Mikrotik 2011UiAS-2HnD - Neophyte - Ooo Q&A ooO

AfricanTech

AfricanTech

Honorary Master
Joined
Mar 19, 2010
Messages
45,668
Reaction score
20,448
Location
In front of a computer...
:o

No idea why I decided to take the plunge and get one of these devices for my home network - there wasn't anything seriously wrong with the existing setup, but after hearing Sinbad wax lyrical, I decided "why not"

Only problem of course is that I have nowhere near the level of knowledge required to actually manage this beastie effectively, so I'm hoping that the experts here won't mind answering my really, really basic questions.

The OP will be used to describe my current scenario and what I did for the initial setup (just to get things going).

Oh, will also be watching this video as recommended in this thread before I start asking questions.

=================

Pre Mikrotik Setup:

1 x TP Link ADSL Modem/Router
1 x TP Link 4 port Switch (cheapie - R100)
2 x Ubiquiti Wireless Transmitters

ADSL line plugged into TP-Link Modem/Router
TP-Link WiFi disabled
Ubiquiti's plugged into TP-Link Modem/Router
TP-Link Switch plugged into TP-Link Modem/Router

Main PC (mine) plugged into TP-Link Modem/Router
Wife PC - plugged into TP-Link Switch
Media PC - plugged into TP-Link Switch

Ubiquiti's servicing:
1 x MacBook
1 x Dell Laptop (occasionally)
1 x AppleTV
1 x PS3
4 x iPad
1 x Android Tablet
2 x iPhone
1 x Android Phone
Assorted intermittent family members cellphones/tablets/laptops

Post Mikrotik setup:

1 x TP Link ADSL Modem/Router [Configured in Bridge mode; DHCP server off
1 x Mikrotik 2011UiAS-2HnD [Firmware 3.18]
2 x Ubiquiti Wireless Transmitters

Main PC - Eth2
Ubiquiti 1 - Eth3
Ubiquiti 2 - Eth4
Wife PC - Eth5
Media PC - Eth6

Ubiquiti's servicing:
1 x MacBook
1 x Dell Laptop (occasionally)
1 x Roku 3
1 x PS3
4 x iPad
1 x Android Tablet
2 x iPhone
1 x Android Phone
Assorted intermittent family members cellphones/tablets/laptops

=======================

Setup:
Not too bad once I got past the faux pas and botherations listed below - I used the "HomeAP" Quickset, filled in the blanks, and that was basically it.


Faux pas committed when initially setting up:
1. Forgot to switch off DHCP on the TP-Link <------ :erm: much grief and hair pulling until I remembered

Dislikes / Botherations:
1. The LCD 'touch panel' is really shyte to use - why they bothered is beyond comprehension
2. For the love of all that is holy I could not obtain a stable setup when I changed the base IP from default [existing network was all on 192.168.0.xxx range with some machines on static ip's so I didn't particularly want to switch to the 192.168.88.xxx range] - after much frustration and hair pulling I gave up, reset the MT to default and got everything setup.
3. Wireless network - whenever I switched it off on the MT (with two Ubiquitis dont need it), the setup became unstable, so eventually just left it on and configured it to have the same name and other credentials as the existing so that it's 'transparent'

Noob questions to follow.
 
Question 1:

How do I see what my line speed is on the ISP link? On the TP-Link I could see it on Device Info page where it listed the "Upstream" and "Downstream" speeds.

Question 2:

How can I / can I browse to the TP-Link (it's plugged into Eth1 and is of course on a different subnet address)

Question 3:

Is there an easy way to setup switching ISP's on a schedule or even on an ah-hoc basis?
 
Answer 1:
You still need to log in on your TP-Link ADSL modem if you want to see your ADSL line's speed, noise margins, etc.

Answer 2:
Make sure that your Mikrotik has an IP address on Eth1 that is on the same subnet as the TP-Link modem.
If your TP-Link modem supports static routes, then you can add a static route on it, where the gateway is the IP address of your Mikrotik on its Eth1 port and the route/subnet mask is that of your home network (eg. 192.168.88.0 mask 255.255.255.0).

I often find that the ADSL modems' static routes don't work properly, in which case I ignore the static route and simply add a masquerade rule in the Mikrotik's firewall for the Eth1 interface.
eg. /ip firewall nat add chain=srcnat action=masquerade out-interface=eth1-modem

Answer 3:
It can take a while to setup initially, but once you've done that, its quick and easy to switch between ISPs.

There are quite a number of ways to switch between ISPs:
  • (easy) Disable pppoe-isp1, enable pppoe-isp2 < not preferred, because some ISPs don't allow immediate re-authentication again when you want to revert immediately
  • (easy) Disable 0.0.0.0/0 route via pppoe-isp1 and enable 0.0.0.0/0 route via pppoe-isp2 < also not preferred, because all your existing connections/downloads till terminate as with #1
  • (difficult) Setup firewall mangle rules to do connection marking and then add mangle rules to mark the routing on certain (or all) connections. You'll also need to add 0.0.0.0/0 routes for the routing marks.
    eg.
    /ip route add dst-address=0.0.0.0/0 gateway=pppoe-isp1 routing-mark=isp1
    /ip route add dst-address=0.0.0.0/0 gateway=pppoe-isp2 routing-mark=isp2

    - This option is the most complex to setup, but it would allow you to switch to the other ISP for all new connections, whilst keeping the existing connections in tact.
    - You can either route all the new connections to the other ISP, or you can go and route certain traffic (like I'm routing news server traffic) via the other ISP

    For more details on policy based routing, see http://blog.butchevans.com/2008/09/mikrotik-policy-routing-implementation-example/
 
If you're dialing PPPoE connections from your MikroTik, which you are, then you MUST ensure that you're blocking new incoming connections, otherwise people would be able to log into your MikroTik router from the Internet!

Like here is my most basic firewall filter rules in a multi PPPoE connection setup, where I allow all already established connections and allow incoming PPTP (port 1723) connections, but drop everything else that is new from the Internet to my router:
Code: 
/ip firewall filter
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-afrihost jump-target=input-internet
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-webafrica jump-target=input-internet
add action=accept chain=input-internet comment="Allow established connections from Internet to router" connection-state=established
add action=accept chain=input-internet comment="Allow PPTP VPN connections from Internet to router" dst-port=1723 protocol=tcp
add action=drop chain=input-internet comment="Drop other connections from Internet to router"

The reason why I'm using custom chains, is so that I can share the same set of rules for all my PPPoE connections. With RouterOS 6, you can actually do this slightly differently, because they have a classifier for pppoe connections I believe.

There are many more things that you can block or allow with your firewall, but for that you can read up on the wiki pages and other examples :)
 
The LCD is terrible as a touch screen but you can configure what to show on it from webfig, so mine just shows the throughput graph of my isp connection permanently.
My tplink adsl router is on the same ip subnet as the rest of my network so I can reach it from anywhere, which is useful for checking line stats and also for doing pppoe from other devices.
Trick for doing this was to add the pppoe client onto the bridge, not a single port, though I guess it should work if I put it into the master port as well.
 
Pada said:
If you're dialing PPPoE connections from your MikroTik, which you are, then you MUST ensure that you're blocking new incoming connections, otherwise people would be able to log into your MikroTik router from the Internet!

Like here is my most basic firewall filter rules in a multi PPPoE connection setup, where I allow all already established connections and allow incoming PPTP (port 1723) connections, but drop everything else that is new from the Internet to my router:
Code: 
/ip firewall filter
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-afrihost jump-target=input-internet
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-webafrica jump-target=input-internet
add action=accept chain=input-internet comment="Allow established connections from Internet to router" connection-state=established
add action=accept chain=input-internet comment="Allow PPTP VPN connections from Internet to router" dst-port=1723 protocol=tcp
add action=drop chain=input-internet comment="Drop other connections from Internet to router"

The reason why I'm using custom chains, is so that I can share the same set of rules for all my PPPoE connections. With RouterOS 6, you can actually do this slightly differently, because they have a classifier for pppoe connections I believe.

There are many more things that you can block or allow with your firewall, but for that you can read up on the wiki pages and other examples :)
Click to expand...
Pada, thanks so much.

[-]Can I copypasta the code block above into the terminal without modification?[/-]

see below
 
Last edited:
Pada said:
If you're dialing PPPoE connections from your MikroTik, which you are, then you MUST ensure that you're blocking new incoming connections, otherwise people would be able to log into your MikroTik router from the Internet!

Like here is my most basic firewall filter rules in a multi PPPoE connection setup, where I allow all already established connections and allow incoming PPTP (port 1723) connections, but drop everything else that is new from the Internet to my router:
Code: 
/ip firewall filter
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-afrihost jump-target=input-internet
add action=jump chain=input comment="to Internet input chain" in-interface=pppoe-webafrica jump-target=input-internet
add action=accept chain=input-internet comment="Allow established connections from Internet to router" connection-state=established
add action=accept chain=input-internet comment="Allow PPTP VPN connections from Internet to router" dst-port=1723 protocol=tcp
add action=drop chain=input-internet comment="Drop other connections from Internet to router"

The reason why I'm using custom chains, is so that I can share the same set of rules for all my PPPoE connections. With RouterOS 6, you can actually do this slightly differently, because they have a classifier for pppoe connections I believe.

There are many more things that you can block or allow with your firewall, but for that you can read up on the wiki pages and other examples :)
Click to expand...

Hmm, I used this link http://superuser.com/questions/6792...ule-block-all-connection-except-to-vpn-server to setup the firewall blocking rule.

ok - took your examples above, changed the in-interface to my one (I presume it's the one i find when I click the "PPP" button (there was only one there so straightforward).

Immediately noticed that I can now connect to the MT via Winbox but not via my browser.

Learning, learning
 
Last edited:
Just be very careful with dropping/rejecting traffic, because you can easily log yourself out that way.

A very handy feature in that regard is the Safe Mode, which you can activate by opening the Terminal and pressing CTRL+X to activate Safe Mode.
With Safe Mode, settings will be reverted if you lose connectivity to the terminal, which is very handy. Otherwise the settings get saved as soon as you press CTRL+X again to end Safe Mode.

Learning how to setup MikroTik routers is quite a learning curve, but it can be quite fun / challenging :)
Like I've actually went for a 3 day beginners training course on MikroTik routers, which was worth it for me ...
 
Pada said:
Just be very careful with dropping/rejecting traffic, because you can easily log yourself out that way.

A very handy feature in that regard is the Safe Mode, which you can activate by opening the Terminal and pressing CTRL+X to activate Safe Mode.
With Safe Mode, settings will be reverted if you lose connectivity to the terminal, which is very handy. Otherwise the settings get saved as soon as you press CTRL+X again to end Safe Mode.

Learning how to setup MikroTik routers is quite a learning curve, but it can be quite fun / challenging :)
Like I've actually went for a 3 day beginners training course on MikroTik routers, which was worth it for me ...
Click to expand...

I figured that out so read what you and that link had to say very carefully.

Worst comes to worst (with all the malarkey I went through yesterday) I'd reset the thing to factory and start over (that I can do easily now :o )

Everything still seems to be working ok after applying those settings - so far so good...

Thanks for the tips
 
Take backups of your config as well, so if you do have to reset, you can recover to a point in time rather than restarting.
 
Sinbad said:
The LCD is terrible as a touch screen but you can configure what to show on it from webfig, so mine just shows the throughput graph of my isp connection permanently.
My tplink adsl router is on the same ip subnet as the rest of my network so I can reach it from anywhere, which is useful for checking line stats and also for doing pppoe from other devices.
Trick for doing this was to add the pppoe client onto the bridge, not a single port, though I guess it should work if I put it into the master port as well.
Click to expand...

Hmm, I was specifically told to ensure that the TPLink is on a different subnet

1. What you're saying is to do the following:

Change TP-Link IP to be same as the MT IP (+1)

ie

MT IP: 192.168.88.1
TP-Link IP: 192.168.88.2

(MT is set to start doling out DHCP in the range 192.168.88.10 - 254)

2. and I would do that how? (or is it in the thread you posted where you discovered you had a dud MT)

Edit: I used km2's method below (steps 1 and 2) and it worked brilliantly
 
Last edited:
I didn't want to do the whole thing of putting my modem on the same subnet as my main network, so I ended up telling it to NAT traffic for the modem's IP address out over the ether1 port rather than going via the default gateway of my ISP.

It was something like (where my main subnet is 192.168.88.x, Mikrotik on 192.168.88.1, IP address 192.168.10.1 for the modem, 192.168.10.30 was the IP for the Mikrotik on the modem subnet, and the ether1-gateway was the name of the port the modem was connected to):

1. Give RouterOS an IP address on the subnet and interface that the modem is on

/ip address add address=192.168.10.30/24 interface=ether1-gateway network=192.168.10.0

2. Tell RouterOS to masquerade traffic destined for the modem to it.

/ip firewall nat add action=masquerade chain=srcnat dst-address=192.168.10.1 out-interface=ether1-gateway

What I cannot remember was if I had to change the ISP masquerade rule to be dst-address=!192.168.10.1 to prevent it from still trying to gobble the packets.

As for the other question regarding scheduled or ad-hoc ISP switching, I do what Pada had as option #2 (easy, default route changing, but drops active connections), and then add a System->Script that is called by a System->Scheduler frequently that runs the following script to change it between certain hours:

Code: 
:if (([/system clock get time] > "21:00:00") or ([/system clock get time] < "09:00:00")) do={/ip route set [/ip route find dst-address=0.0.0.0/0 (routing-mark).""=""] gateway="WebAfrica Download Plus"} else={/ip route set [/ip route find dst-address=0.0.0.0/0 (routing-mark).""=""] gateway="Other ISP"}

(the routing marks that Pada talks about are also really useful to be able to route traffic from specific applications like Steam over one ISP using Windows and DSCP policy, or from a particular "downloader" computer you may have on the network)
 
Last edited:
Sinbad said:
Take backups of your config as well, so if you do have to reset, you can recover to a point in time rather than restarting.
Click to expand...

Oh, and also along with the binary backups you do, consider using:

/export compact

to give you the list of commands you can paste back into the router to restore your config to the way it was. Really useful for seeing all the custom settings applied as well as being able to pick and choose pieces to restore.
 
Will be paying attention to this thread as well..

I need to get some time to sit down and do a proper setup on my MT as well...
 
km2 said:
I didn't want to do the whole thing of putting my modem on the same subnet as my main network, so I ended up telling it to NAT traffic for the modem's IP address out over the ether1 port rather than going via the default gateway of my ISP.

It was something like (where my main subnet is 192.168.88.x, Mikrotik on 192.168.88.1, IP address 192.168.10.1 for the modem, 192.168.10.30 was the IP for the Mikrotik on the modem subnet, and the ether1-gateway was the name of the port the modem was connected to):

1. Give RouterOS an IP address on the subnet and interface that the modem is on

/ip address add address=192.168.10.30/24 interface=ether1-gateway network=192.168.10.0

2. Tell RouterOS to masquerade traffic destined for the modem to it.

/ip firewall nat add action=masquerade chain=srcnat dst-address=192.168.10.1 out-interface=ether1-gateway

What I cannot remember was if I had to change the ISP masquerade rule to be dst-address=!192.168.10.1 to prevent it from still trying to gobble the packets.
Click to expand...

Thank you very much.

Finally got around to doing this and it works like an absolute charm.

Didn't have to do anything beyond instruction 2

Happiness
 
Pada said:
- You can either route all the new connections to the other ISP, or you can go and route certain traffic (like I'm routing news server traffic) via the other ISP
Click to expand...

I presume that I can also set it up so that only traffic from a specific device on the local network is routed to a specific ISP
 
AfricanTech said:
I presume that I can also set it up so that only traffic from a specific device on the local network is routed to a specific ISP
Click to expand...

I'm a little more rusty on this kind of setup. Used to do it with WebAfrica + OpenWeb, where OpenWeb provided uncapped data throughout the day for my local servers downloading, but WebAfrica was used for regular usage until the evening when OpenWeb would be used for everything. I switched from that setup to a pure time of day switching thing with WebAfrica + Afrihost, but still have the old configuration info.

Make sure you have routes added that will accept the routing mark for your account, where "Uncapped" is the name of my PPPoE Client and "via-uncapped" is the name of the routing mark I tag any data I want to go over it:

1. Tell it that anything with the routing mark must be sent out via the correct interface

Code: 
/ip route add distance=1 gateway=Uncapped routing-mark=via-uncapped

2. If my Uncapped connection was down I didn't want it to automatically fall back to using my regular premium data account, so I added another route at a distance of 2 that would block it from going out via the default gateway.

Code: 
/ip route add distance=2 routing-mark=via-uncapped type=unreachable

3. Add the rule that tags all packets coming from the specific machine (in my case my server was 192.168.88.251) with the specific routing mark.

Code: 
/ip firewall mangle add action=mark-routing chain=prerouting new-routing-mark=via-uncapped passthrough=no src-address=192.168.88.251
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X