1 – remote routing decision to this
network will be made based on the sum of the
external and internal metrics
as-type-2 – remote routing decision to this
network will be made based only on external
metrics (internal metrics will become trivial)
© Ufoakses 2008 26
ASBR
Cost=10
Cost=10
Cost=10
Cost=10
Cost=10
Source
Cost=10
Cost=9 Destination
Total Cost=40
Total Cost=49
External Type 1 Metrics
© Ufoakses 2008 27
ASBR
Cost
trivial
Cost
trivial
Cost
trivial
Cost
trivial
Cost
trivial
Source
Cost=10
Cost=9 Destination
Total Cost=10
Total Cost=9
External Type 2 Metrics
© Ufoakses 2008 28
Redistribution Lab
Enable type 1 redistribution for all connected
routes
Take a look at the routing table
Add one static route to 172.16.XY.0/24 network
Enable type 1 redistribution for all static routes
Take a look at the routing table
© Ufoakses 2008 29
Interface Cost
Choose correct network type for the interface
All interfaces
have default
cost of 10
To override
default setting
you should add
new entry in
interface menu
© Ufoakses 2008 30
Designated Routers
To reduce OSPF traffic in NBMA and broadcast
networks, a single source for routing updates
was introduced - Designated Router (DR)
DR maintains a complete topology table of the
network and sends the updates to the others
Router with the highest priority (previous slide)
will be elected as DR
Router with next priority will be elected as
Backup DR (BDR)
Router with priority 0 will never be DR or BDR
© Ufoakses 2008 31
OSPF Interface Lab
Choose correct network type for all OSPF
interfaces
Assign costs (next slide) to ensure one way
traffic in the area
Check your routing table for ECMP routes
Assign necessary costs so backup link will be
used only when some other link fails
Check OSPF network redundancy!
Ensure ABR to be DR your area, but not in
backbone area
© Ufoakses 2008 32
Costs
To Main AP
To Laptop
To Laptop
To Laptop
To Laptop
ABR
BACKUP
LINK
100
100
100
100
10
10
10
10
???
???
© Ufoakses 2008 33
NBMA Neighbors
For non-broadcast
networks it is
necessary to
specify neighbors
manually
The priority determines the neighbor chance to
be elected as a Designated router
© Ufoakses 2008 34
Stub Area
A stub area is an area
which does not
receive AS external
routes.
Typically all routes to
external AS networks
can be replaced by
one default route. -
this route will be
created automatically
distributed by ABR
© Ufoakses 2008 35
Stub area (2)
«Inject Summary LSA» option allows to collect
separate backbone or other area router Link
State Advertisements (LSA) and inject it to the
stub area
Enable «Inject Summary LSA» option only on
ABR
«Inject Summary LSA» is not a route
aggregation
«Inject Summary LSA» cost is specified
by«Default area cost» option
© Ufoakses 2008 36
Not-So-Stubby Area (NSSA)
NSSA is a type of stub
area that is able to
transparently inject AS
external routes to the
backbone.
«Translator role» option
allow to control which
ABR of the NSSA area
will act as a relay from
ASBR to backbone
area
© Ufoakses 2008 37
Virtual Link
ASBR
area-id=0.0.0.1
area-id=0.0.0.0
area-id=0.0.0.2 area-id=0.0.0.3
NSSA Stub
default default
OSPF AS
© Ufoakses 2008 38
Area Type Lab
Set your area type to «stub»
Check your routing table for changes!
Make sure that default route redistribution on
the ABR is set to «never»
Set «Inject Summary LSA» option
on the ABR to «enable»
on the IR to «disable»
© Ufoakses 2008 39
Passive interface
Passive option allow you to disable OSPF
“Hello” protocol on client interfaces
It is necessary to
assign client
networks to the
area or else stub
area will consider
those networks as
external.
It is a security
issue!!!
© Ufoakses 2008 40
Area Ranges
Address ranges are used to aggregate
(replace) network routes from within the area
into one single route
It is possible
then to advertise
this aggregate
route or drop it
It is possible to
assign specific
cost to
aggregate route
© Ufoakses 2008 41
Route Aggregation Lab
Advertise only one 192.168.Z.0/24 route
instead of four /26 (192.168.Z.0/26, 192.168.Z.64/26,
192.168.Z.128/26, 192.168.Z.192/26) into the backbone
Stop advertising backup network to the
backbone
Check the Main AP's routing table
© Ufoakses 2008 42
Summary
For securing your OSPF network
Use authentication keys (for interfaces and areas)
Use highest priority (255) to designated router
Use correct network types for the area
To increase performance of OSPF network
Use correct area types
Use “Summary LSA” for stub areas
Use route aggregation as much as possible
© Ufoakses 2008 43
OSPF and Dynamic VPN Interfaces
Each dynamic VPN interface
creates a new /32 Dynamic, Active, Connected
(DAC) route in the routing table when appears
removes that route when disappears
Problems:
Each of these changes results in OSPF update, if
redistribute-connected is enabled (update flood in
large VPN networks)
OSPF will create and send LSA to each VPN
interface, if VPN network is assigned to any OSPF
area (slow performance)
© Ufoakses 2008 44
ABR
PPPoE
server
PPPoE
server
Area type = stub
Area1
~250 PPPoE clients
~ 100 PPPoE
clients
Type stub “PPPoE area”
© Ufoakses 2008 45
ABR
PPPoE
server
PPPoE
server
Area type = default
Area1
~250 PPPoE
clients
~ 100 PPPoE
clients
Type default “PPPoE area”
© Ufoakses 2008 46
“PPPoE area” Lab (discussion)
Give a solution for each problem mentioned
previously if used area type is “stub”
Try to find a solution for each problem
mentioned previously if used area type is
“default”
© Ufoakses 2008 47
OSPF Routing Filters
The routing filters may be applied to incoming
and outgoing OSPF routing update messages
Chain “ospf-in” for all incoming routing update
messages
Chain “ospf-out” for all outgoing routing update
messages
Routing filters can manage only external OSPF
routes (routes for the networks that are not
assigned to any OSPF area)
© Ufoakses 2008 48
Routing Filters
© Ufoakses 2008 49
Routing Filters and VPN
It is possible to create a routing filter rule to
restrict all /32 routes from getting into the OSPF
It is necessary to have one aggregate route to
this VPN network :
By having address from the aggregate VPN network
to the any interface of the router
Suggestion: place this address on the interface where
VPN server is running
Suggestion: use network address, the clients will not be
able to avoid your VPN service then
By creating static route to the router itself
© Ufoakses 2008 50
Routing filters Rule
© Ufoakses 2008
Bridging
Bridge, Admin MAC, Bridge ports, Bridge
firewall, STP and RSTP
© Ufoakses 2008 51
Bridge
Ethernet-like networks can be connected
together using OSI Layer 2 bridges
The bridge feature allows interconnection of
hosts connected to separate LANs as if they
were attached to a single LAN segment
Bridges extend the broadcast domain and
increase the network traffic on bridged LAN
© Ufoakses 2008 52
Bridge Configuration
Bridge is a virtual interface in RouterOS
Several bridges can be created
/interface bridge add name=bridge1
Interfaces are assigned as ports to a bridge
/interface bridge port add interface=ether1
bridge=bridge1
/interface bridge port add interface=ether2
bridge=bridge1
© Ufoakses 2008 53
Creating a Bridge
© Ufoakses 2008 54
Assigning Ports to the Bridge
© Ufoakses 2008 55
Spanning Tree Protocol
The Spanning Tree Protocol (STP)
is defined by IEEE Standard 802.1D
provides a loop free topology for any bridged LAN
discovers an optimal spanning tree within the mesh
network and disables the links that are not part of
the tree, thus eliminating bridging loops
© Ufoakses 2008 56
STP in Action
A
B
C
D
E F
Root
Bridge
© Ufoakses 2008 57
STP Root Bridge
Lowest priority
Lowest ID (MAC address)
Central point of the topology
Each bridge calculates shortest path to the Root
Bridge
© Ufoakses 2008 58
Spanning Tree
B A
C
D
E
F
Root
Bridge
© Ufoakses 2008 59
Rapid Spanning Tree Protocol
Rapid Spanning Tree Protocol (RSTP)
is an evolution of the STP
provides for faster spanning tree convergence after
a topology change than STP
rstp-bridge-test package is required for the
RSTP feature to be available in RouterOS
© Ufoakses 2008 60
RSTP Bridge Port Roles
Lowest priority for looped ports
Root port – a path to the root bridge
Alternative port – backup root port
Designated port – forwarding port
Backup port – backup designated port
© Ufoakses 2008 61
Routed Networks vs Bridging
Routers do not forward broadcast frames
Communication loops and their resultant
broadcast storms are no longer a design issue
in routed networks
Redundant media and meshed topologies can
offer traffic load sharing and more robust fault
tolerance than bridged network topologies
© Ufoakses 2008 62
Bridge Firewall
The bridge firewall implements packet filtering
and thereby provides security functions that are
used to manage data flow to, from and through
bridge
Elements of bridge firewall are:
Bridge Filter
Bridge Network Address Translation (NAT)
Bridge Broute
© Ufoakses 2008 63
Bridge Filter
Bridge filter has three predefined chains, input,
forward, and output
Example application is filtering broadcast traffic
© Ufoakses 2008 64
Bridge NAT
Bridge network address translation (NAT)
provides ways for changing source/destination MAC
addresses of the packets traversing a bridge
has two built-in chains
src-nat
dst-nat
Bridge NAT can be used for ARP
© Ufoakses 2008 65
Bridge Broute
Bridge Broute
makes bridge a brouter - router that performs
routing on some of the packets, and bridging - on
others
has one predefined chain, brouting, which is
traversed right after a packet enters an enslaved
interface before "Bridging Decision"
For example, IP can be routed, and everything
else bridged (IPX)
© Ufoakses 2008
Firewall
Firewall filters,
Network Intrusion Detection System (NIDS),
Network Address Translation (NAT)
© Ufoakses 2008 67
Firewall Filters Structure
Firewall filter rules are organized in chains
There are default and user-defined chains
There are three default chains
input – processes packets sent to the router
output – processes packets sent by the router
forward – processes packets sent through the
router
Every user-defined chain should subordinate to
at least one of the default chains
© Ufoakses 2008 68
Firewall Filter Structure Diagram
© Ufoakses 2008 69
Firewall Filters
The firewall filter facility is a tool for packet
filtering
Firewall filters consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 70
Filter Rules – Winbox View
© Ufoakses 2008 71
Firewall Filter Chains
You can direct traffic to user-defined chains
using action jump (and direct it back to the
default chain using action return)
Users can add any number of chains
User-defined chains are used to optimize the
firewall structure and make it more readable
and manageable
User-defined chains help to improve
performance by reducing the average number
of processed rules per packet
© Ufoakses 2008 72
User-Defined Chains
© Ufoakses 2008 73
Firewall Building Tactics
Accept only needed,
drop everything else
Drop all unneeded,
accept everything else
© Ufoakses 2008 74
Connection Tracking
Connection Tracking (or Conntrack) system is
the heart of firewall, it gathers and manages
information about all active connections.
By disabling the conntrack system you will lose
functionality of the NAT and most of the filter
and mangle conditions.
Each conntrack table entry represents
bidirectional data exchange
Conntrack takes a lot of CPU resources (disable
it, if you don't use firewall)
© Ufoakses 2008 75
Conntrack Placement
© Ufoakses 2008 76
Conntrack – Winbox View
© Ufoakses 2008 77
Condition: Connection State
Connection state is a status assigned to each
packet by conntrack system:
New – packet is opening a new connection
Related – packet is also opening a new connection,
but it is in some kind of relation to an already
established connection
Established – packet belongs to an already known
connection
Invalid – packet does not belong to any of the
known connections
Connection state ≠ TCP state
© Ufoakses 2008 78
Connection State
© Ufoakses 2008 79
First Rule Example
© Ufoakses 2008
Chain Input
Protecting the router – allowing only necessary
services from reliable source addresses with
agreeable load
© Ufoakses 2008 81
Chain Input Lab
Create 3 rules to ensure that only connectionstate
new packets will proceed through the
input filter
Drop all connection-state invalid packets
Accept all connection-state established packets
Accept all connection-state related packets
Create 2 rules to ensure that only you will be
able to connect to the router
Accept all packets from your laptop IP
Drop everything else
© Ufoakses 2008 82
Firewall Maintenance
Write comment for each firewall rule, to make
your firewall more manageable
Look at the rule counters, to determine rule
activity
Change rule position to get necessary order
Use action “passthrough” to determine amount
of traffic before applying any action
Use action “log” to collect detailed information
about traffic
© Ufoakses 2008 83
Action “log”
© Ufoakses 2008 84
RouterOS Services
© Ufoakses 2008 85
RouterOS Services Lab
Create rules to allow only necessary RouterOS
services to be accessed from the public network
Use action “log” to determine those services
Create rule to allow winbox, ssh and telnet
connection from the teacher's network
(10.1.2.0/24)
Arrange rules accordingly
Write comment for each firewall rule
© Ufoakses 2008 86
Important Issue
Firewall filters do not filter MAC level
communications
You should turn off MAC-telnet and MACWinbox
features at least on the public interface
You should disable network discovery feature,
so that the router do not reveal itself anymore
(“/ip neighbor discovery” menu)
© Ufoakses 2008 87
MAC-telnet and MAC-winbox
© Ufoakses 2008
Chain Forward
Protecting the customers from viruses and
protecting the Internet from the customers
© Ufoakses 2008 89
Chain Forward Lab
Create 3 rules to ensure that only connectionstate
new packets will proceed through the
chain forward (same as in the Chain Input Lab)
Create rules to close most popular ports of
viruses
Drop TCP and UDP port range 137-139
Drop TCP and UDP port 445
© Ufoakses 2008 90
Virus Port Filter
At the moment the are few hundreds active
trojans and less than 50 active worms
You can download the complete “virus port
blocker” chain (~330 drop rules with ~500
blocked virus ports) from
ftp://admin@10.1.1.254
Some viruses and trojans use standard services
ports and can not be blocked.
© Ufoakses 2008 91
Bogon IPs
There are ~4,3 billion IPv4 addresses
There are several IP ranges restricted in public
network
There are several of IP ranges reserved (not
used at the moment) for specific purposes
There are lots of unused IP ranges!!!
You can find information about all unused IP
ranges at:
http://www.cidr-report.org/as2.0/#Bogons
© Ufoakses 2008 92
Address List Lab
Make an address list of the most common
bogon IP addresses
© Ufoakses 2008 93
Address List Options
Instead of creating one
filter rule for each IP
network address, you
can create only one
rule for IP address list.
Use “Src./Dst. Address
List” options
Create an address list
in “/ip firewall addresslist”
menu
© Ufoakses 2008 94
Address Filtering Lab
Allow packets to enter your network only from
the valid Internet addresses
Allow packets to enter your network only to the
valid customer addresses
Allow packets to leave your network only from
the valid customers addresses
Allow packets to leave your network only to the
valid Internet addresses
© Ufoakses 2008 95
User-defined Chains
Firewall structure, chain reusability
© Ufoakses 2008 96
ICMP Protocol
Internet Control Message Protocol (ICMP) is
basic network troubleshooting tool, it should be
allowed to bypass the firewall
Typical IP router uses only five types of ICMP
messages (type:code)
For PING - messages 0:0 and 8:0
For TRACEROUTE – messages 11:0 and 3:3
For Path MTU discovery – message 3:4
Any other type ICMP messages should be
blocked
© Ufoakses 2008 97
ICMP Message Rule Example
© Ufoakses 2008 98
ICMP Chain Lab
Make a new chain – ICMP
Accept 5 necessary ICMP messages
Drop all other ICMP packets
Move all ICMP packets to the ICMP chain
Create an action “jump” rule in the chain Input
Place it accordingly
Create an action “jump” rule in the chain Forward
Place it accordingly
© Ufoakses 2008 99
ICMP Jump Rule
© Ufoakses 2008 100
Network Intrusion Types
Network intrusion is a serious security risk that
could result not only in temporary service
denial, but also in total refusal of network
service
We can point out 4 major network intrusion
types:
Ping flood
Port scan
DoS attack
DDoS attack
© Ufoakses 2008 101
Ping Flood
Ping flood usually
consists of loads of
random ICMP
messages
With “limit” condition it
is possible to bound
the rule match rate to
a given limit
This condition is often
used with action “log”
© Ufoakses 2008 102
Port Scan
Port Scan is sequential
TCP (UDP) port probing
PSD (Port scan
detection) works only for
TCP protocol
Low ports
From 0 to 1023
High ports
From 1024 to 65535
© Ufoakses 2008 103
Intrusion Protection Lab
Adjust all 5 accept rules in the chain ICMP to
match rate 5 packets per second with 5 packet
burst possibility
Create PSD protection
Create a PSD drop rule in the chain Input
Place it accordingly
Create a PSD drop rule in the chain Forward
Place it accordingly
© Ufoakses 2008 104
DoS Attacks
Main target for DoS attacks is consumption of
resources, such as CPU time or bandwidth, so
the standard services will get Denial of Service
(DoS)
Usually router is flooded with TCP/SYN
(connection request) packets. Causing the
server to respond with a TCP/SYN-ACK packet,
and waiting for a TCP/ACK packet.
Mostly DoS attackers are virus infected
customers
© Ufoakses 2008 105
DoS Attack Protection
All IP's with more than 10 connections to the
router should be considered as DoS attackers
With every dropped TCP connection we will
allow attacker to create new connection
We should implement DoS protection into 2
steps:
Detection - Creating a list of DoS attackers on the
basis of connection-limit
Suppression – applying restrictions to the detected
DoS attackers
© Ufoakses 2008 106
DoS Attack Detection
© Ufoakses 2008 107
DoS Attack Suppression
To bound the attacker
from creating a new
connections, we will
use action“tarpit”
We must place this
rule before the
detection rule or else
address-list entry will
rewrites all the time
© Ufoakses 2008 108
DDoS attacks
A Distributed Denial of
Service attack is very
similar to DoS attack
only it occurs from
multiple
compromised
systems
Only thing that could
help is “TCPSyn
Cookie” option in
conntrack system
© Ufoakses 2008
Network Address Translation
(NAT)
Destination NAT, Source NAT, NAT traversal
© Ufoakses 2008 110
NAT Types
As there are two IP addresses and ports in an
IP packet header, there are two types of NAT
The one, which rewrites source IP address and/or
port is called source NAT (src-nat)
The other, which rewrites destination IP address
and/or port is called destination NAT (dst-nat)
Firewall NAT rules process only the first packet of
each connection (connection state “new” packets)
© Ufoakses 2008 111
NAT Type Diagrams
SRC
NAT SRC DST NEW SRC DST
DST
NAT SRC DST SRC NEW DST
© Ufoakses 2008 112
Firewall NAT Structure
Firewall NAT rules are organized in chains
There are two default chains
dstnat – processes traffic sent to and through the
router, before it divides in to “input” and “forward”
chain of firewall filter.
srcnat – processes traffic sent from and through the
router, after it merges from “output” and “forward”
chain of firewall filter.
There are also user-defined chains
© Ufoakses 2008 113
IP Firewall Diagram
© Ufoakses 2008 114
Firewall NAT
The firewall NAT facility is a tool for rewriting
packet's header information.
Firewall NAT consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 115
NAT Rules - Winbox View
© Ufoakses 2008 116
NAT Actions
There are 6 specific actions in the NAT
dst-nat
redirect
src-nat
masquarade
netmap
same
There are 7 more actions in the NAT, but they
are exactly the same as in firewall filters
© Ufoakses 2008 117
Src-nat
Action “src-nat” changes packet's source
address and/or port to specified address and/or
port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources
behind specific public IP address
© Ufoakses 2008 118
Src-nat Rule Example
© Ufoakses 2008 119
Masquerade
Action “masquerade” changes packet's source
address router's address and specified port
This action can take place only in chain srcnat
Typical application: hide specific LAN resources
behind one dynamic public IP address
© Ufoakses 2008 120
Masquerade Rule Example
© Ufoakses 2008 121
Source NAT Issues
Hosts behind a NAT-enabled router do not have
true end-to-end connectivity:
connection initiation from outside is not possible
some TCP services will work in “passive” mode
src-nat behind several IP addresses is
unpredictable
some protocols will require so-called NAT helpers to
to work correctly (NAT traversal)
© Ufoakses 2008 122
NAT Helpers
You can specify ports for existing NAT helpers,
but you can not add new helpers
© Ufoakses 2008 123
Src-nat Lab
You have been assigned one “public” IP
address 172.16.0.XY/32
Assign it to the wireless interface
Add src-nat rule to “hide” your private network
192.168.XY.0/24 behind the “public” address
Connect from your laptop using winbox, ssh, or
telnet via your router to the main gateway
10.1.1.254
Check the IP address you are connecting from
(use “/user active print” on the main gateway)
© Ufoakses 2008 124
Dst-nat
Action “dst-nat” changes packet's destination
address and port to specified address and port
This action can take place only in chain dstnat
Typical application: ensure access to local
network services from public network
© Ufoakses 2008 125
Dst-nat Rule Example
© Ufoakses 2008 126
Redirect
Action “redirect” changes packet's destination
address to router's address and specified port
This action can take place only in chain dstnat
Typical application: transparent proxying of
network services (DNS,HTTP)
© Ufoakses 2008 127
Redirect Rule Example
© Ufoakses 2008 128
Redirect Lab
Capture all TCP and UDP port 53 packets
originated from your private network
192.168.XY.0/24 and redirect them to the router
itself.
Set your laptop's DNS server to some random
IP address
Clear your router's DNS cache
Try to open a previously unseen Internet page
Take a look at the DNS cache of the router
© Ufoakses 2008 129
Dst-nat Lab
Capture all TCP port 80 (HTTP) packets
originated from your private network
192.168.XY.0/24 and change destination
address to 10.1.2.1 using dst-nat rule
Clear your browser's cache on the laptop
Try browsing the Internet
© Ufoakses 2008 130
Netmap and Same
Netmap - creates a static 1:1 mapping of one
set of IP addresses to another one. Often used
to distribute public IP addresses to hosts on
private networks
Same - gives a particular client the same
source/destination IP address from the supplied
range for any connection. Used for services that
expect constant IP address for multiple
connections from the same client
© Ufoakses 2008
Firewall Mangle
IP packet marking and IP header fields adjustment
© Ufoakses 2008 132
What is Mangle?
The mangle facility allows to mark IP packets
with special marks.
These marks are used by other router facilities
to identify the packets.
Additionally, the mangle facility is used to
modify some fields in the IP header, like TOS
(DSCP) and TTL fields.
© Ufoakses 2008 133
Firewall Mangle
The firewall filter facility is a tool for packet
marking
Firewall filters consist from the sequence of IFTHEN
rules
0) IF <condition(s)> THEN <action>
1) IF <condition(s)> THEN <action>
2) IF <condition(s)> THEN <action>
If a packet doesn't meet all the conditions of the
rule, it will be sent on to the next rule.
If a packet meet all the conditions of the rule,
specified action will be performed on it.
© Ufoakses 2008 134
Firewall Mangle
© Ufoakses 2008 135
Mangle Structure
Mangle rules are organized in chains
There are five built-in chains:
Prerouting- making a mark before Global-In queue
Postrouting - making a mark before Global-Out
queue
Input - making a mark before Input filter
Output - making a mark before Output filter
Forward - making a mark before Forward filter
New user-defined chains can be added, as
necessary
© Ufoakses 2008 136
Mangle and Queue Diagram
(simple)
© Ufoakses 2008 137
Mangle actions
There are 7 more actions in the mangle:
mark-connection – mark connection (from a
single packet)
mark-packet – mark a flow (all packets)
mark-routing - mark packets for policy routing
change MSS - change maximum segment size of
the packet
change TOS - change type of service
change TTL - change time to live
strip IPv4 options
© Ufoakses 2008 138
Marking Connections
Use mark connection to identify one or group of
connections with the specific connection mark
Connection marks are stored in the connection
tracking table
There can be only one connection mark for one
connection.
Connection tracking helps to associate each
p
acket to a specific connection (connection mark)
© Ufoakses 2008 139
Mark Connection Rule
© Ufoakses 2008 140
Marking Packets
Packets can be marked
Indirectly. Using the connection tracking facility,
based on previously created connection marks
(faster)
Directly. Without the connection tracking - no
connection marks necessary, router will compare
each packet to a given conditions (this process
imitates some of the connection tracking features)
© Ufoakses 2008 141
Mark Packet Rule
© Ufoakses 2008 142
Mangle Lab
Mark all HTTP connections
Mark all packets from HTTP connections
Mark all ICMP packets
Mark all other connections
Mark all packets from other connections
Check the configuration
© Ufoakses 2008 143
Mangle Lab Result
© Ufoakses 2008
MikroTik RouterOS - QoS
Quality of Service
Simple limitation using Simple Queues.
Traffic marking using Firewall Mange.
Traffic prioritization using Queue Tree.
© Ufoakses 2008 145
Speed Limiting
Forthright control over data rate of inbound
traffic is impossible
The router controls the data rate indirectly by
dropping incoming packets
TCP protocol adapts itself to the effective
connection speed
Simple Queue is the easiest way to limit data
rate
© Ufoakses 2008 146
Simple Queues
Simple queues make data rate limitation easy.
One can limit:
Client's rx rate (client's download)
Client's tx rate (client's upload)
Client's tx + rx rate (client's aggregate)
While being easy to configure, Simple Queues
give control over all QoS features
© Ufoakses 2008 147
Simple Limitation
© Ufoakses 2008 148
Simple Queue Lab
Restore configuration backup (slide 12)
Create on simple queue to limit your local
network's upload/download data rate to
256Kbps/512Kbps
Check the limitation!
Create another simple queue to limit your
laptop's upload/download data rate to 64Kbps/
128Kbps
Check the limitation!
Reorder queues
© Ufoakses 2008 149
Limitation and QoS
QoS is not only limitation!
QoS is an attempt to use the existing resources
rationally (it is not of an interest not to use all
the available speed)
QoS balances and prioritizes the traffic flow and
prevents monopolizing the (always too narrow)
channel. That is why it is called “Quality of
Service”
© Ufoakses 2008 150
QoS Basic Principles
QoS is implemented not only by limitations, but
by additional queuing mechanism like:
Burst
Dual limitation
Queue hierarchy
Priority
Queue discipline
Queuing disciplines control the order and speed
of packets going out through the interface
© Ufoakses 2008 151
Burst
Burst is one of the means to ensure QoS
Bursts are used to allow higher data rates for a
short period of time
If an average data rate is less than burstthreshold,
burst could be used (actual data rate
can reach burst-limit)
Average data rate is calculated from the last
burst-time seconds
© Ufoakses 2008 152
Average Data Rate
Average data rate is calculated as follows:
burst-time is being divided into 16 periods
router calculates the average data rate of each
class over these small periods
Note, that the actual burst period is not equal
to the burst-time. It can be several times shorter
than the burst-time depending on the max-limit,
burst-limit, burst-threshold, and actual data rate
history (see the graph example on the next
slide)
© Ufoakses 2008 153
Limitation with Burst
© Ufoakses 2008 154
Limitation with Burst
© Ufoakses 2008 155
Burst Lab
Delete all previously created queues
Create a queue to limit your laptop upload/
download to 64Kbps/128Kbps
Set burst to this queue
burst-limit up to 128Kbps/256Kbps
burst-threshold 32Kbps/64Kbps
burst-time 20 seconds
Use bandwidth-test to test the limitations
© Ufoakses 2008 156
Advanced Burst Lab
Try to set burst-threshold for this queue to the
128Kbps/256Kbps
Try to set burst-threshold for this queue to the
64Kbps/128Kbps
Try to set burst-threshold for this queue to the
16Kbps/32Kbps
State the optimal burst configuration
© Ufoakses 2008 157
Interface Traffic Monitor
Open up interface menu in WinBox to see tx/rx
rates per interface
Open up any interface and select the “Traffic”
tab to see the graphs
Use the “monitor-traffic” command in terminal to
get the traffic data per one or more interfaces,
for example:
/interface monitor-traffic ether1
/interface monitor-traffic ether1,ether2,ether3
© Ufoakses 2008 158
Interface Traffic Monitor
© Ufoakses 2008 159
Torch Tool
Torch tool offers more detailed actual traffic
report for the interface
It's easier to use the torch in WinBox:
Go to “Tools” > “Torch”
Select an interface to monitor and click “Start”
Use “Stop” and “Start” to freeze/continue
Refine the output by selecting protocol and port
Double-click on specific IP address to fill in the Src.
Or Dst. Address field (0.0.0.0/0 is for any address)
© Ufoakses 2008 160
Torch Tools
© Ufoakses 2008 161
Dual Limitation
Advanced, better QoS
Dual limitation has two rate limits:
CIR (Committed Information Rate) – in worst case
scenario a flow will get its limit-at no matter what
(assuming we can actually send so much data)
MIR (Maximal Information Rate) – in best case
scenario a flow can get up to max-limit if there is
spare bandwidth
© Ufoakses 2008 162
Dual Limitation Example
MIR 1
MIR 2
Mbps
sec
Client1 traffic
Client2 traffic
MIR 1
MIR 2
Mbps
sec
CIR 1
CIR 2
Before After
© Ufoakses 2008 163
Dual Limitation Lab
Create one queue for limiting your laptop's
communication with the first test server
limit-at 86Kbps/172Kbps
max-limit to 172Kbps/384Kbps
dst-address <first test server>
Create one queue for limiting your laptop's
communication with the second test server
limit-at 86Kbps/172Kbps
max-limit to 172Kbps/384Kbps
dst-address <second test server>
© Ufoakses 2008 164
Parent Queue
It is hard for the router to detect exact speed of
Internet connection
To optimize usage of your Internet resources
and to ensure desired QoS operation you
should assign maximal available connection
speed manually
To do so, you should create one parent queue
with strict speed limitation and assign all your
queues to this parent queue
© Ufoakses 2008 165
Parent Queue
© Ufoakses 2008 166
Dual Limitation Lab
Create a parent queue
max-limit to 256Kbps/512Kbps
Assign both previously created queues to the
parent queue
Set parent option to “main_queue”
Test the limitations
© Ufoakses 2008 167
First Child Queue
© Ufoakses 2008 168
Second Child Queue
© Ufoakses 2008 169
Priority
8 is the lowest priority, 1 is the highest
Numeric difference between priorities is
irrelevant (two queues with priorities 1 and 8,
will have same relation as two queues with
priorities 1 and 2)
Queue with higher priority will reach its CIR
before the queue with lower priority
Queue with higher priority will reach its MIR
before the queue with lower priority
© Ufoakses 2008 170
Priority Lab
Adjust priorities in the “Dual Limitation Lab”
Check the limitations!
© Ufoakses 2008 171
Queue Disciplines
Queuing disciplines can be classified into two
groups by their influence on the traffic flow –
schedulers and shapers
Scheduler queues reorder the packet flow.
These disciplines limit the number of waiting
packets, not the data rate
Shaper queues control data flow speed. They
can also do a scheduling job
© Ufoakses 2008 172
Idealized Shapers
© Ufoakses 2008 173
Idealized Schedulers
© Ufoakses 2008 174
Queue types
Scheduler queues
BFIFO
PFIFO
RED
SFQ
Shaper queues
PCQ
© Ufoakses 2008 175
FIFO algorithm
PFIFO and BFIFO
FIFO queuing
disciplines do not
change packet order,
instead they
accumulate packets
until a defined limit is
reached
© Ufoakses 2008 176
RED algorithm
Random Early Detect (Random Early Drop)
Does not limit the speed; indirectly equalizes
users' data rates when the channel is full
When the average queue size reaches minthreshold,
RED randomly chooses which
arriving packet to drop
If the average queue size reaches maxthreshold,
all packets are dropped
Ideal for TCP traffic limitation
© Ufoakses 2008 177
RED algorithm
If real queue size is
much greater than maxthreshold,
then all excess
packets are dropped
© Ufoakses 2008 178
SFQ algorithm
Stochastic Fairness Queuing (SFQ) cannot limit
traffic at all. Its main idea is to equalize traffic
flows when your link is completely full.
The fairness of SFQ is ensured by hashing and
round-robin algorithms
Hashing algorithm is able to divides the session
traffic in up to 1024 sub queues. It can hold up
to 128 packets in memory simultaneously
The round-robin algorithm dequeues allot bytes
from each sub queue in a turn
© Ufoakses 2008 179
SFQ algorithm
After perturb seconds
the hashing algorithm
changes and divides
the session traffic to
different subqueues
© Ufoakses 2008 180
SFQ Example
SFQ should be used for equalizing similar
connection
Usually used to manage information flow to or
from the servers, so it can offer services to
every customer
Ideal for p2p limitation - it is possible to place
strict limitation without dropping connections
© Ufoakses 2008 181
PCQ algorithm
Per Connection Queue allows to choose
classifiers (one or more of src-address, dstaddress,
src-port, dst-port)
PCQ does not limit the number of sub flows
It is possible to limit the maximal data rate that
is given to each of the current sub flows
PCQ is memory consumptive!!
© Ufoakses 2008 182
PCQ algorithm
If you classify the
packets by srcaddress
then all
packets with different
source IP addresses
will be grouped into
different subqueues
© Ufoakses 2008 183
PCQ example
If ‘limit-at’ and ‘max-limit’ are set to ‘0’, then the
subqueues can take up all bandwidth available
for the parent
Set the PCQ Rate to ‘0’, if you do not want to
limit subqueues, i.e, they can use the bandwidth
up to ‘max-limit’, if available
© Ufoakses 2008 184
PCQ in Action
pcq-rate=128000
© Ufoakses 2008 185
PCQ in Action (cont.)
pcq-rate=0
© Ufoakses 2008 186
Queue Type Lab
Try RED algorithm in the last configuration
Check the limitations!
Try SFQ algorithm
Check the limitations!
Watch the teachers demonstration about
PCQ
© Ufoakses 2008
HTB
Hierarchical Token Bucket
© Ufoakses 2008 188
HTB
HTB mentioned before is not managed like
other queues
HTB is a hierarchical queuing discipline.
HTB is able to prioritize and group traffic flows
HTB is not co-existing with another queue on an
interface – there can only be one queue and
HTB is the one.
© Ufoakses 2008 189
HTB Algorithm
All the circles are queuing disciplines – a packet storage with
a
flow management algorithm (FIFO, RED, SFQ or PCQ)
© Ufoakses 2008 190
HTB
There are 3 HTB trees maintained by
RouterOS:
global-in
global-total
global-out
And one more for each interface
© Ufoakses 2008 191
Mangle and HTB
© Ufoakses 2008 192
HTB (cont.)
When packet travels through the router, it
passes all 4 HTB trees
When packet travels to the router, it passes only
global-in and global-total HTB.
When packet travels from the router, it passes
global-out, global-total and interface HTB.
© Ufoakses 2008 193
HTB Algorithm
In order of priority HTB satisfies all “limit-at”s for
leaf classes
When the “limit-at” is reached the class
becomes “yellow”
When the “max-limit” is reached the class
becomes “red”
© Ufoakses 2008 194
HTB Algorithm
Some attributes of HTB classes :
limit-at
max-limit
priority
Simple queues are executed by the HTB facility
in “global-out” ('direct' queue), “globalin”
('reverse' queue) and “global-total” ('total'
queue) trees
© Ufoakses 2008 195
Queue Tree
Another way to manage the traffic
© Ufoakses 2008 196
Tree Queue
© Ufoakses 2008 197
Queue Tree and Simple Queues
Tree queue can be placed in 4 different places:
Global-in (“direct” part of simple queues are placed
here automatically)
Global-out(“total” part of simple queues are placed
here automatically)
Global-total (“reverse” part simple queues are
placed here automatically)
Interface queue
If placed in same place Simple queue will take
traffic before Queue Tree
© Ufoakses 2008 198
Queue Tree
Queue tree is only one directional. There must
be one queue for download and one for upload
Queue tree queues work only with packet
marks. These marks should be created in the
firewall mangle
Queue tree allows to build complex queue
hierarchies
© Ufoakses 2008 199
Queue Tree Lab
Create queue tree:
Create a main queue
Create child queue for ICMP
Create child queue for HTTP
Create child queue for OTHER
Consume all the available traffic using
bandwidth-test and check the ping response
times
Set highest priority to ICMP
Check the ping response times
© Ufoakses 2008 200
Queue Tree Lab Result
© Ufoakses 2008 201
Wireless and Tunnels
Wireless Concepts, Encryption, User Manager,
WDS and Mesh, nStreme Protocol, VLAN,
PPPoE, PPTP, L2TP, IPSec
© Ufoakses 2008
MikroTik RouterOS - Wireless
Wireless Concepts, Encryption, WDS and Mesh,
NStreme Protocol
© Ufoakses 2008 203
Wireless Interface Mode Settings
bridge/ap-bridge – AP mode; bridge mode supports only one
client
station – a regular client (can not be bridged)
station-pseudobridge/station-pseudobridge-clone – client, which
can be bridged (implements MAC address translation)
alignment-only – for positioning antennas
nstreme-dual-slave – card will be used in nstreme-dual interface
wds-slave – works as ap-bridge mode but adapts to the WDS
peers frequency
station-wds – client, which can be bridged (AP should support
WDS feature)
© Ufoakses 2008 204
Wireless Station
Joins a Service Set
Follows the Access Point within the Scan List
Restrictions based on Connect List
© Ufoakses 2008 205
Finding Access Points
© Ufoakses 2008 206
Alignment Tool
© Ufoakses 2008 207
Wireless Sniffer Tool
© Ufoakses 2008 208
Wireless Standards
IEEE 802.11b
2.4GHz, 22MHz bandwidth
11Mbit max air rate
IEEE 802.11g
2.4GHz, 22MHz bandwidth
802.11b compatibility mode
54Mbit max air rate
IEEE 802.11a
5GHz, 20MHz bandwidth
54Mbit max air rate
© Ufoakses 2008 209
Band Variations
Double channel (40MHz) – 108Mbit max air rate
2.4ghz-g-turbo
5ghz-turbo
Half channel (10MHz) – 27Mbit max air rate
2ghz-10mhz
5ghz-10mhz
Quarter channel (5MHz) – 13.5Mbit max air rate
2ghz-5mhz
5ghz-5mhz
© Ufoakses 2008 210
Supported Frequencies
Wireless cards usually support the following
frequencies:
For all 2.4GHz bands: 2192-2539MHz
For all 5GHz bands: 4920-6100MHz
Your country regulations allow only particular
frequency ranges
Custom frequency license unlocks all
frequencies supported by the wireless hardware
© Ufoakses 2008 211
Channels- 802.11b/g
11 channels (US), 22 MHz wide
3 non-overlapping channels
3 Access Points can occupy same area without
interfering
1 2 3 4 5 6 7 8 9 10 11
2400
2483
© Ufoakses 2008 212
Channels- 802.11a
12 channels, 20 MHz wide
5 turbo channels, 40MHz wide
36 40
5150
44 48 52 56 60 64
5180 5200 5220 5240 5260 5280 5300 5320 5350
5210 5250 5290
149 153
5735
157 161
5745 5765 5785 5805 5815
5760 5800
42 50 58
152 160
© Ufoakses 2008 213
Winbox: Wireless Regulations
© Ufoakses 2008 214
Wireless Regulations
To follow all the regulations in your wireless
communication domain you must specify:
Country where wireless system will operate
Frequency mode as regulatory domain – you will
be able to use only allowed channels with allowed
transmit powers
Antenna gain of antenna attached to this router
DFS mode – periodically will check for less used
frequency and change to it
(Proprietary-extensions to post-2.9.25)
© Ufoakses 2008 215
Wireless Country Settings Lab
Open terminal
Issue “/interface wireless info print” command
Change country to “australia”
Issue “/interface wireless info print” command
Compare results
Set country back to 'no_country_set'
© Ufoakses 2008 216
Access Point
Creates wireless infrastructure
Participates in Wireless Area
Expects stations to follow its frequency (DFS)
Authentication based on Access List
© Ufoakses 2008 217
Frequency Usage Tool
Frequency Usage
Monitor looks only for
IEEE 802.11 frames
Interface is disabled
during the Frequency
usage monitor
© Ufoakses 2008 218
Wireless Snooper Tool
© Ufoakses 2008 219
Wireless AP/Station Lab
Work in pairs to make AP/Station connection
with your neighbor's router
Create a AP on the wlan1 interface in 5Ghz
band with SSID “apXY” where XY is your
number
On wlan2 interface create a station to connect
to your neighbor's AP (you need to know the
neighbor's AP SSID)
Make a backup from this configuration
© Ufoakses 2008 220
Registration Table
© Ufoakses 2008 221
Access Management
default-forwarding (on AP) – whether the
wireless clients may communicate with each
other directly (access list may override this
setting for some particular clients)
default-authentication – enables AP to register
a client even if it is not in access list. In turn for
client it allows to associate with AP not listed in
client's connect list
© Ufoakses 2008 222
Wireless Access List
Individual settings for each client in access list
will override the interface default settings
Access list entries can be made from the
registration table entries by using action 'Copy
to Access List'
Access list entries are ordered, just like in
firewall
Matching by all interfaces “interface=all”
“Time” - works just like in firewall
© Ufoakses 2008 223
Wireless Access list
© Ufoakses 2008 224
Wireless Access List
© Ufoakses 2008 225
Wireless Access List Lab
Check if the neighbor's wireless router is
connected to your AP interface (wlan1)
Disable the default interface settings on wlan1:
default-forwarding, default-authentication
Make sure that nobody is connected to your AP
Add access list entry with your neighbor's MAC
address and make sure it connects
© Ufoakses 2008 226
Wireless RADIUS Authentication
© Ufoakses 2008 227
Wireless Connect List
Allow or deny clients from connecting to specific
AP by using Connect list
Connect list entries can be made from the
registration table entries by using action 'Copy to
Access List'
Connect list entries are ordered, just like in
firewall
Used also for WDS links
© Ufoakses 2008 228
Wireless Connect List
1 2
3
© Ufoakses 2008 229
Wireless Connect List
© Ufoakses 2008 230
Wireless Connect List Lab
On the AP interface (wlan1) set SSID to
“CHAOS”
On the Station interface (wlan2) leave the SSID
field empty
Add connect list entry for wlan2 interface to
connect to your neighbor's AP (you will need
the neighbor's AP MAC address)
© Ufoakses 2008 231
Rate Dependency from Signal Level
Rates,
6 Mbps
Signal,
dBm
18 36 48
Card Receive
Sensitivity
9 12 24 54
-100
-60
Link signal
level
© Ufoakses 2008 232
Rate Jumping
You can optimize link performance, by avoiding
rate jumps, in this case link will work more
stable at 36Mbps rate
54Mbps
36Mbps
48Mbps
Recalibration Recalibration
5% of time
15% of time
80% of time
© Ufoakses 2008 233
Basic and Supported Rates
Supported rates –
client data rates
Basic rates – link
management data
rates
If router can't send
or receive data at
basic rate – link
goes down
© Ufoakses 2008 234
Wireless MultiMedia (WMM)
4 transmit queues with priorities:
1,2 – background
0,3 – best effort
4,5 – video
6,7 – voice
Priorities set by
Bridge or IP firewall
Ingress (VLAN or WMM)
DSCP
© Ufoakses 2008 235
Wireless Encryption
© Ufoakses 2008 236
Wireless Encryption
© Ufoakses 2008 237
Wireless Encryption Lab
Create a new security profile with options:
mode=dynamic-keys
authentication-type=wpa2-psk
group/unicast ciphers=aes-ccm
wpa2-key=wireless
Apply the new profile to wlan1 and check if the
neighbors wireless client connects
© Ufoakses 2008 238
Wireless Distribution System
WDS (Wireless Distribution System) allows
packets to pass from one AP to another, just as
if the APs were ports on a wired Ethernet switch
APs must use the same band and SSID and
operate on the same frequency in order to
connect to each other
WDS is used to make bridged networks across
the wireless links and to extend the span of the
wireless network
© Ufoakses 2008 239
Wireless Distribution System
WDS link can be created between wireless
interfaces in several mode variations:
bridge/ap-bridge – bridge/ap-bridge
bridge/ap-bridge – wds-slave
bridge/ap-bridge – station-wds
You must disable DFS setting when using WDS
with more than one AP
© Ufoakses 2008 240
Simple WDS Topologies
© Ufoakses 2008 241
Dynamic WDS Interface
It is created 'on the fly' and appears
u
nder wds menu as a dynamic interface ('D' flag)
When the link between WDS devices goes
down, attached IP addresses will slip off from
WDS interface
Specify “wds-default-bridge” parameter and
attach IP addresses to the bridge
© Ufoakses 2008 242
Dynamic WDS Configuration
WDS can be created between two APs, both
must have WDS (static or dynamic) feature
enabled
APs must have
same SSID or the
“WDS ignore SSID”
feature enabled
We must create a
bridge to use
dynamic wds feature
© Ufoakses 2008 243
Bridge Creation
© Ufoakses 2008 244
Dynamic WDS Lab
Create a bridge interface with protocol-mode=rstp
Make sure that wlan1 interface is set to “ap-bridge” mode
and choose with your neighbor an equal SSID
Enable the dynamic WDS mode on the wlan1 and specify
the default-wds-bridge option to use bridge1
Add 10.1.1.XY/24 IP to the bridge interface
Check your network: From Your router try to ping neighbors
router
Optional: Add ether1 to the bridge and change laptops IP to
10.1.1.1XY/24
© Ufoakses 2008 245
Static WDS
It should be created manually
It requires the destination MAC address and
master interface parameters to be specified
manually
Static WDS interfaces never disappear, unless
you disable or remove them
© Ufoakses 2008 246
Static WDS
To use static WDS
use “ap-bridge” mode
Set WDS mode to
“static” and WDS
default bridge to
“none”
Create static WDS
interfaces
© Ufoakses 2008 247
Static WDS Interface
© Ufoakses 2008 248
Static WDS Lab
Adjust setup from the previous lab, to use WDS
static mode
Configure your wireless card accordingly
Create the static WDS interface
Add necessary ports to the bridge
Optional: Add ether1 to the bridge and change
laptops IP to 10.1.1.1XY/24
© Ufoakses 2008 249
Station-WDS
© Ufoakses 2008 250
Station-WDS
Use station-wds
mode to create clients
with WDS capabilities
WDS-mode must be
disabled on the
wireless card
Now your wireless
interface will work in
the bridge
© Ufoakses 2008 251
Station-WDS Lab
Adjust setup from the previous lab, to use only
one router as access point and other router as
station with WDS capability
Optional: Switch places (AP becomes client,
client becomes AP) and repeat the setup.
Optional: Add ether1 to the bridge and change
laptops IP to 10.1.1.1XY/24
© Ufoakses 2008 252
Simple MESH using WDS
© Ufoakses 2008 253
WDS MESH
© Ufoakses 2008 254
Simple MESH
© Ufoakses 2008 255
Dual Band MESH
© Ufoakses 2008 256
MESH Network
© Ufoakses 2008 257
MikroTik Nstreme
Nstreme is MikroTik's
proprietary (i.e.,
incompatible with
other vendors)
wireless protocol
created to improve
point-to-point and
point-to-multipoint
wireless links.
© Ufoakses 2008 258
Nstreme Protocol
Benefits of Nstreme protocol:
Client polling
Very low protocol overhead per frame allowing
super-high data rates
No protocol limits on link distance
No protocol speed degradation for long link
distances
Dynamic protocol adjustment depending on
traffic type and resource usage
© Ufoakses 2008 259
Nstreme Protocol: Frames
framer-limit - maximal frame size
framer-policy - the method how to combine frames.
There are several methods of framing:
none - do not combine packets
best-fit - put as much packets as possible in one frame,
until the limit is met, but do not fragment packets
exact-size - same as best-fit, but with the last packet
fragmentation
dynamic-size - choose the best frame size dynamically
© Ufoakses 2008 260
Nstreme Lab
Restore configuration backup file
Route your private network together with your
neighbor's network
Enable N-streme and check link productivity
with different framer polices
© Ufoakses 2008 261
Nstreme Dual Protocol
MikroTik proprietary (i.e., incompatible with other vendors)
wireless protocol that works with a pair of wireless cards
(Atheros chipset cards only) – one transmitting, one
receiving
© Ufoakses 2008 262
Nstreme Dual Interface
Set both wireless cards
into
“nstreme_dual_slave”
mode
Create Nstreme dual
interface (press “plus”
button in wireless
interface window)
Use framer policy only if
necessary
© Ufoakses 2008
VPN
Virtual Private Networks
EoIP
PPTP, L2TP
PPPoE
© Ufoakses 2008 264
VPN Benefits
Enable communications between corporate
private LANs over
Public networks
Leased lines
Wireless links
Corporate resources (e-mail, servers, printers)
can be accessed securely by users having
granted access rights from outside (home, while
travelling, etc.)
© Ufoakses 2008
EoIP
Ethernet over IP
© Ufoakses 2008 266
EOIP (Ethernet Over IP) tunnel
MikroTik proprietary protocol.
Simple in configuration
Don't have authentication or data encryption
capabilities
Encapsulates Ethernet frames into IP protocol
47/gre packets, thus EOIP is capable to carry
MAC-addresses
EOIP is a tunnel with bridge capabilities
© Ufoakses 2008 267
Creating EoIP Tunnel
© Ufoakses 2008 268
Creating EoIP Tunnel
Check that you are able to ping remote address
before creating a tunnel to it
Make sure that your EOIP tunnel will have
unique MAC-address (it should be from
EF:xx:xx:xx:xx:xx range)
Tunnel ID on both ends of the EOIP tunnel must
be the same – it helps to separate one tunnel
from other
© Ufoakses 2008 269
EoIP and Bridging
EoIP Interface can be bridged with any other
EoIP or Ethernet-like interface.
Main use of EoIP tunnels is to transparently
bridge remote networks.
EoIP protocol does not provide data encryption,
therefore it should be run over encrypted tunnel
interface, e.g., PPTP or PPPoE, if high security
is required.
© Ufoakses 2008 270
EOIP and Bridging
Any IP network
(LAN, WAN, Internet)
Bridge
Local network
192.168.0.101/24 - 192.168.0.255/24
Local network
192.168.0.1/24 - 192.168.0.100/24
Bridge
© Ufoakses 2008 271
EoIP Lab
Restore default system backup
Create EOIP tunnel with your neighbor(s)
Transfer to /22 private networks – this way you
will be in the same network with your neighbor,
and local addresses will remain the same
Bridge your private networks via EoIP
© Ufoakses 2008 272
/32 IP Addresses
IP addresses are added to the tunnel interfaces
Use /30 network to save address space, for
example:
10.1.6.1/30 and 10.1.6.2/30 from network
10.1.6.0/30
It is possible to use point to point addressing,
for example:
10.1.6.1/32, network 10.1.7.1
10.1.7.1/32, network 10.1.6.1
© Ufoakses 2008 273
EoIP and /30 Routing
Tunnel1: 1.1.1.1/30
Any IP
network
(LAN, WAN, Internet)
Tunnel2: 2.2.2.1/30
Tunnel3: 3.3.3.1/30
Tunnel3: 3.3.3.2/30
Tunnel2: 2.2.2.2/30
Tunnel1: 1.1.1.2/30
© Ufoakses 2008 274
EoIP and /32 Routing
Any IP network Tunnel1: 1.1.1.1/32
(LAN, WAN, Internet)
Tunnel2: 1.1.1.1/32
Tunnel3: 1.1.1.1/32
Tunnel3: 3.3.3.2/32
Tunnel2: 2.2.2.2/32
Tunnel1: 1.1.1.2/32
Network: 1.1.1.1
Network: 1.1.1.1
Network: 1.1.1.1
Network: 1.1.1.2
Network: 2.2.2.2
Network: 3.3.3.2
© Ufoakses 2008
Local User Database
PPP Profile, PPP Secret
© Ufoakses 2008 276
Point-to-Point protocol tunnels
A little bit sophisticated in configuration
Capable of authentication and data encryption
Such tunnels are:
PPPoE (Point-to-Point Protocol over Ethernet)
PPTP (Point-to-Point Tunneling Protocol)
L2TP (Layer 2 Tunneling Protocol)
You should create user information before
creating any tunnels
© Ufoakses 2008 277
PPP Secret
PPP secret (aka local PPP user database)
stores PPP user access records
Make notice that user passwords are displayed
in the plain text – anyone who has access to the
router are able to see all passwords
It is possible to assign specific /32 address to
both ends of the PPTP tunnel for this user
Settings in /ppp secret user database override
corresponding /ppp profile settings
© Ufoakses 2008 278
PPP Secret
© Ufoakses 2008 279
PPP Profile and IP Pools
PPP profiles define default values for user
access records stored under /ppp secret
submenu
PPP profiles are used for more than 1 user so
there must be more than 1 IP address to give
out - we should use IP pool as “Remote
address” value
Value “default” means – if option is coming from
RADIUS server it won't be overrided
© Ufoakses 2008 280
PPP Profile
© Ufoakses 2008 281
Change TCP MSS
Big 1500 byte packets have problems going
trought the tunnels because:
Standard Ethernet MTU is 1500 bytes
PPTP and L2TP tunnel MTU is 1460 bytes
PPPOE tunnel MTU is 1488 bytes
By enabling “change TCP MSS option, dynamic
mangle rule will be created for each active user
to ensure right size of TCP packets, so they will
be able to go through the tunnel
© Ufoakses 2008
PPTP and L2TP
Point-to-Point Tunnelling Protocol and
Layer 2 Tunnelling Protocol
© Ufoakses 2008 283
PPTP Tunnels
PPTP uses TCP port 1723 and IP protocol 47/
GRE
There is a PPTP-server and PPTP-clients
PPTP clients are available for and/or included
in almost all OS
You must use PPTP and GRE “NAT helpers” to
connect to any public PPTP server from your
private masqueraded network
© Ufoakses 2008 284
L2TP Tunnels
PPTP and L2TP have mostly the same
functionality
L2TP traffic uses UDP port 1701 only for link
establishment, further traffic is using any
available UDP port
L2TP don't have problems with NATed clients –
it don't required “NAT helpers”
Configuration of the both tunnels are identical in
RouterOS
© Ufoakses 2008 285
Creating PPTP/L2TP Client
© Ufoakses 2008 286
PPTP Client Lab
Restore system backup (slide 12)
Create PPTP client
Server Address:10.1.2.1
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the
internet
© Ufoakses 2008 287
Creating PPTP/L2TP server
© Ufoakses 2008 288
PPTP Server Lab
Create a PPTP server
Create one user in PPP Secret
Configure your laptop to connect to your PPTP
server
Make necessary adjustments to access the
Internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPTP-client on the laptop accordingly
© Ufoakses 2008 289
Optional: Advanced VPN Lab
Restore system backup (slide 12)
Create secure L2TP tunnel with your neighbor
Create EoIP tunnel over the L2TP tunnel
Bridge your networks together!
© Ufoakses 2008 290
User Access Control
Controlling the Hardware
Static IP and ARP entries
DHCP for assigning IP addresses and managing
ARP entries
Controlling the Users
PPPoE requires PPPoE client configuration
HotSpot redirects client request to the sign-up page
PPTP requires PPTP client configuration
© Ufoakses 2008
PPPoE
Point-to-Point Protocol over Ethernet
© Ufoakses 2008 292
PPPoE tunnels
PPPoE works in OSI 2nd (data link) layer
PPPoE is used to hand out IP addresses to
clients based on the user authentication
PPPoE requires a dedicated access
concentrator (server), which PPPoE clients
connect to.
Most operating systems have PPPoE client
software. Windows XP has PPPoE client
installed by default
© Ufoakses 2008 293
PPPoE client
© Ufoakses 2008 294
PPPoE Client Lab
Restore default system backup
Create PPTP client
Interface: wlan1
Service:pppoe
User: admin
Password: admin
Add default route = yes
Make necessary adjustments to access the
internet
© Ufoakses 2008 295
PPPoE Client Status
Check your PPPoE connection
Is the interface enabled?
Is it “connected” and running (R)?
Is there a dynamic (D) IP address assigned to the
pppoe client interface in the IP Address list?
What are the netmask and the network address?
What routes do you have on the pppoe client
interface?
See the “Log” for troubleshooting!
© Ufoakses 2008 296
* PPPoE Lab with Encryption *
The PPPoE access concentrator is changed to
use encryption now
You should use encryption, either
change the ppp profile used for the pppoe client to
'default-encryption', or,
modify the ppp profile used for the pppoe client to
use encryption
See if you get the pppoe connection running
© Ufoakses 2008 297
PPPoE Server
PPPoE server accepts PPPoE client
connections on a given interface
Clients can be authenticated against
the local user database (ppp secrets)
a remote RADIUS server
a remote or a local MikroTik User Manager
database
Clients can have automatic data rate limitation
according to their profile
© Ufoakses 2008 298
Creating PPPoE server (service)
© Ufoakses 2008 299
PPPoE Server Lab
Create a PPPoE server
Create one user in PPP Secret
Configure your laptop to connect to your PPPoE
server
Make necessary adjustments to access the
internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPPoE-client on the laptop
accordingly
© Ufoakses 2008
PPP interface Bridging
PPP BCP (Bridge Control Protocol)
PPP MP (Multi-link Protocol)
© Ufoakses 2008 301
PPP Bridge Control Protocol
RouterOS now have BCP support for all async.
PPP, PPTP, L2TP & PPPoE (not ISDN)
interfaces
If BCP is established, PPP tunnel does not
require IP address
Bridged Tunnel IP address (if present) does not
applies to whole bridge – it stays only on PPP
interface (routed IP packets can go through the
tunnel as usual)
© Ufoakses 2008 302
Setting up BCP
You must specify bridge
option in the ppp profiles
on both ends of the
tunnel.
The bridge must have
manually set MAC
address, or at least one
regular interface in it,
because ppp interfaces
do not have MAC
addresses.
© Ufoakses 2008 303
PPP Bridging Problem
PPP interface MTU is smaller than standard
Ethernet interface
It is impossible to fragment Ethernet frames –
tunnels must have inner algorithm how to
encapsulate and transfer Ethernet frames via
link with smaller MTU
EOIP have encapsulation algorithm enabled by
default, PPP interfaces doesn't
PPP interfaces can utilize PPP Multi-link
Protocol to encapsulate Ethernet frames
© Ufoakses 2008 304
PPP Multi-link Protocol
PPP Multi-link Protocol allows to open multiple
simultaneous channels between systems
It is possible to split and recombine packets,
between several channels – resulting in
increase the effective maximum receive unit
(MRU)
To enable PPP Multi-link Protocol you must
specify MRRU option
In MS Windows you must enable "Negotiate
multi-link for single link connections" option
© Ufoakses 2008 305
PPP Multi-link Protocol
© Ufoakses 2008 306
PPP Bridging Lab
Restore default system backup
Create PPP tunnel with your neighbor(s)
Bridge PPP tunnels with your local interface
Ensure that MTU and MRU of the PPP link is at
least 1500 byte
Check the configuration using ping tool with
different packet size
BTW – using PPP MP (even without bridging) it is possible
to avoid MSS changes and all MSS related problems
© Ufoakses 2008
HotSpot
Plug-and-Play Access
© Ufoakses 2008 308
HotSpot
HotSpot is used for authentication in local
network
Authentication is based on HTTP/HTTPS
protocol meaning it can work with any Internet
browser
HotSpot is a system combining together
various independent features of RouterOS to
provide the so called ‘Plug-and-Play’ access
© Ufoakses 2008 309
How does it work?
User tries to open a
web page
Router checks if the
user is already
authenticated in the
HotSpot system
If not, user is redirected
to the HotSpot login
page
User specifies the login
information
© Ufoakses 2008 310
How does it work?
If the login information
is correct, then the
router
authenticates the client in the
Hotspot system;
opens the requested web
page;
opens a status pop-up
window
The user can access
the network through the
HotSpot gateway
© Ufoakses 2008 311
HotSpot Features
User authentication
User accounting by time, data transmitted/
received
Data limitation
by data rate
by amount
Usage restrictions by time
RADIUS support
Walled garden
© Ufoakses 2008 312
HotSpot Setup Wizard (Step 1)
© Ufoakses 2008 313
HotSpot Setup Wizard
Start the HotSpot setup wizard and select
interface to run the HotSpot on
Set address on the HotSpot interface
Choose whether to masquerade hotspot
network or not
Select address pool for the HotSpot
Select HotSpot SSL certificate if HTTPS is
required
© Ufoakses 2008 314
HotSpot Setup Wizard (Step 2-5)
© Ufoakses 2008 315
HotSpot Setup Wizard
Select SMTP server to automatically redirect
outgoing mails to local SMTP server, so the
clients need not to change their outgoing mail
settings
Specify DNS servers to be used by the router
and HotSpot users
Set DNS name of the local HotSpot server
Finally the wizard allows to create one HotSpot
user
© Ufoakses 2008 316
HotSpot Setup Wizard (Step 5-8)
© Ufoakses 2008 317
HotSpot Setup Wizard Lab
Create simple Hotspot server for your private
network using HotSpot Setup Wizard
Login and check the setup!
Logout
Type any random IP, netmask, gateway, DNS
values on your Laptop network configuration
Login and check the setup!
© Ufoakses 2008 318
HotSpot Server Setup Wizard
The preferred way to configure HotSpot server
Automatically creates configuration entries in
/ip hotspot
/ip hotspot profile
/ip hotspot users
/ip pool
/ip dhcp-server
/ip dhcp-server networks
/ip firewall nat (dynamic rules)
/ip firewall filter (dynamic rules)
© Ufoakses 2008 319
HotSpot Servers
© Ufoakses 2008 320
HotSpot Servers Profiles
HotSpot server profiles are used for
common server settings. Think of profiles
as of server groups
You can choose 6 different authentication
methods in profile settings
© Ufoakses 2008 321
HotSpot Server Profiles
© Ufoakses 2008 322
HotSpot Authentication Methods
HTTP PAP - simplest method, which shows the
HotSpot login page and expects to get the user
credentials in plain text (maximum compatibility
mode)
HTTP CHAP - standard method, which includes
CHAP computing for the string which will be sent to
the HotSpot gateway.
HTTPS – plain text authentication using SSL
protocol to protect the session
© Ufoakses 2008 323
HotSpot Authentication Methods
HTTP cookie - after each successful login, a
cookie is sent to the web browser and the same
cookie is added to active HTTP cookie list. This
method may only be used together with HTTP PAP,
HTTP CHAP or HTTPS methods
MAC address - authenticates clients as soon as
they appear in the hosts list, using client's MAC
address as user name
Trial - does not require authentication for a certain
amount of time
© Ufoakses 2008 324
HotSpot Users
© Ufoakses 2008 325
HotSpot Users
Bind username, password and profile for a
particular client
Limit a user by uptime, bytes-in and bytes-out
Assign an IP address for the client
Permit user connections only from particular
MAC address
© Ufoakses 2008 326
HotSpot User Profiles
© Ufoakses 2008 327
HotSpot User Profiles
Store settings common to groups of users
Allow to choose firewall filter chains for
incoming and outgoing traffic check
Allow to set a packet mark on traffic of every
user of this profile
Allow to rate limit users of the profile
© Ufoakses 2008 328
HotSpot IP Bindings
© Ufoakses 2008 329
HotSpot IP Bindings
Setup static NAT translations based on either
the original IP address (or IP network),
the original MAC address.
Allow some addresses to bypass HotSpot
authentication. Usefully for providing IP
telephony or server services.
Completely block some addresses.
© Ufoakses 2008 330
HotSpot HTTP-level Walled Garden
© Ufoakses 2008 331
HotSpot HTTP-level Walled Garden
Walled garden allows to bypass HotSpot
authentication for some resources
HTTP-level Walled Garden manages HTTP
and HTTPS protocols
HTTP-level Walled Garden works like Webproxy
filtering, you can use the same HTTP
methods and same regular expressions to
make an URL string
© Ufoakses 2008 332
HotSpot IP-level Walled Garden
IP-level Walled Garden works on the IP level,
use it like IP firewall filter
© Ufoakses 2008 333
HotSpot IP-level Walled Garden
© Ufoakses 2008 334
Hotspot Lab
Allow access to the www.mikrotik.com without
the Hotspot authentication
Allow access to your router's IP without the
Hotspot authentication
Create another user with 10MB download
limitation.
Check this user!
Allow your laptop to bypass the Hotspot.
© Ufoakses 2008 335
Login Page Customization
There are HTML template pages on the router
FTP for each active HotSpot profile
Those HTML pages contains variables which
will be replaced with the actual information by
the HotSpot before sending to the client
It is possible to modify those pages, but you
must directly download HTML pages from the
FTP to modify them correctly
© Ufoakses 2008 336
Customized Page Example
© Ufoakses 2008 337
User Manager for HotSpot
Centralized Authorization and Accounting
system
Works as a RADIUS server
Built in MikroTik RouterOS as a separate
package
© Ufoakses 2008 338
Requirements for User Manager
x86 based router with MikroTik RouterOS
v2.9.x
Router with at least 32MB RAM
Free 2MB of HDD space
RouterOS Level 4 license for
mo
re than 10 active sessions (in RouterOS v2.9.x)
© Ufoakses 2008 339
Features
User Authorization using PAP,CHAP
Multiple subscriber support and permission
management
Credits/Prepaid support for users
Rate-limit attribute support
User friendly WEB interface support
Report generation by time/amount
Detailed sessions and logs support
Simple user adding and voucher printing support
© Ufoakses 2008 340
New Features
User Authorization using MSCHAPv1,MSCHAPv2
User status page
User sign up system
Support for decimal places in credits
Authorize.net and PayPal payment gateway support
Database backup feature
License changes in RouterOS v3.0 for active users:
Level3 – 10 active users
Level4 – 20 active users
Level5 – 50 active users
Level6 – Unlimited active users
© Ufoakses 2008 341
Supported Services
Hotspot user authorization
PPP/PPtP/PPPoE users authorization,
Encryption also supported
DHCP MAC authorization
Wireless MAC authorization
RouterOS users authorization
© Ufoakses 2008 342
User Manager Usage
Hotels
Airports
Cafés
Universities
Companies
ISPs
© Ufoakses 2008 343
User Signup
User can create a new
account by filling out
the form. An account
activation email will be
sent to the users email
address
© Ufoakses 2008 344
Buying Prepaid Credit Time
Authorize.net/PayPal payment
support for buying a credit
Payment data (such as credit
card number and expiry date) is
sent directly from user's computer
to payment gateway and is not
captured by User Manager. User
Manager processes only
response about the payment
result from the payment gateway.
© Ufoakses 2008 345
Future plans
Still in development – BETA
New improved User Manager WEB interface
Radius Incoming (RFC3576)
Your suggestions are welcome...
support@mikrotik.com
الاشتراك في:
التعليقات (Atom)