Saturday, December 6, 2008
Mikrotik VPN: Point ot Point Tunnel Protocol (PPTP)
PPTP (Point to Pont Tunnel Protocol) supports Encrypted tunnels over IP. the Mikrotik RouterOS implementation incluldes support fot PPTP client and the server.
General application of PPTP tunnels:
* For a secure router to router tunnels over the internet
* To link (bridge) local LANs or Intranets (EoIP think is also used)
* For mobile or remote clients to remotely access an intranet / LAN of a company (see PPTP setup for Windows for more information)
PPTP connction is each composed of a server and a client. The Mikrotik RouterOS may funcion as a server or the client - or, the various configurations, it may be some connections for the server and client for other connections. For example, the client created below could connect to a windows 2000 server, another Mikrotik Router, or another router which supports a PPTP server.
Description
PPTP is a secure tunnels for transporting IP traffic using PPP. PPTP encapsulates PPP in virtual lines that run over IP. PPTP incorporates PPP and the MPPE (Microsoft Point to Point Encryption) to make Encrypted links. The purpose of this protocol si to make well-managed secure connection (clients are avialable for and / or included in almost all OSS including Windows).
PPTP incluldes PPP authentication and accounting for each PPTP connection. Full authentication and accouting for each connection may be done through a radius of the client or Locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, the IP protocol ID 47), as Assigned by the internet Assigned Number Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and the protocol 47 traffic to be routerd through the firewall or router.
PPTP connection my be limited or dr to set up a masqueraded Policia /NAT IP connction. Please see the Micorsoft and RFC linke at the end of the section for more information.
PPTP Client Setup
Submenu Level: /interace pptp-client
Property Description
name (name; default: pptp-out1) - interface name for reference
mtu (interger; default: 1460) - Maximum transmits Unit. the optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentaion of packets)
mrt (integer; default:1460) - Maximum Receive Unit. The optimal vlaue is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MRU to 1460 to aviod fragmentation of packets)
connect-to (IP address) - the IP address of the PPTP server to connect to
user (string) - user name to use when logging on the remote server
password (string; default: "") - user password to use when loggin to the remote server
profile (name: default: default) - profile to use when connecting to the remote server
add-default-router (yes I no; default: no) - whether to use the server which this client is connected to as its default router (gateway)
Example
to set up PPTP client named test2 using username john with password john to connection the 10.1.1.12 PPTP server and use it as the default gateway:
[admin@Mikrotik] interface pptp-client> add name=test2 connect-to=10.1.1.12 \
\.. user=john add-default-route=yes passowrd=john
[admin@Mikrotik] interface pptp-client>print
Flage: X - disabled, R - running
0 X name="test2" mtu=1460 mru=1460 connect-to=10.1.1.12 user="john"
password="john" profile=default add-default-route=yes
[admin@Mikrotik] interface pptp-client> enable 0
Monitoring PPTP Client
Command name: /interface pptp-clent monitor
Property Description
Statistics:
Uptime (time) connection time displayed in days, hours, minutes, and seconds
encoding (string) - encrytion and encording (if asymmetric, separated with "/") being userd in this connection
status (string) - staturs of the client:
#Dialing - attempting to make a connection
#Verifying passowrd... - connection has been established tothe server, passwrod verification in progress
#connected - self-explanatory
#Terminated - interface is not enabled or the other side will not establish a connection
Example
Example of an established connection:
[admin@Mikrotik] interface pptp-client> monitor test2 uptime: 4h35s
encoding: MPPE 128 bit, stateless
status: connected
[admin@Mikrotik] interface pptp-client>
PPTP server setup
Submenu level : /interface pptp-server server
[admin@Mikrotik] interface pptp-server server> print
enabled: no
mtu: 1460
mru: 1460
authenticaion: mschap2
default-profile: default
[admin@Mikrotik] interface pptp-server server>
Description
The PPTP server supports unlimited connections form clients. For each cureent connection, a dynamic interface is created.
Property Description
enabled (yes I no; default:no) - defines whether PPTP server is enabled or not
mtu (integer; default: 1460 ) - Maximum Transmit Unit. The optimal vlaue is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500- byte ether net link,set the MTU to 1460 to avoid fragmentation of packets)
mru (integer; default: 1460) - Maximum Receive Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentation of packets)
authentication (multiple choice: pap chap mschap1 mschap2; default: mschap2) - authentication algorithm
default-profile (name; default: default) - default profile to use
Example
To enable PPTP server:
[admin@MikroTik] interface pptp-server server> set enabled=yes
[admin@MikroTik] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@MikroTik] interface pptp-server server>
PPTP Server Users
Submenu level : /interface pptp-server
Description
There are two types of items in PPTP server configuration - static users and dynamic connections. A dynamic connection can be established if the user database or the default-profile has its local-address and remote-address set correctly. When static users are added, the default profile may be left with its default values and only P2P user (in /ppp secret) should be configured. Note that in both cases P2P users must be configured properly.
Property Description
name - interface name
user - the name of the user that is configured statically or added
dynamically
Statistics:
mtu - shows (cannot be set here) client's MTU
client-address - shows (cannot be set here) the IP of the connected client
uptime - shows how long the client is connected
encoding (string) - encryption and encoding (if asymmetric, separated with '/') being used in this connection
Example
To add a static entry for ex1 user:
[admin@MikroTik] interface pptp-server> add user=ex1
[admin@MikroTik] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 DR ex 1460 10.0.0.202 6m32s none
1 pptp-in1 ex1
[admin@MikroTik] interface pptp-server>
In this example an already connected user ex is shown besides the one we just added.
PPTP Router-to-Router Secure Tunnel Example
The following is an example of connecting two Intranets using an encrypted PPTP tunnel over the Internet.
There are two routers in this example:
* [HomeOffice]
Interface LocalHomeOffice 10.150.2.254/24
Interface ToInternet 192.168.80.1/24
* [RemoteOffice]
Interface ToInternet 192.168.81.1/24
Interface LocalRemoteOffice 10.150.1.254/24
Each router is connected to a different ISP. One router can access another router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@HomeOffice] ppp secret> add name=ex service=pptp password=lkjrht
local-address=10.0.103.1 remote-address=10.0.103.2
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default
local-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@HomeOffice] interface pptp-server> add user=ex
[admin@HomeOffice] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 pptp-in1 ex
[admin@HomeOffice] interface pptp-server>
And finally, the server must be enabled:
[admin@HomeOffice] interface pptp-server server> set enabled=yes
[admin@HomeOffice] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@HomeOffice] interface pptp-server server>
Add a PPTP client to the RemoteOffice router:
[admin@RemoteOffice] interface pptp-client> add connect-to=192.168.80.1 user=ex \
\... password=lkjrht disabled=no
[admin@RemoteOffice] interface pptp-client> print
Flags: X - disabled, R - running
0 R name="pptp-out1" mtu=1460 mru=1460 connect-to=192.168.80.1 user="ex"
password="lkjrht" profile=default add-default-route=no
[admin@RemoteOffice] interface pptp-client>
Thus, a PPTP tunnel is created between the routers. This tunnel is like an Ethernet point-to-point connection between the routers with IP addresses 10.0.103.1 and 10.0.103.2 at each router. It enables 'direct' communication between the routers over third party networks.
To route the local Intranets over the PPTP tunnel – add these routes:
[admin@HomeOffice] > ip route add dst-address 10.150.1.0/24 gateway 10.0.103.2[admin@RemoteOffice] > ip route add dst-address 10.150.2.0/24 gateway 10.0.103.1
On the PPTP server it can alternatively be done using routes parameter of the user configuration:
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret> set 0 routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2
routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret>
Test the PPTP tunnel connection:
[admin@RemoteOffice]> /ping 10.0.103.1
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms
ping interrupted
3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
Test the connection through the PPTP tunnel to the LocalHomeOffice interface:
[admin@RemoteOffice]> /ping 10.150.2.254
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms
ping interrupted
3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
To bridge a LAN over this secure tunnel, please see the example in the 'EoIP' section of the manual. To set the maximum speed for traffic over this tunnel, please consult the 'Queues' section.
Connecting a Remote Client via PPTP Tunnel
The following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel giving that computer an IP address from the same network as the remote office has (without need of bridging over eoip tunnels)
Please, consult the respective manual on how to set up a PPTP client with the software You are using.
The router in this example:
* [RemoteOffice]Interface ToInternet 192.168.81.1/24
Interface Office 10.150.1.254/24
The client computer can access the router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@RemoteOffice] ppp secret> add name=ex service=pptp password=lkjrht
local-address=10.150.1.254 remote-address=10.150.1.2
[admin@RemoteOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default
local-address=10.150.1.254 remote-address=10.150.1.2 routes==""
[admin@RemoteOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@RemoteOffice] interface pptp-server> add name=FromLaptop user=ex[admin@RemoteOffice] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 FromLaptop ex
[admin@RemoteOffice] interface pptp-server>
And the server must be enabled:
[admin@RemoteOffice] interface pptp-server server> set enabled=yes
[admin@RemoteOffice] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@RemoteOffice] interface pptp-server server>
Finally, the proxy APR must be enabled on the 'Office' interface:
[admin@RemoteOffice] interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] interface ethernet> print
Flags: X - disabled, R - running
# NAME MTU MAC-ADDRESS ARP
0 R ToInternet 1500 00:30:4F:0B:7B:C1 enabled
1 R Office 1500 00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>
ref: http://www.mikrotik.com/documentation//manual_2.7/Interface/PPTP.html
General application of PPTP tunnels:
* For a secure router to router tunnels over the internet
* To link (bridge) local LANs or Intranets (EoIP think is also used)
* For mobile or remote clients to remotely access an intranet / LAN of a company (see PPTP setup for Windows for more information)
PPTP connction is each composed of a server and a client. The Mikrotik RouterOS may funcion as a server or the client - or, the various configurations, it may be some connections for the server and client for other connections. For example, the client created below could connect to a windows 2000 server, another Mikrotik Router, or another router which supports a PPTP server.
Description
PPTP is a secure tunnels for transporting IP traffic using PPP. PPTP encapsulates PPP in virtual lines that run over IP. PPTP incorporates PPP and the MPPE (Microsoft Point to Point Encryption) to make Encrypted links. The purpose of this protocol si to make well-managed secure connection (clients are avialable for and / or included in almost all OSS including Windows).
PPTP incluldes PPP authentication and accounting for each PPTP connection. Full authentication and accouting for each connection may be done through a radius of the client or Locally.
MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.
PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, the IP protocol ID 47), as Assigned by the internet Assigned Number Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and the protocol 47 traffic to be routerd through the firewall or router.
PPTP connection my be limited or dr to set up a masqueraded Policia /NAT IP connction. Please see the Micorsoft and RFC linke at the end of the section for more information.
PPTP Client Setup
Submenu Level: /interace pptp-client
Property Description
name (name; default: pptp-out1) - interface name for reference
mtu (interger; default: 1460) - Maximum transmits Unit. the optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentaion of packets)
mrt (integer; default:1460) - Maximum Receive Unit. The optimal vlaue is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MRU to 1460 to aviod fragmentation of packets)
connect-to (IP address) - the IP address of the PPTP server to connect to
user (string) - user name to use when logging on the remote server
password (string; default: "") - user password to use when loggin to the remote server
profile (name: default: default) - profile to use when connecting to the remote server
add-default-router (yes I no; default: no) - whether to use the server which this client is connected to as its default router (gateway)
Example
to set up PPTP client named test2 using username john with password john to connection the 10.1.1.12 PPTP server and use it as the default gateway:
[admin@Mikrotik] interface pptp-client> add name=test2 connect-to=10.1.1.12 \
\.. user=john add-default-route=yes passowrd=john
[admin@Mikrotik] interface pptp-client>print
Flage: X - disabled, R - running
0 X name="test2" mtu=1460 mru=1460 connect-to=10.1.1.12 user="john"
password="john" profile=default add-default-route=yes
[admin@Mikrotik] interface pptp-client> enable 0
Monitoring PPTP Client
Command name: /interface pptp-clent monitor
Property Description
Statistics:
Uptime (time) connection time displayed in days, hours, minutes, and seconds
encoding (string) - encrytion and encording (if asymmetric, separated with "/") being userd in this connection
status (string) - staturs of the client:
#Dialing - attempting to make a connection
#Verifying passowrd... - connection has been established tothe server, passwrod verification in progress
#connected - self-explanatory
#Terminated - interface is not enabled or the other side will not establish a connection
Example
Example of an established connection:
[admin@Mikrotik] interface pptp-client> monitor test2 uptime: 4h35s
encoding: MPPE 128 bit, stateless
status: connected
[admin@Mikrotik] interface pptp-client>
PPTP server setup
Submenu level : /interface pptp-server server
[admin@Mikrotik] interface pptp-server server> print
enabled: no
mtu: 1460
mru: 1460
authenticaion: mschap2
default-profile: default
[admin@Mikrotik] interface pptp-server server>
Description
The PPTP server supports unlimited connections form clients. For each cureent connection, a dynamic interface is created.
Property Description
enabled (yes I no; default:no) - defines whether PPTP server is enabled or not
mtu (integer; default: 1460 ) - Maximum Transmit Unit. The optimal vlaue is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500- byte ether net link,set the MTU to 1460 to avoid fragmentation of packets)
mru (integer; default: 1460) - Maximum Receive Unit. The optimal value is the MTU of the interface the tunnel is working over decreased by 40 (so, for 1500-byte ethernet link, set the MTU to 1460 to avoid fragmentation of packets)
authentication (multiple choice: pap chap mschap1 mschap2; default: mschap2) - authentication algorithm
default-profile (name; default: default) - default profile to use
Example
To enable PPTP server:
[admin@MikroTik] interface pptp-server server> set enabled=yes
[admin@MikroTik] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@MikroTik] interface pptp-server server>
PPTP Server Users
Submenu level : /interface pptp-server
Description
There are two types of items in PPTP server configuration - static users and dynamic connections. A dynamic connection can be established if the user database or the default-profile has its local-address and remote-address set correctly. When static users are added, the default profile may be left with its default values and only P2P user (in /ppp secret) should be configured. Note that in both cases P2P users must be configured properly.
Property Description
name - interface name
user - the name of the user that is configured statically or added
dynamically
Statistics:
mtu - shows (cannot be set here) client's MTU
client-address - shows (cannot be set here) the IP of the connected client
uptime - shows how long the client is connected
encoding (string) - encryption and encoding (if asymmetric, separated with '/') being used in this connection
Example
To add a static entry for ex1 user:
[admin@MikroTik] interface pptp-server> add user=ex1
[admin@MikroTik] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 DR ex 1460 10.0.0.202 6m32s none
1 pptp-in1 ex1
[admin@MikroTik] interface pptp-server>
In this example an already connected user ex is shown besides the one we just added.
PPTP Router-to-Router Secure Tunnel Example
The following is an example of connecting two Intranets using an encrypted PPTP tunnel over the Internet.
There are two routers in this example:
* [HomeOffice]
Interface LocalHomeOffice 10.150.2.254/24
Interface ToInternet 192.168.80.1/24
* [RemoteOffice]
Interface ToInternet 192.168.81.1/24
Interface LocalRemoteOffice 10.150.1.254/24
Each router is connected to a different ISP. One router can access another router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@HomeOffice] ppp secret> add name=ex service=pptp password=lkjrht
local-address=10.0.103.1 remote-address=10.0.103.2
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default
local-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@HomeOffice] interface pptp-server> add user=ex
[admin@HomeOffice] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 pptp-in1 ex
[admin@HomeOffice] interface pptp-server>
And finally, the server must be enabled:
[admin@HomeOffice] interface pptp-server server> set enabled=yes
[admin@HomeOffice] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@HomeOffice] interface pptp-server server>
Add a PPTP client to the RemoteOffice router:
[admin@RemoteOffice] interface pptp-client> add connect-to=192.168.80.1 user=ex \
\... password=lkjrht disabled=no
[admin@RemoteOffice] interface pptp-client> print
Flags: X - disabled, R - running
0 R name="pptp-out1" mtu=1460 mru=1460 connect-to=192.168.80.1 user="ex"
password="lkjrht" profile=default add-default-route=no
[admin@RemoteOffice] interface pptp-client>
Thus, a PPTP tunnel is created between the routers. This tunnel is like an Ethernet point-to-point connection between the routers with IP addresses 10.0.103.1 and 10.0.103.2 at each router. It enables 'direct' communication between the routers over third party networks.
To route the local Intranets over the PPTP tunnel – add these routes:
[admin@HomeOffice] > ip route add dst-address 10.150.1.0/24 gateway 10.0.103.2[admin@RemoteOffice] > ip route add dst-address 10.150.2.0/24 gateway 10.0.103.1
On the PPTP server it can alternatively be done using routes parameter of the user configuration:
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret> set 0 routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=defaultlocal-address=10.0.103.1 remote-address=10.0.103.2
routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret>
Test the PPTP tunnel connection:
[admin@RemoteOffice]> /ping 10.0.103.1
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms
ping interrupted
3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
Test the connection through the PPTP tunnel to the LocalHomeOffice interface:
[admin@RemoteOffice]> /ping 10.150.2.254
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms
ping interrupted
3 packets transmitted, 3 packets received, 0% packet lossround-trip min/avg/max = 3/3.0/3 ms
To bridge a LAN over this secure tunnel, please see the example in the 'EoIP' section of the manual. To set the maximum speed for traffic over this tunnel, please consult the 'Queues' section.
Connecting a Remote Client via PPTP Tunnel
The following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel giving that computer an IP address from the same network as the remote office has (without need of bridging over eoip tunnels)
Please, consult the respective manual on how to set up a PPTP client with the software You are using.
The router in this example:
* [RemoteOffice]Interface ToInternet 192.168.81.1/24
Interface Office 10.150.1.254/24
The client computer can access the router through the Internet.
On the PPTP server a user must be set up for the client:
[admin@RemoteOffice] ppp secret> add name=ex service=pptp password=lkjrht
local-address=10.150.1.254 remote-address=10.150.1.2
[admin@RemoteOffice] ppp secret> print detail
Flags: X - disabled
0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default
local-address=10.150.1.254 remote-address=10.150.1.2 routes==""
[admin@RemoteOffice] ppp secret>
Then the user should be added in the PPTP server list:
[admin@RemoteOffice] interface pptp-server> add name=FromLaptop user=ex[admin@RemoteOffice] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
# NAME USER MTU CLIENT-ADDRESS UPTIME ENC...
0 FromLaptop ex
[admin@RemoteOffice] interface pptp-server>
And the server must be enabled:
[admin@RemoteOffice] interface pptp-server server> set enabled=yes
[admin@RemoteOffice] interface pptp-server server> print
enabled: yes
mtu: 1460
mru: 1460
authentication: mschap2
default-profile: default
[admin@RemoteOffice] interface pptp-server server>
Finally, the proxy APR must be enabled on the 'Office' interface:
[admin@RemoteOffice] interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] interface ethernet> print
Flags: X - disabled, R - running
# NAME MTU MAC-ADDRESS ARP
0 R ToInternet 1500 00:30:4F:0B:7B:C1 enabled
1 R Office 1500 00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>
ref: http://www.mikrotik.com/documentation//manual_2.7/Interface/PPTP.html
Tuesday, December 2, 2008
Mirkotik Bandwidth Test
Overview
The Bandwidth Tester can be userd to momitor the Throughput only to a remote Mikrotik Router (either wired or wireless) and thereby help to discover the netwrok "bottlenecks".
The test uses the TCP standard TCP protocol with Acknowledgments, and follow the TCP algorithm on how many packets to send according to the latency, dropped packets, and other features in the TCP algorithm. Please review the TCP protocol for details on its internal speed settings and how to ANALYZE its Behavior. Statistics for Throughput are calculated using the entire size of the TCP packet. As Acknowledgments are an internal working of TCP, their size and usage of the links are not included in the throughput statistics. Therefore this statistical is not as reliable as the UDP statistical when Estimating Throughput.
The UDP Tester is 110% or more packets than currently reported as received on the other side of the link. To see the maximum Throughput of a link, the packet size should be set for the maximum allowed by the MTU links - usually this is 1500 bytes. There is no acknowledgment required by UDP; Implementation this means that the closest approximation of the Throughput can be seen.
Installation
The Bandwidth test feature is included in the 'system' package. No installaion is needed for this feature,
Hareware Resource Usage
! What! Bandwidth Test uses all available bandwidth (by default), and may impact the network usability.
There is no other significant resource usage.
Bandwidth Test Description
Bandwidth Test Server Configuration
[admin@Mikrotik] tool> bandwidth-server
Configure network bandwidth tester service. Use authentication for disabling unwanted bandwidth wating. Note that remote router must be Mikrotik Router in order to run the test.
session
print
get get value of property
set
export
[admin@Mikrotik] tool> bandwidth-server print
enable: yes
authentication: no
allocate-udp-ports-from: 2000 max-sessions: 10
[admin@Mikrotik] tool>
Setting description:
enable - enable client connections for bandwidth test
authenticate - communicate only with authenticated (by valid username and passwrod) clients
allocate-udp-ports-from - allocate UDP ports form
max-session - maximal number of bandwidth-test clients
The list of current connections can be get in SESSION submenu:
[admin@Mikrotik] tool> bandwidth-server session
print print values of item properties
remove remove item
[admin@Mikrotik] tool> bandwidth-server session
print
#FROM PROTOCOL DIRECTION USER
0 10.0.0.202 tcp send
[admin@Mikrotik] tool>
Bandwidth Test Client Configuration
Bandwidth Test uses TCP or UDP protocol for test. The test tries to use maximum or partial amount of bandwidth to test link speed. Be aware theat default test uses all available bandwidth and may impact network usability.
[admin@Mikrotik] tool> bandwidth-test
Run TCP or UDP bandwidth test. Tries to user maximum or partial amount of bandwith to test link speed. Note that remote router must be Mikrotik Router in order to run the test. Be aware that default test uses all available bandwidth and may impact network usability.
assume-lost-time
direction direction of datat flow
do
duration
interval
local-tx-speed
once print statistics once and quit
password Passowrd for remote user
protocol Protocol to use for test
remote-tx-speed
size UDP packet size or TCP seqment size
user
[admin@Mikrotik] tool> bandwidth-test
Descriptions of arguments:
address - ip address of destination host
assume-lost-time - if Bandwidth Server is not responding for that time, assume that connection is lost
direction - specify the direction of the test (receive, transmit, both, default is transmit)
do- script source
duration - Duration of the test
interval - Delay between messages (in seconds). Default is 1 second. Can be 20ms...5s
local-test-speed - transfer test maximum speed (given in bits per second)
password - password for remote user
protocol - type of protocol to use *UDP or TCP, default TCP)
remote-tx-speed - Receive test maximum speed (given in bits per second)
size - packet size in bytes (50.. 1500, default 512). works only with UDP protocol
user - Remote user
Bandwidth Test Example
[admin@Mikrotik] tool> bandwith-test 10.0.0.202
user=admin direction=both protocol=udp \
\ ... size=1500 duration=14s
status: done testing
tx-current: 11.49Mbps
tx-10-second-average: 10.05Mbps
txt-total-average: 7.96Mbps
rx-current: 12.55Mbps
rx-10-second-average: 10.33Mbps
rx-total-average: 8.14Mbps
[admin@Mikrotik] tool>
The Bandwidth Tester can be userd to momitor the Throughput only to a remote Mikrotik Router (either wired or wireless) and thereby help to discover the netwrok "bottlenecks".
The test uses the TCP standard TCP protocol with Acknowledgments, and follow the TCP algorithm on how many packets to send according to the latency, dropped packets, and other features in the TCP algorithm. Please review the TCP protocol for details on its internal speed settings and how to ANALYZE its Behavior. Statistics for Throughput are calculated using the entire size of the TCP packet. As Acknowledgments are an internal working of TCP, their size and usage of the links are not included in the throughput statistics. Therefore this statistical is not as reliable as the UDP statistical when Estimating Throughput.
The UDP Tester is 110% or more packets than currently reported as received on the other side of the link. To see the maximum Throughput of a link, the packet size should be set for the maximum allowed by the MTU links - usually this is 1500 bytes. There is no acknowledgment required by UDP; Implementation this means that the closest approximation of the Throughput can be seen.
Installation
The Bandwidth test feature is included in the 'system' package. No installaion is needed for this feature,
Hareware Resource Usage
! What! Bandwidth Test uses all available bandwidth (by default), and may impact the network usability.
There is no other significant resource usage.
Bandwidth Test Description
Bandwidth Test Server Configuration
[admin@Mikrotik] tool> bandwidth-server
Configure network bandwidth tester service. Use authentication for disabling unwanted bandwidth wating. Note that remote router must be Mikrotik Router in order to run the test.
session
get get value of property
set
export
[admin@Mikrotik] tool> bandwidth-server print
enable: yes
authentication: no
allocate-udp-ports-from: 2000 max-sessions: 10
[admin@Mikrotik] tool>
Setting description:
enable - enable client connections for bandwidth test
authenticate - communicate only with authenticated (by valid username and passwrod) clients
allocate-udp-ports-from - allocate UDP ports form
max-session - maximal number of bandwidth-test clients
The list of current connections can be get in SESSION submenu:
[admin@Mikrotik] tool> bandwidth-server session
print print values of item properties
remove remove item
[admin@Mikrotik] tool> bandwidth-server session
#FROM PROTOCOL DIRECTION USER
0 10.0.0.202 tcp send
[admin@Mikrotik] tool>
Bandwidth Test Client Configuration
Bandwidth Test uses TCP or UDP protocol for test. The test tries to use maximum or partial amount of bandwidth to test link speed. Be aware theat default test uses all available bandwidth and may impact network usability.
[admin@Mikrotik] tool> bandwidth-test
Run TCP or UDP bandwidth test. Tries to user maximum or partial amount of bandwith to test link speed. Note that remote router must be Mikrotik Router in order to run the test. Be aware that default test uses all available bandwidth and may impact network usability.
assume-lost-time
direction direction of datat flow
do
duration
interval
local-tx-speed
once print statistics once and quit
password Passowrd for remote user
protocol Protocol to use for test
remote-tx-speed
size UDP packet size or TCP seqment size
user
[admin@Mikrotik] tool> bandwidth-test
Descriptions of arguments:
address - ip address of destination host
assume-lost-time - if Bandwidth Server is not responding for that time, assume that connection is lost
direction - specify the direction of the test (receive, transmit, both, default is transmit)
do- script source
duration - Duration of the test
interval - Delay between messages (in seconds). Default is 1 second. Can be 20ms...5s
local-test-speed - transfer test maximum speed (given in bits per second)
password - password for remote user
protocol - type of protocol to use *UDP or TCP, default TCP)
remote-tx-speed - Receive test maximum speed (given in bits per second)
size - packet size in bytes (50.. 1500, default 512). works only with UDP protocol
user - Remote user
Bandwidth Test Example
[admin@Mikrotik] tool> bandwith-test 10.0.0.202
user=admin direction=both protocol=udp \
\ ... size=1500 duration=14s
status: done testing
tx-current: 11.49Mbps
tx-10-second-average: 10.05Mbps
txt-total-average: 7.96Mbps
rx-current: 12.55Mbps
rx-10-second-average: 10.33Mbps
rx-total-average: 8.14Mbps
[admin@Mikrotik] tool>
Create DOTA Mikrotik
DOTA is one of the Warcraft game to the online version. GameNet grames on this is in addition to games terlaris games online-games such as sealonline, pangya, deco and many more. besides games this free site packing pocer aliases, is also very passionate. Here is try to write about how to create DOTA in the engine mikrotik.
Stay turn.........
Following these steps:
[admin@BaseStation] >ip firewall nat add chain=srcnat action=masquerade out-interface=Public
[admin@BaseStation] >ip address add address=202.xxx.xxx.xxx/32 interface=Public
[admin@BaseStation] >ip firewall nat add chain=dstnat dst-address=202.xxx.xxx.xxx
action=dst-nat to-address=192.168.xxx.xxx (xxx filled in accordance with the ip local want to create games)
[admin@BaseStation] >ip firewall nat add chain=srcnat src-address=192.168.xxx.xxx action=src-nat to address=202.xxx.xxx.xxx
To be incorporated in the client's LAN or a network can play with the add command:
[admin@BaseStation] >ip firewall nat add chain=dstnat dst-address=202.xxx.xxx.1-202.xxx.xxx.254 action=netmap to-address=192.168.xxx.1-192.168.xxx.254
[admin@BaseStation] >ip firewall nat add chain=srcnat src-address=192.168.xxx.1-192.168.xxx.254 action=netmap to-address=202.xxx.xxx.1-202.xxx.xxx.254
Up here have been successful, but in fact there is a problem that i face, namely the engine Mikrotik i can not access or remote from outside the network and other problems, follow-port SNMP follow-up ketuptup so to show the sort of cacti ... ther is a blank so that you can help
Fix Dota Mikrotik
Previously i had to write about the Rules Create Dota in Mikrotik, but there are obstacles when it is activated routerbox rules can not be in a remote, diping can not even display a graph MRTG / Cacti.
After some time to try and find literrature from the LEADER of google eventually rules that are suitable of the remote form outside the network, can ping and course i can see a graph of bandwidth via MRTG / Cacti.
Rule it like this:
ip firewall nat add chain=dstnat dst-address=202.xxx.xxx.xxx protocol=tcp dst-port=6113 action=dst-nat to-addresses=192.168.xxx.xxx to-ports=6113
ip firewall nat add chain=dstnat dst-address=202.xxx.xxx.xxx protocol=udp dst-port=6113 action=dst-nat to-addresses=192.168.xxx.xxx to-ports=6113
ip firewall nat add chain=srcnat src-address=192.168.xxx.xxx protocol=tcp src-port=6113 action=src-nat to-addresses=202.xxx.xxx.xxx to-ports=6113
ip firewall nat add chain=srcnat src-address=192.168.xxx.xxx protocol=udp src-port=6113 action=src-nat to-addresses=202.xxx.xxx.xxx to-port=6113
ip firewall nat add chain=srcnat src-address=192.168.xxx.xxx-192.168.xxx.xxx action=netmap to-address=202.xxx.xxx.xxx-202.xxx.xxx.xxx to-port=0-65535
May already know alot about the rules above, i hope the above rules can be used by anyone who need it, because from experience that ther is indeed difficult toind literature or googling about the rule create dota in Mikrotik.
Stay turn.........
Subscribe to:
Posts (Atom)
