Nothing Special   »   [go: up one dir, main page]
Scribd Logo
Upload

Welcome to Scribd!

  • 3 views

    Steve

    Uploaded by

    berndl

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Steve

    Uploaded by

    berndl
    3 views40 pages

    Original Title

    steve

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    3 views40 pages

    Steve

    Uploaded by

    berndl

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 40

    About Me

    • Steve Discher, from College Station, Texas, USA


    •MikroTik Certified Trainer since 2008 and teach
    RouterOS classes, LearnMikroTik.com and blog at
    SteveDischer.com

    • Operate a wireless distribution company,


    ISPSupplies.com
    Congratulations to 13
    New MTCNA’s
    Look at nine different RouterOS forgotten
    features, configuration calamities and some sweet
    solutions to simple problems
    Inbound NAT with a
    Dynamic IP
    PROBLEM: I have a dynamic WAN IP but
    want to allow inbound services
    Destination NAT With
    a Dynamic IP
    IP Packet
    Dst IP: 60.70.80.2

    IP Packet
    Dst IP: 10.0.25.2
    RDP Server
    Destination NAT With
    a Dynamic IP

    With a static IP,


    it is simple…
    Destination NAT With
    a Dynamic IP

    With a dynamic IP,


    it is also simple!
    Return
    How to Not be a
    Participant In a DNS
    Attack
    DNS Allow Remote
    Requests
    PROBLEM: Open DNS
    servers can be used to launch
    Distributed Denial of Service
    (DDoS) attacks
    DNS Allow Remote
    Requests
    SOLUTION: Create a firewall rule to block
    everything on the WAN port or specifically to
    block port 53 UDP and TCP.
    /ip firewall filter

    add chain=input protocol=tcp dst-port=53 in-interface=ether1-gateway


    action=drop

    add chain=input protocol=udp dst-port=53 in-interface=ether1-gateway


    action=drop

    Return
    Where’s That Firewall?
    IP Cloud Feature
    •Starting with RouterOS v6.14 MikroTik offers a
    Dynamic DNS name service for RouterBOARD
    devices.
    •This means that your device can automatically get a
    working domain name, this is useful if your IP address
    changes.
    •Prior to this feature, you had to use problematic
    DynDNS Scripts
    IP Cloud Feature

    Create a CNAME in your DNS server for the


    MyNetName.net host name

    Return
    Hairpin NAT
    Hairpin NAT
    2.2.2.2
    Hairpin NAT
    Hairpin NAT
    • Server replies but source IP address of the request is on the same
    subnet as the web server.

    • Server does not send the reply back to the router, but sends it
    back directly to 192.168.1.10 with a source IP address in the reply
    of 192.168.1.2.

    • The client receives the reply packet, but it discards it because it


    expects a packet back from 1.1.1.1, and not from 192.168.1.2. As
    far as the client is concerned the packet is invalid and not related
    to any connection the client previously attempted to establish.
    Hairpin NAT

    /ip firewall nat


    add chain=srcnat src-address=192.168.1.0/24 dst-address=192.168.1.2\
    protocol=tcp dst-port=80 out-interface=ether2 action=masquerade
    Return
    802.11ac Center/
    Extension Channels
    802.11ac Control
    Channel Nomenclature

    Ceee…what?
    802.11ac Control
    Channel Nomenclature

    C e e e
    5180 5200 5220 5240

    Remember not to put extension


    below/above Control if no valid
    frequencies exist there!
    Return
    Special Login
    Special Login
    Router

    Router/Switch

    SSH/Telnet to an IP on a router, and


    be redirected to a serial port based
    on user name.
    Special Login
    Router:
    1. Disable serial console

    2. Add new user with port


    in Special login

    ssh serial@R1

    is redirected to serial port of R2


    Return
    UPnP
    UPnP
    Universal Plug and Play architecture for transparent
    peer-to-peer network connectivity of personal
    computers and network-enabled intelligent devices
    or appliances, typically game consoles.
    UPnP
    Required by
    standard, but don’t
    enable!

    Enables a
    workaround for
    some broken
    implementations
    UPnP
    2300 active hosts
    producing 2694
    dynamic NAT rules

    Return
    IP Flows
    IP Traffic Flow
    •MikroTik Traffic-Flow is a
    system that provides statistic
    information about packets which
    pass through the router.
    •Besides network monitoring and
    accounting, system
    administrators can identify
    various problems that may
    occur in the network.
    IP Traffic Flow
    •With help of Traffic-Flow, it is
    possible to analyze and optimize
    the overall network
    performance.
    •As Traffic-Flow is compatible
    with Cisco NetFlow, it can be
    used with various utilities which
    are designed for Cisco's
    NetFlow.
    IP Traffic Flow
    Enable flows and
    create a target. The
    target is a NetFlows
    server such as
    ManageEngine, or
    NTOP.
    IP Traffic Flow
    IP Traffic Flow
    This data can then
    be analyzed and
    charted to
    determine the types
    of traffic flowing
    through your router,
    source IP’s
    destination IP’s, top
    talkers , etc.
    statistically over
    time.
    Return
    MikroTikConfig.com
    Updated!
    2013 St. Louis MUM
    •Java based, limited functionality
    2014 Pittsburgh MUM
    •Web based, added firewall, QOS and country based address
    lists
    2015
    • Add PCC based load balancing for 2 or 3 WAN connections
    MikroTikConfig.com
    Fill in the
    blanks,
    download a
    text file,
    import.
    Demo
    Questions?
    Thank You For Playing!
    • Training: MyWISPTraining.com &
    LearnMikroTik.com

    • Store: ISPSupplies.com
    • Blog: SteveDischer.com
    • “RouterOS by Example” available from
    distributors, Amazon.com, Kindle, iTunes

    • Configurator: MikroTikConfig.com

    You might also like