How to Get Connected with RouterOS: Difference between revisions
Pancakepuppy (talk | contribs) Created page and added content. Version 1, please edit or submit feedback as necessary! |
Pancakepuppy (talk | contribs) m Formatting changes |
||
| Line 1: | Line 1: | ||
=== Configure your Internet-Facing Port === | === Configure your Internet-Facing Port === | ||
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP. | This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a ''Mikrotik hAP ac2'', minimal pre-existing settings, and a home network that configures hosts via DHCP. | ||
Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''eth'' | Interface ''ether2'' is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the '''Switch > Port Isolation''' menu to forward traffic directly to the CPU from ''eth'' | ||
| Line 10: | Line 6: | ||
''er2''. | ''er2''. | ||
[[File:Step 1 - Port Isolation.png|thumb|442x442px|RouterOS Switch Port Isolation menu|border|none]]Enter the '''IP > DHCP Client''' menu and create a new DHCP client to configure ''ether2''. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively. | |||
[[File:Step 1 - DHCP Client.png|thumb|423x423px|RouterOS DHCP Client menu|none]] | |||
[[File:Step 1 - | |||
=== Configure your WireGuard Tunnel === | === Configure your WireGuard Tunnel === | ||
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys. | For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys. | ||
[[File:Step 2 - WireGuard Interface.png|thumb|393x393px|RouterOS WireGuard menu|none]]Open the '''WireGuard''' menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank. | |||
[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu|none]]Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds. | |||
[[File:Step 2 - WireGuard Peer.png|thumb|459x459px|RouterOS WireGuard Peer menu]] | |||
Navigate to the '''Peers''' tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds. | |||
=== Configure Your CGHMN Routed Subnet === | === Configure Your CGHMN Routed Subnet === | ||
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well. | Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well. | ||
[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu]] | Ports ''ether3'' through ''ether5'' have been added to a bridge named ''cghmn-lan'' in the '''Bridge''' menu.[[File:Step 3 - Bridge menu.png|thumb|172x172px|RouterOS Bridge menu|none]] | ||
[[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu]] | [[File:Step 3 - Bridge Ports menu.png|thumb|243x243px|RouterOS Bridge Ports menu|none]] | ||
In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255). | In the '''IP > Addresses''' menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255). | ||
[[File:Step 3 - IP Addresses menu.png|thumb|306x306px|RouterOS IP Addresses menu|none]] | |||
Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the '''IP > Pool''' menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.[[File:Step 3 - IP Pool menu.png|thumb|306x306px|RouterOS IP Pool menu|none]] | |||
Open the '''IP > DHCP Server''' menu and go to the '''Networks''' tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.[[File:Step 3 - DHCP Networks menu.png|thumb|403x403px|RouterOS DHCP Server Networks menu|none]] | |||
In the '''DHCP''' tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.[[File:Step 3 - DHCP Server menu.png|thumb|317x317px|RouterOS DHCP Server menu|none]] | |||
You can view DHCP leases assigned by the server and create reservations in the '''Leases''' tab.[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu|none]] | |||
[[File:Step 3 - DHCP Leases menu.png|thumb|476x476px|RouterOS DHCP Leases menu]] | |||
| Line 134: | Line 42: | ||
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic. | At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic. | ||
Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case.[[File:Step 4 - Add Routes.png|thumb|715x715px|RouterOS IP Routes menu|none]] | |||
Open the '''IP > Routes''' menu. You should see a few entries in the routing table already with a '''D''' flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, ''wg1'' in this case. | |||
=== Add Firewall Rules === | === Add Firewall Rules === | ||
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways. | While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways. | ||
[[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu]] | [[File:Step 5 - Add Firewall Rules.png|thumb|787x787px|RouterOS Firewall Rules menu|none]] | ||
Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun! | Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun! | ||
Revision as of 21:41, 28 August 2026
Configure your Internet-Facing Port
This step will look different depending on your router hardware, pre-existing RouterOS configuration, and home network architecture. In my case, I’m using a Mikrotik hAP ac2, minimal pre-existing settings, and a home network that configures hosts via DHCP.
Interface ether2 is used for the connection onto my home network. (You’ll use whatever interface you want on your hardware.) Since this is Mikrotik router hardware with switched Ethernet ports, I will enter the Switch > Port Isolation menu to forward traffic directly to the CPU from eth
er2.
Enter the IP > DHCP Client menu and create a new DHCP client to configure ether2. Once a lease is obtained, a default route and interface IP address will be visible in the IP > Routes and IP > Addresses menus respectively.
Configure your WireGuard Tunnel
For this step, you’ll need your WireGuard connection info from CGHMN User Services, which also require that you’ve generated public and private keys.
Open the WireGuard menu and create a new WireGuard interface. You only need to add your public and private keys in this window and can leave the listen port blank.
Navigate to the Peers tab and create a new peer. From your CGHMN User Services ‘Welcome’ e-mail, fill in the Public Key, Endpoint and Endpoint Port, Allowed Addresses, Preshared Key, Persistent Keepalive, and Client Address (which is your ‘Tunnel IP’.) Client Keepalive isn’t required but I have it set to 25 seconds.
Configure Your CGHMN Routed Subnet
Next, we’ll set up the routed subnet we were assigned. I’ve configured my subnet to assign addresses to clients with DHCP, which I’ll cover in this section as well.
Ports ether3 through ether5 have been added to a bridge named cghmn-lan in the Bridge menu.
In the IP > Addresses menu, create a new IP address in your routed subnet for the router to use with the bridge interface. I (PancakePuppy) have the 100.68.209.0/24 subnet and I’m going to use the first available address for my router. T his is arbitrary – it can be any address that isn’t network (.0) or broadcast (.255).
Let’s set up the DHCP Server to dynamically configure our hosts. With a protocol. First, open the IP > Pool menu and create a new pool. I’ve made a pool which covers the full remainder of my routed subnet, but you may want to leave some room for statically configured devices.
Open the IP > DHCP Server menu and go to the Networks tab. Create a new network and enter your routed subnet in the Address field, your router IP in Gateway, and whichever DNS servers you wish your hosts to use. I used the CGHMN Core DNS servers. Configure the other options to your preference.
In the DHCP tab, create a new DHCP server on your routed subnet interface and select the Address Pool we created earlier. With this created, hosts you connect to the specified interface will receive IP addresses, domain name services, and know where to send packets that want to escape the subnet.
You can view DHCP leases assigned by the server and create reservations in the Leases tab.
Add Routes
At this point, if a host sends the router a packet destined for a CGHMN address outside your subnet, it will be dropped. We need to add a few static routes so our router knows where to send CGHMN traffic.
Open the IP > Routes menu. You should see a few entries in the routing table already with a D flag, indicating they were dynamically (automatically) added for us. We will create 3 new routes using the Allowed IPs list to guide us and set Gateway Interface to the WireGuard interface from Step 2, wg1 in this case.
Add Firewall Rules
While it may not be absolutely necessary, I like to have a few basic firewall rules for allowing incoming pings, related and established connections, and blocking everything else. I also want a rule to drop packets arriving from the tunnel interface with a destination address on my home network. I can’t imagine that happening but I’ll cover the possibility anyways.
Rules are evaluated in ascending numerical order, so make sure your final “deny everything else” rule comes last. Besides just allowing or denying traffic, firewall rules can also be used to log, create address lists, or tarpit connections. Experimenting is part of the fun!