8/1/2014

Schedule
09:00 10:30 Morning Session I
10:30 11:00 Morning Break

MikroTik RouterOS Training

User Management

11:00 12:30 Morning Session II

12:30 13:30 Lunch Break

13:30 15:00 Afternoon Session I

15:00 15:30 Afternoon Break

15:30 17:00 (18:00) Afternoon Session II

Vahid Shahbazian fard jahromy

www.LearnMikroTik.ir
LearnMikroTik.ir 2014

Instructor

Housekeeping

Vahid Shahbazian fard jahromy

Course materials
Routers, cables
Break times and lunch

Training, Support & Consultant

Specialization: Wireless, Firewall, The Dude,
Routing, Monitoring Techniques

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

Course Objective

Topics Overview

Provide knowledge and hands-on training for

MikroTik RouterOS basic and advanced user
management capabilities for any size
networks
Upon completion of the course you will be
able to plan, implement, adjust and debug
user
management
configurations
implemented by MikroTik RouterOS

Point-to-Point Protocols

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

PPP Profile, PPP Secret

PPTP and L2TP
User Access Control
PPP interface Bridging
Bridge Control Protocol
PPP Multi-link Protocol

8/1/2014

Topics Overview (Cont.)

Topics Overview (Cont.)

Hotspot

RADIUS

Hotspot Setup
Hotspot Login Methods
Universal clients
Users
Group of Users
Server Configuration
Exceptions
Accounting
LearnMikroTik.ir 2014

RADIUS client
RADIUS server
User Manager

RADIUS incoming

IPsec
IPsec Introduction
Transport mode vs. Tunnel mode
7

LearnMikroTik.ir 2014

Introduce Yourself

Class Setup Lab.

Please, introduce yourself to the class

Create an 192.168.XY.0/24 Ethernet network

between the laptop (.1) and the router (.254)
Connect routers to the AP SSID MTCUMEclass
Assign IP address 10.1.1.XY/24 to the wlan1
Routers main GW and DNS address is 10.1.1.254
Gain access to the internet from your laptops via
local router
Create new full access user for your router and
change admin access rights to read

Your name
Your Company
Your previous knowledge about RouterOS
Your previous knowledge about networking
What do you expect from this course?

Please, remember your class XY number.

(X is number of the row, Y is your seat number in the
row)
My number is: X=_____ Y=_____
LearnMikroTik.ir 2014

Class Setup

LearnMikroTik.ir 2014

10

Class setup Lab (cont.)

Set system identity of the board and wireless
radio name to XY_<your_name>. Example:
88_Shahbazian
Upgrade your router to the latest MikroTik
RouterOS version
Upgrade your Winbox loader version
Set up NTP client use 10.1.1.254 as server
Create a configuration backup and copy it to
the laptop (it will be default configuration)

LearnMikroTik.ir 2014

11

LearnMikroTik.ir 2014

12

8/1/2014

Point-to-Point Protocols
PPTP, PPPoE, L2TP, BCP, MLPPP, MRRU,
Interface routing, Dynamic address-lists,
Dynamic simple queues

PPP Profile, PPP Secret

LOCAL USER DATABASE

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

Point-to-Point protocol tunnels

PPP Secret

little bit sophisticated in configuration

Capable of authentication and data encryption
Such tunnels are:

PPP secret (aka local PPP user database)

stores PPP user access records
Make notice that user passwords are displayed
in the plain text anyone who has access to the
router with sensitive privilege are able to see all
passwords
It is possible to assign specific /32 address to
both ends of the PPTP tunnel for this user
Settings in /ppp secret user database override
corresponding /ppp profile settings

PPPoE (Point-to-Point Protocol over Ethernet)

PPTP (Point-to-Point Tunneling Protocol)
L2TP (Layer 2 Tunneling Protocol)
OVPN (Open Virtual Private Network)
SSTP (Secure Socket Tunneling Protocol)

You should create user information before

creating any tunnels
LearnMikroTik.ir 2014

14

15

PPP Secret

LearnMikroTik.ir 2014

16

PPP Profile and IP Pools

PPP profiles define default values for use
access records stored under /ppp secret
submenu
PPP profiles are used for more than 1 user so
there must be more than 1 IP address to give
out
we should use IP pool as Remote address value

Value default means if option is coming

from RADIUS server it won't be overrided
LearnMikroTik.ir 2014

17

LearnMikroTik.ir 2014

18

8/1/2014

PPP Profile

Dynamic Simple Queues

It is possible to assign
specific limit to each
group belonging to the
same PPP profile
Every time new user
connects RouterOS will
create new simple
queue
This option can be
acquired from RADIUS
server

LearnMikroTik.ir 2014

19

Dynamic Simple Queues (Cont.)

LearnMikroTik.ir 2014

Dynamic address-list
It is also possible to
implement custom QoS
structures
Every time new user
connects RouterOS will
create new address-list
entry
Address-list then can be
utilized
by
mange
facility
for
packet
marking.

It is possible to select
Dynamic Queue order
Parent Queue
Queue Type

LearnMikroTik.ir 2014

20

21

LearnMikroTik.ir 2014

22

Change TCP MSS

Big 1500 byte packets have problems going
through the tunnels because:
Standard Ethernet MTU is 1500 bytes
PPTP and L2TP tunnel MTU is 1460 bytes
PPPOE tunnel MTU is 1488 bytes

By enabling change TCP MSS option, dynamic

mangle rule will be created for each active
user to ensure right size of TCP packets, so
they will be able to go through the tunnel
LearnMikroTik.ir 2014

23

Point-to-Point Tunnelling Protocol and

Layer 2 Tunnelling Protocol

PPTP AND L2TP

LearnMikroTik.ir 2014

24

8/1/2014

PPTP Tunnels

L2TP Tunnels

PPTP uses TCP port 1723 and IP protocol 47/GRE

PPTP and L2TP have mostly the same functionality

There is a PPTP-server and PPTP-clients

PPTP clients are available for and/or included
in almost all OS
You must use PPTP and GRE NAT helpers to
connect to any public PPTP server from your
private masqueraded network

L2TP traffic uses UDP port 1701 only for link

establishment, further traffic is using any
available UDP port
L2TP don't have problems with NATed clients
it don't required NAT helpers
Configuration of the both tunnels are identical
in RouterOS

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

25

Creating PPTP/L2TP Client

26

PPTP Client Lab

Create PPTP client
Server Address: 10.1.2.1
User: class
Password: class
Add default route = yes

Make necessary adjustments to access the

internet

LearnMikroTik.ir 2014

27

LearnMikroTik.ir 2014

Creating PPTP/L2TP server

28

PPTP Server Lab

Create a PPTP server
Create one user in PPP Secret
Configure your laptop to connect to your PPTP
server
Make necessary adjustments to access the
Internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPTP-client on the laptop accordingly

LearnMikroTik.ir 2014

29

LearnMikroTik.ir 2014

30

8/1/2014

Optional: Advanced VPN Lab

Restore system backup

Create secure L2TP tunnel with your neighbor
Create EoIP tunnel over the L2TP tunnel
Bridge your networks together!
Point to Point Protocol over Ethernet

USER ACCESS CONTROL

LearnMikroTik.ir 2014

31

LearnMikroTik.ir 2014

User Access Control

PPPoE tunnels

Controlling the Hardware

PPPoE works in OSI 2nd (data link) layer

PPPoE is used to hand out IP addresses to
clients based on the user authentication
PPPoE
requires
a
dedicated
access
concentrator (server), which PPPoE clients
connect to.
Most operating systems have PPPoE client
software. Windows XP has PPPoE client
installed by default

Static IP and ARP entries

DHCP for assigning IP addresses and managing
ARP entries

Controlling the Users

PPPoE requires PPPoE client configuration
Hotspot redirects client request to the sign-up
page
PPTP requires PPTP client configuration
LearnMikroTik.ir 2014

32

33

PPPoE client

LearnMikroTik.ir 2014

34

PPPoE Client Lab

Restore default system backup
Create PPPoE client
Interface: wlan1
Service: internet
User: class
Password: class
Add default route = yes

Make necessary adjustments to access the

internet
LearnMikroTik.ir 2014

35

LearnMikroTik.ir 2014

36

8/1/2014

PPPoE Client Status

* PPPoE Lab with Encryption *

Check your PPPoE connection

Is the interface enabled?
Is it connected and running (R)?
Is there a dynamic (D) IP address assigned to the
PPPoE client interface in the IP Address list?
What are the netmask and the network address?
What routes do you have on the PPPoE client
interface?

37

PPPoE Server
PPPoE
server
accepts
PPPoE
connections on a given interface
Clients can be authenticated against

change the PPP profile used for the PPPoE client

to 'default-encryption', or,
modify the PPP profile used for the PPPoE client to
use encryption

See if you get the PPPoE connection running

See the Log for troubleshooting!

LearnMikroTik.ir 2014

The PPPoE access concentrator is changed to

use encryption now
You should use encryption, either

LearnMikroTik.ir 2014

38

Creating PPPoE server (service)

client

the local user database (ppp secrets)

a remote RADIUS server
a remote or a local MikroTik User Manager
database

Clients can have automatic data rate limitation

according to their profile
LearnMikroTik.ir 2014

39

LearnMikroTik.ir 2014

40

PPPoE Server Lab

Create a PPPoE server
Create one user in PPP Secret
Configure your laptop to connect to your PPPoE
server
Make necessary adjustments to access the
internet via the tunnel
Create PPP Profile for the router to use
encryption
Configure PPPoE-client on the laptop accordingly
LearnMikroTik.ir 2014

41

PPP BCP (Bridge Control Protocol)

PPP MP (Multi-link Protocol)

PPP INTERFACE BRIDGING

LearnMikroTik.ir 2014

42

8/1/2014

PPP Bridge Control Protocol

Setting up BCP
Bridge must be specified the
PPP profiles on both sides of
the tunnel
Note that PPP interface
don't have any MAC
addresses so your bridge
must have a MAC address
before you add PPP to the
bridge

RouterOS now have BCP support for all async.

PPP, PPTP, L2TP & PPPoE (not ISDN) interfaces
BCP allows to bridge Ethernet packets through
the PPP link
BCP is independent part of PPP tunnel - It is
not related to IP address of PPP interface
Bridging and routing over PPP link can happen
at the same time, independently.
LearnMikroTik.ir 2014

43

LearnMikroTik.ir 2014

44

PPP MTU Problem

PPP Multi-link Protocol

PPP interface MTU is smaller than standard

Ethernet interface
It is impossible to fragment Ethernet frames
tunnels must have inner algorithm how to
transfer Ethernet frames via link with smaller
MTU
EOIP have encapsulation algorithm enabled by
default, PPP interfaces doesn't
PPP interfaces can utilize PPP Multi-link Protocol
to handle Ethernet frames

PPP Multi-link Protocol allows divide packet to

multiple channels therefore increasing
possible MTU and MRU (up to 65535 bytes)
MLPPP can be created:

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

45

MRRU

over single physical link where multiple channels

run on the same link
over multiple physical links - where multiple
channels run on the multiple link
46

PPP Multi-link Protocol

To enable PPP Multi-link Protocol over single

link you must specify MRRU option
If both sides support this feature there are no
need for MSS adjustment (in firewall mangle)
MRRU is less CPU expensive that 2 mangle
rules per client if you have more that 30
clients
In MS Windows you must enable "Negotiate
multi-link for single link connections" option
LearnMikroTik.ir 2014

47

LearnMikroTik.ir 2014

48

8/1/2014

PPP Bridging Lab

MLPPP

Restore default system backup

Create PPP tunnel with your neighbour(s)
Bridge PPP tunnels with your local interface
Ensure that MTU and MRU of the PPP link is at
least 1518 byte (size of Ethernet frame)
Check the configuration using ping tool with
different packet size

MikroTik RouterOS have multi-link PPP over

multiple links client support starting from V3.10
Server support will be added some time in the
future
To enable MLPPP just assign multiple interfaces
for the same PPP client.
Note:

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

49

all PPP lines must have same user name and password
Server must have support for MLPPP
50

Interface ECMP Routing

In case you have more that one PPP connection
from the same server, but MLPPP is impossible
(different user names, server support missing) it
is possible to use Interface routing
Simple IP address routing is impossible all PPP
connections have the same gateway IP address
To enable interface routing just specify all PPP
interfaces as route gateway-interface
Works only on PPP interfaces.
LearnMikroTik.ir 2014

51

Hotspot
Overview & Setup, Users & Groups,
Universal clients, Server configurations,
Exceptions, Accounting

LearnMikroTik.ir 2014

Hotspot Overview
Tool for Instant Plug-and-Play Internet access
Hotspot provides authentication of clients
before access to public network
Walled-garden to allow resources without
authentication
It also provides User Accounting
Transparent proxy

Introduction Hotspot

HOTSPOT OVERVIEW

LearnMikroTik.ir 2014

53

LearnMikroTik.ir 2014

54

8/1/2014

Hotspot Usage

Hotspot Operation

Open Access Points, Internet Cafes, Airports,

universities campuses, etc.
Different ways of authorization
Flexible accounting
Anywhere Authorization or Accounting are
required

Client can use wrong network configuration

settings, Hotspot server translates them to
correct ones
No Internet available before Hotspot
authorization
Exceptions are added to walled-garden and
/ip hotspot ip-binding

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

55

56

Hotspot Operation
Enter username/password in Hotspot login
page to get the Internet
Other login methods available
Different accounting options
How to setup Hotspot

HOTSPOT SETUP

LearnMikroTik.ir 2014

57

LearnMikroTik.ir 2014

Hotspot Requirements

58

Hotspot Setup

(Before setup)

Valid IP address configuration on local

(Hotspot) and Public (Internet) interfaces
DNS servers added in /ip dns
One Hotspot user (added by setup command)

Setup is launched by the command,

/ip hotspot setup
Use /ip hotspot setup for Hotspot server
setup, strongly recommended
All configuration settings can be added
manually

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

59

60

10

8/1/2014

Hotspot Setup

Important Notes

Run ip
hotspot
setup
Select
Interface
Proceed to
answer the
questions

Users connected to Hotspot interface will be

disconnected from the Internet
Client will have to authorize in Hotspot to get
access to Internet

LearnMikroTik.ir 2014

61

LearnMikroTik.ir 2014

62

Configuration Created

Common Mistakes

Additional configuration is created in different

sections by Hotspot setup
Hotspot default setup creates additional
configuration:

Hotspot on bridge, configure server on bridge

interface not on the bridge port (hotspot can
not run on slave interface)
Correct DNS name for Hotspot server FQDN
required
arp=enabled for the interface

DHCP-Server on Hotspot Interface

Pool for Hotspot Clients
Dynamic Firewall rules (Filter and NAT)

No additional configuration necessary with /ip

hotspot setup
LearnMikroTik.ir 2014

63

LearnMikroTik.ir 2014

Hotspot Help

64

Hotspot Lab

Hotspot login page is provided when user tries

to access any web-page
To logout from Hotspot you need to go to
http://routerIP or
http://HotSpotDNS

Lets create Hotspot on local Interface

Dont forget Hotspot login and password or
you will not be able to get the Internet
Make sure you get to the Internet

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

65

66

11

8/1/2014

Remember
Access to public networks is blocked (Internet,
Winbox to the router)
Login to the Hotspot to get the Internet
Login by Hotspot page

USERS

LearnMikroTik.ir 2014

67

LearnMikroTik.ir 2014

Hotspot users

Users Settings
Server, Hotspot server user
belongs to
Name, client username
Password, users password
Address, Hotspot IP address to be
used by client
MAC-address, login only from the
specific MAC-address
Profile, users profile name

Users are added and managed from

/ip hotspot user
Required settings are username and password

LearnMikroTik.ir 2014

69

LearnMikroTik.ir 2014

Users Limits

70

Users lab

Uptime, time allowed to be online

for user
Bytes In, bytes user can upload
Bytes Out, bytes user can
download
Bytes Total = Bytes In + Bytes Out

LearnMikroTik.ir 2014

68

71

Add additional Hotspot user

Set this user to login only from your laptop
Restrict user to 5 hours 1Gb upload and 1Gb
download per day

LearnMikroTik.ir 2014

72

12

8/1/2014

Daily users
For the
previous lab,
use scheduler
and simple
script
/ip hotspot user
reset-counters
command to
reset uptime
LearnMikroTik.ir 2014

MONITOR USERS

73

LearnMikroTik.ir 2014

Hotspot Network Hosts

74

Authorized Users

Information
about clients
connected to
Hotspot
interface
shown in
/ip hotspot host

LearnMikroTik.ir 2014

Authorized
users are
shown in
/ip hotspot
active

75

LearnMikroTik.ir 2014

76

Login Methods

HTTP CHAP, HTTP PAP

HTTPS
MAC-Address
Cookie
Trial method

HOTSPOT LOGIN METHODS

LearnMikroTik.ir 2014

77

LearnMikroTik.ir 2014

78

13

8/1/2014

Login Configuration

HTTP CHAP, PAP

/ip hotspot profile

stores Login
Method
configuration

Login page is shown for users

login/password is necessary
to get Internet
CHAP, CHAP challenge for
login, enabled browsers
JavaScript
PAP, login in plain text for
legacy browsers

LearnMikroTik.ir 2014

79

LearnMikroTik.ir 2014

HTTPS

Cookie
Cookie is sent to
client, after
successful HTTP
login
Hotspot does not
ask for
login/password for
second time access

Login page is shown for users

Authorization is encrypted by SSL protocol
Certificate should be imported to router

LearnMikroTik.ir 2014

80

81

LearnMikroTik.ir 2014

MAC-Address

Trial
Avoid Hotspot
login page
Add MACaddress as
username
Authentication
occurs, as user is
connected to
the Hotspot

LearnMikroTik.ir 2014

82

83

Use Hotspot free of

charge for the period
Set usage time over
specific period

LearnMikroTik.ir 2014

84

14

8/1/2014

Login Methods Lab

Hotspot Sequence

Enable cookie login for 2 days lifetime

Enable trial for 1 hour over 24 hours
Enable MAC-address authentication for your
laptop

User is connected to the Router

Universal Client IP address is translated, if necessary
MAC-Address
HTTP, HTTPS
Cookie

LearnMikroTik.ir 2014

85

MAC-address users authentication

Login page is shown for user
Cookie used for second HTTP login

LearnMikroTik.ir 2014

Exceptions Sequence

Hotspot Logout

IP-Binding

Present on Universal client level

Walled-Garden

Allow access to specific resources

LearnMikroTik.ir 2014

86

87

Logout from Hotspot to stop accounting

Logout from login page, http://hotspot or
http://router_ip
After keepalive timeout reached

LearnMikroTik.ir 2014

88

User Profile
To apply common settings for the group of users

GROUP OF USERS

LearnMikroTik.ir 2014

89

LearnMikroTik.ir 2014

90

15

8/1/2014

Profile Settings

Rate Limit

Address-Pool, to enable
universal client
Session Timeout, user is
logged out after this time
Keepalive Timeout,
detects whether client is
reachable
Shared Users, allowed
simultaneous logins with
the same username
LearnMikroTik.ir 2014

91

Rate Limit (Continue)

Bandwidth limit for Hotspot

clients
Creates dynamic simple queue
Syntax, rx-rate[/tx-rate] [rxburstrate[/tx-burst-rate] [rxburstthreshold[/tx-burstthreshold] [rxburst-time[/txburst-time] [priority][rx-ratemin[/tx-rate-min]]]]
rx clients upload, tx clients
download
LearnMikroTik.ir 2014

Firewall and Mangle

Filter, check users
through the specific
firewall filter chain
Packet Mark, to set
mangle mark for the
users
Add jump from built-in
chains (input, forward,
output) to hotspot
chain

It is possible to select
Dynamic Queue order
Parent Queue
Queue Type

LearnMikroTik.ir 2014

93

Advertise

LearnMikroTik.ir 2014

94

Alternative Advertising

To show advertise webpage after period of

time
Internet is blocked, if
not shown
Popup blockers can
disturb advertise

LearnMikroTik.ir 2014

92

Put the advertisement

information to status page
HTML knowledge required
to modify alogin.html
(status)
Open-status page=always,
shows status page for all
clients

95

LearnMikroTik.ir 2014

96

16

8/1/2014

Scripts

User Profile Lab

Execute scripts on
Hotspot user login and
logout

LearnMikroTik.ir 2014

Set max-limit=1M/2M limit-at=512k/1M

priority=3 for every Hotspot user
Log Hotspot users traffic in firewall chain=log
Set static queue and make sure they are
before dynamic all the time

97

LearnMikroTik.ir 2014

98

Hotspot server
Servers menu lists all Hotspot
servers
Interface, specifies interface
Hotspot is configured on
Address-Pool, Universal
client for non-authorized
clients
Timeouts, timeouts for
unauthorized clients
Addresses-Per-Mac,
number of IP addresses
allowed per one MAC
address

SERVER CONFIGURATION

LearnMikroTik.ir 2014

99

LearnMikroTik.ir 2014

Hotspot Server Lab

Hotspot Server

Create Bridge on the router between Hotspot

interface and unused interface
Modify Hotspot servers settings appropriately

LearnMikroTik.ir 2014

100

101

Profile, contains all

settings for the
Hotspot server

LearnMikroTik.ir 2014

102

17

8/1/2014

Login

Server Profile
DNS name, Hotspot
server DNS name, use
FQDN
Rate-Limit, set
bandwidth limit for the
entire Hotspot server
HTTP proxy, parent
proxy settings
SMTP server, to
redirect e-mails to
your mail server

Hotspot login
method selection
Additional
authentication
settings
Trial User
configuration

LearnMikroTik.ir 2014

103

LearnMikroTik.ir 2014

Hotspot Customization

Hotspot pages

HTML-directory, sets
location of the Hotspot
server files
Use FTP client to get
Hotspot login page files

LearnMikroTik.ir 2014

105

Customize Hotspot

redirect.html - redirect users to another url

login.html - login page shown to a user
md5.js Java script for MD5 password hashing
status.html - statistics for the client
logout.html - logout page
error.html - error page
You can put necessary information with basic
HTML knowledge

LearnMikroTik.ir 2014

106

Hotspot Profile Lab

/ip hotspot resethtml <hotspotX>,

command to get
back default login
page

LearnMikroTik.ir 2014

104

Set Trial Login on the Hotspot server

Set DNS-Name for Hotspot, use it to login and
logout
Modify Hotspot page to login without login
and password

107

LearnMikroTik.ir 2014

108

18

8/1/2014

Previous Lab

Page Modifications

Get login.html page from ftp://router

Open login.html with text editor

Change two lines

<type=text value=$(username)> to
<input type=hidden name=username value=yourname?>

<input type=password>
<input type=hidden name=password value=password>

LearnMikroTik.ir 2014

109

LearnMikroTik.ir 2014

110

Login without password

No login/password required
Put advertising information or any information
for user to accept
Increase shared-users

EXCEPTIONS

LearnMikroTik.ir 2014

111

Hotspot Exceptions

112

Hotspot Walled-Garden

Hotspot blocks connection to the Internet

Servers, switches, telephony terminals
perhaps do not have browser for the login
There are few ways to bypass HotSpot
authentication

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

Tool to get access to specific resources

without HotSpot authorization
Walled-Garden for HTTP and HTTPS
Walled-Garden IP for other resources (Telnet,
SSH, Winbox, etc.)

113

LearnMikroTik.ir 2014

114

19

8/1/2014

Walled-Garden

Walled-Garden

Access for HTTP and HTTPS pages without

authentication
Ability to block pages

LearnMikroTik.ir 2014

115

Src. address, Hotspot client address

Dst. address, HTTP/HTTPs IP address
Dst. Host, DNS name, example www.test.com
Path, www.test.com/path

LearnMikroTik.ir 2014

Walled-Garden IP

IP Binding

Bypass other services without authentication

Bypass for protocols and ports, SSH, Telnet, Winbox,
SIP calls, etc.

LearnMikroTik.ir 2014

117

Allows full Hotspot bypass for the user

Static Universal client (one-to-one NAT)
translations
Block unauthorized hosts or networks

LearnMikroTik.ir 2014

One-to-One NAT

118

IP Binding types

Address, Hotspot client

address
To Address, new
address of the Hotspot
client

LearnMikroTik.ir 2014

116

119

regular, no action for

the client
bypassed, client is
bypassed without
authentication
blocked, block access
for the client or
network

LearnMikroTik.ir 2014

120

20

8/1/2014

Firewall rules

Filter and NAT

Hotspot setup creates dynamic firewall rules

Static rules are moved to the bottom after
reboot
Special chain available for placing static rules
over dynamic

Static rules to be placed before dynamic

LearnMikroTik.ir 2014

LearnMikroTik.ir 2014

121

Firewall rules

Exceptions lab

Jump rules are red, because there is no rules

in custom chain
Red rules does not make any problem for
HotSpot or firewall operation

LearnMikroTik.ir 2014

122

Set www.mikrotik.com without

authentication
Set SSH without authentication
Block Telnet for all Hotspot users
Set access for Hotspot only for users with local
network IP address

123

LearnMikroTik.ir 2014

124

Accounting

ACCOUNTING

LearnMikroTik.ir 2014

125

LearnMikroTik.ir 2014

126

21

8/1/2014

SNMP
Information provided by SNMP

LearnMikroTik.ir 2014

127

22