From 7cdae2df421b8e8087edf5f3942a5cef81527ef8 Mon Sep 17 00:00:00 2001 From: Wolfgang Hottgenroth Date: Tue, 15 Apr 2025 22:31:50 +0200 Subject: [PATCH] Mikrotik, 6 --- content/snippets/0250-configuring-a-mikrotik.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/content/snippets/0250-configuring-a-mikrotik.md b/content/snippets/0250-configuring-a-mikrotik.md index c9e1fc5..cad107d 100644 --- a/content/snippets/0250-configuring-a-mikrotik.md +++ b/content/snippets/0250-configuring-a-mikrotik.md @@ -34,7 +34,8 @@ Second step, PPPoE: ``` /interface/pppoe-client -add comment="3. Layer for Telekom FTTH" interface=telekom-layer2 name=telekom-layer3 user=XXX password=YYY +add comment="3. Layer for Telekom FTTH" interface=telekom-layer2 name=telekom-layer3 \ + user=XXX password=YYY ``` Here, the earlier created VLAN interface `telekom-layer2` to used. @@ -56,7 +57,8 @@ Additional a masquarading rule in the firewall configuration is required: ``` /ip/firewall/nat -add action=masquerade chain=srcnat comment="nat on wan" log=no log-prefix=masq out-interface=telekom-layer3 +add action=masquerade chain=srcnat comment="nat on wan" log=no log-prefix=masq \ + out-interface=telekom-layer3 ``` And finally a DNS server (I was a bit surprised that it was not configured dynamically.): @@ -74,7 +76,8 @@ This was an easy task, however, since I had to rework the whole firewall filter ``` /ip/firewall/nat -add action=dst-nat chain=dstnat comment="http server" dst-address-type=local dst-port=80 log=no log-prefix=http-server protocol=tcp to-addresses=10.0.1.100 +add action=dst-nat chain=dstnat comment="http server" dst-address-type=local dst-port=80 \ + log=no log-prefix=http-server protocol=tcp to-addresses=10.0.1.100 ``` This rule says: any access to a local address (one that is configured directly on the router) on port 80/tcp is forwarded to the address 10.0.1.100. That is the address @@ -105,7 +108,8 @@ In the end I came to this rule: ``` /ip/firewall/nat -add action=masquerade chain=srcnat comment="Generic Hairpin NAT Rule, remember to maintain the lists CLIENTS and SERVICES" \ +add action=masquerade chain=srcnat \ + comment="Generic Hairpin NAT Rule, remember to maintain the lists CLIENTS and SERVICES" \ dst-address-list=SERVICES log=yes log-prefix=hairpin1 src-address-list=CLIENTS ```