MikroTik, Networking

DNS Resolving for PPP Clients

Leave a comment

Sometimes you will need to connect to a router that either has a dynamic IP or a domain name instead of directly to the IP address.  This is easily achieved using RouterOS  with a simple script.  Using the script below you will need to change PPP-INTERFACE to the name of your PPP interface and VPN.YOURDOMAIN.COM to the domain name of what you are trying to connect to.

/system script
    add name="CBrown-VPN DNS" policy=\
    ftp,reboot,read,write,policy,test,winbox,password source=":global pptpinte\
    rfacename \"PPP-INTERFACE\"\r\
    \n:global pptpdnsname \"VPN.YOURDOMAIN.COM\"\r\
    \n:global pptpdnsip [:resolve \$pptpdnsname]\r\
    \n:global currentip [/interface pptp-client get \$pptpinterfacename connec\
    t-to]\r\
    \n:if (\$currentip != \$pptpdnsip) do={ /interface pptp-client set [find n\
    ame=\$pptpinterfacename] connect-to=\$pptpdnsip}\r\
    \n}"

Continue reading DNS Resolving for PPP Clients →

MikroTik, Networking

Block Facebook

Leave a comment

Many businesses want to block facebook on their corporate networks.  Here is a useful site to lookup blocks of IPs.

http://www.robtex.com/dns/www.facebook.com.html#records

http://bgp.he.net/AS32934#_prefixes

Using the IPs from above we can create firewall rules to block facebook.

/ip firewall filter
add action=drop chain=forward comment="Block Facebook" dst-address=173.252.64.0/18
add action=drop chain=forward comment="Block Facebook" dst-address=204.15.20.0/22
add action=drop chain=forward comment="Block Facebook" dst-address=66.220.144.0/20
add action=drop chain=forward comment="Block Facebook" dst-address=31.13.64.0/18
add action=drop chain=forward comment="Block Facebook" dst-address=31.13.24.0/21
add action=drop chain=forward comment="Block Facebook" dst-address=69.171.224.0/19
add action=drop chain=forward comment="Block Facebook" dst-address=74.119.76.0/22
add action=drop chain=forward comment="Block Facebook" dst-address=103.4.96.0/22
MikroTik, Networking

Open NAT on Xbox Live

2 Comments

Here are the rules I use to open my NAT on Xbox Live.  Xbox.com says to “open” ports 88udp, 3074udp/tcp, 53udp/tcp, and 80tcp.  Assuming you can browse the internet you don’t need to NAT 80 and 53 to your Xbox.  These are just HTTP and DNS traffic which you should already have working.  The ports used for actual gaming are 3074 and 88.  One is probably used for the actual game play and the other is more than likely used for voice.  I am not sure and could be completely wrong, either way you need to NAT them both. Continue reading Open NAT on Xbox Live →

MikroTik, Networking

PtP Bridge With 802.11N and NV2

1 Comment

Here is the configuration for a Point-to-Point link that can be used with a number of MikroTik devices.  With this example I used two StationTik 5G’s but could be used with SXT’s or any other Point-to-Point devices.  You might need to change your frequency depending on usage in your area.

AP Side

/interface bridge
add l2mtu=1600 name=bridge1
/interface wireless
set 0 band=5ghz-onlyn channel-width=20/40mhz-ht-above disabled=no frequency=5745 \
    ht-rxchains=0,1 ht-txchains=0,1 l2mtu=2290 \
    mode=bridge nv2-preshared-key=yourpass nv2-security=enabled ssid=PtP wireless-protocol=nv2
/interface wireless security-profiles
set [ find default=yes ] group-ciphers="" supplicant-identity=MikroTik unicast-ciphers=""
/interface bridge port
add bridge=bridge1 interface=wlan1
add bridge=bridge1 interface=ether1
/ip address
add address=10.36.84.4/24 interface=bridge1
/ip dhcp-client
add interface=bridge1
/system clock
set time-zone-name=America/New_York
/system identity
set name=AP
/system ntp client
set enabled=yes mode=unicast primary-ntp=64.90.182.55

Continue reading PtP Bridge With 802.11N and NV2 →

Work

NEC DT700 Phone Setup

2 Comments

When you first take the phone out of the box you will have to put some settings in it so it can call back to the server.  To do that it is not exactly straight forward and I could not seem to find it anywhere in the documentation.  After the phone starts to boot dial Hold Transfer * #.  Then you will be asked for a username and login.  The username is ADMIN and the password is 6633222.  Now configure your phone accordingly.

 

MikroTik, Networking

Disable Access During Certain Hours

6 Comments

Recently I have needed to restrict access to the internet during certain hours.  This is very easy to achieve with MikroTIk using a few mangle and filter rules.  I currently have this configuration on a RB751 so I am using a bridge for the LAN.  I have ports 2-5 switched together and then bridged the wlan1 and ether2 (the master port) together.  Instead of just restricting everything on the bridge I wanted to be able to allow access to myself and certain others during “restricted times”, and this is why I used mangle to mark connections and filter via the connection marks.

Here you can see the two rules mark the connections from my allowed devices.  The last two rules mark everything else in and out of the DHCP bridge.

/ip firewall mangle
add action=mark-connection chain=forward comment="Mark CBrown Computer" disabled=no in-interface=DHCP \
    new-connection-mark=Allowed passthrough=no src-mac-address=XX:XX:XX:XX:XX:XX
add action=mark-connection chain=forward comment="Mark CBrown iPhone" disabled=no in-interface=DHCP \
    new-connection-mark=Allowed passthrough=no src-mac-address=XX:XX:XX:XX:XX:XX
add action=mark-connection chain=prerouting comment="DHCP Upload" disabled=no in-interface=DHCP \
    new-connection-mark=DHCP passthrough=no
add action=mark-connection chain=postrouting comment="DHCP Download" disabled=no new-connection-mark=DHCP \
    out-interface=DHCP passthrough=no

Continue reading Disable Access During Certain Hours →

CBrown (K8CTB) Blog