..

RB750GL Setup

Build my own environment for network experiment!

I want to make an environment for developing and testing. And that environment totally belongs to me.

Scenario

  • RouterBOARD RB750GL
    • MikroTik RouterOS 5.25
  • PC
    • XenServer 6.2
 mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
E                                                       3
E                        Internet                       3
E                                                       3
 wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
    |
    |
    |
    |
    |                                    +----+   +----+
    | 10.113.215.193/24                  | VM |...| VM |
+---+----------+                        ++----+---+----++
|   1          |  (DHCP, NAT)           |               |
| (Gateway)   2+------------------------+               |
|             3| 192.168.88.1/24        |      PC       |
|             4|                        |   XenServer   |
|  RB750GL    5|                        |               |
|              |                        |               |
+--------------+                        +---------------+
                                        192.168.88.154/24

Connect with Internet

Configure IP address, gateway and DNS server

/ip address add address=10.113.215.193/24 interface=ether1-gateway
/ip route add dst-address=0.0.0.0/0 gateway=ether1-gateway
/ip dns set servers=10.113.235.1,8.8.8.8

To test connectivity, try to do this

/tool flood-ping 8.8.8.8

NTP (Network Time Protocol)

Synchronize time with 3.asia.pool.ntp.org using NTP

/system ntp client set enabled=yes mode=unicast primary-ntp=77.235.14.49 secondary-ntp=212.26.18.43

To verify that NTP client is running

/system ntp client print

Upgrade RouterOS

Check what version RB750GL is running currently

/system package update print

Update RouterOS from 5.25 to 5.26

/system package update check-for-updates
/system package update download

By issuing /system package update print you’ll see the percentage of download progress. When it is done, upgrade the OS

/system package update upgrade

RB750GL will auto reboot immediately. When it is ready, ssh into it you’ll see

MMM      MMM       KKK                          TTTTTTTTTTT      KKK
MMMM    MMMM       KKK                          TTTTTTTTTTT      KKK
MMM MMMM MMM  III  KKK  KKK  RRRRRR     OOOOOO      TTT     III  KKK  KKK
MMM  MM  MMM  III  KKKKK     RRR  RRR  OOO  OOO     TTT     III  KKKKK
MMM      MMM  III  KKK KKK   RRRRRR    OOO  OOO     TTT     III  KKK KKK
MMM      MMM  III  KKK  KKK  RRR  RRR   OOOOOO      TTT     III  KKK  KKK

MikroTik RouterOS 5.26 (c) 1999-2013       http://www.mikrotik.com/

The upgrading procedure was done successfully.

DHCP (Dynamic Host Configuration Protocol) Server

Giving XenServer a static IP

/ip dhcp-server lease add address=192.168.88.154 mac-address=f4:6d:04:79:80:ff

Firewall

There were bunch of rules set already. If there were not, you can try these

/ip firewall filter add action=accept chain=input comment="default configuration" disabled=no protocol=icmp
/ip firewall filter add action=accept chain=input comment="default configuration" connection-state=established disabled=no
/ip firewall filter add action=accept chain=input comment="default configuration" connection-state=related disabled=no
/ip firewall filter add action=drop chain=input comment="default configuration" disabled=no in-interface=ether1-gateway
/ip firewall filter add action=accept chain=forward comment="default configuration" connection-state=established disabled=no
/ip firewall filter add action=accept chain=forward comment="default configuration" connection-state=related disabled=no
/ip firewall filter add action=drop chain=forward comment="default configuration" connection-state=invalid disabled=no

Reminder: Firewall rules are traversed in order.

NAT (Network Address Translation)

To allow VMs inside LAN have full access to the Internet, one thing to do is masquerade packets send to the outer network

/ip firewall nat add action=masquerade chain=srcnat comment="default configuration" disabled=no out-interface=ether1-gateway

If you want remote client to access internal services, e.g. SSH, HTTP, RDP, etc., destination NAT is needed

/ip firewall nat add action=dst-nat chain=dstnat disabled=no dst-port=2222 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.155 to-ports=22

VPN (Virtual Private Network) Server

Setting up PPTP (Point-to-Point Tunneling Protocol) server. First, we need to allocate a IP pool for VPN clients

/ip pool add name=pptp_pool1 range=192.168.88.5-192.168.88.9

/ppp profile add name=pptp_profile local-address=192.168.88.1 remote-address=pptp_pool1
/ppp secret add name=doreremimi password=51402991 service=pptp profile=pptp_profile
/interface pptp-server server set enable=yes

After the setting was done, the connection of VPN should be allowed through the firewall

/ip firewall filter add chain=input in-interface=ether1-gateway protocol=tcp dst-port=1723 action=accept

The connection states could be checked throuth this command

/interface pptp-server monitor

Now, VPN clients can only ping RB750GL’s LAN IP. If you want to communicate with other PCs or servers in the LAN, one thing you have to do is enabling proxy ARP on the local port

/interface ethernet set ether2-master-local arp=proxy-arp

References