wn/minimal-setups
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Mikrotik, 6
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
Wolfgang Hottgenroth
2025-04-15 22:31:50 +02:00
parent 4fb3782d50
commit 7cdae2df42
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
content/snippets/0250-configuring-a-mikrotik.md
View File

@ -34,7 +34,8 @@ Second step, PPPoE:
```
/interface/pppoe-client
add comment="3. Layer for Telekom FTTH" interface=telekom-layer2 name=telekom-layer3 user=XXX password=YYY
add comment="3. Layer for Telekom FTTH" interface=telekom-layer2 name=telekom-layer3 \
user=XXX password=YYY
```
Here, the earlier created VLAN interface `telekom-layer2` to used.
@ -56,7 +57,8 @@ Additional a masquarading rule in the firewall configuration is required:
```
/ip/firewall/nat
add action=masquerade chain=srcnat comment="nat on wan" log=no log-prefix=masq out-interface=telekom-layer3
add action=masquerade chain=srcnat comment="nat on wan" log=no log-prefix=masq \
out-interface=telekom-layer3
```
And finally a DNS server (I was a bit surprised that it was not configured dynamically.):
@ -74,7 +76,8 @@ This was an easy task, however, since I had to rework the whole firewall filter
```
/ip/firewall/nat
add action=dst-nat chain=dstnat comment="http server" dst-address-type=local dst-port=80 log=no log-prefix=http-server protocol=tcp to-addresses=10.0.1.100
add action=dst-nat chain=dstnat comment="http server" dst-address-type=local dst-port=80 \
log=no log-prefix=http-server protocol=tcp to-addresses=10.0.1.100
```
This rule says: any access to a local address (one that is configured directly on the router) on port 80/tcp is forwarded to the address 10.0.1.100. That is the address
@ -105,7 +108,8 @@ In the end I came to this rule:
```
/ip/firewall/nat
add action=masquerade chain=srcnat comment="Generic Hairpin NAT Rule, remember to maintain the lists CLIENTS and SERVICES" \
add action=masquerade chain=srcnat \
comment="Generic Hairpin NAT Rule, remember to maintain the lists CLIENTS and SERVICES" \
dst-address-list=SERVICES log=yes log-prefix=hairpin1 src-address-list=CLIENTS
```