Showing posts with label Mikrotik. Show all posts
Showing posts with label Mikrotik. Show all posts

Mar 13, 2013

How to Connect two Mikrotik SXT-5D's In Bridge Mode

Things covered in this how to:
  • Connecting Two Mikrotik RouterBoard SXT-5D devices together in Bridge Mode
  • Upgrading your SXT’s to the Latest Version of RouterOS
  • Doing a Bandwidth Test Between two RouterBoard SXT-5D’s

If you're relatively new to the Mikrotik world my recommendation would be to setup the SXT’s so that they’re both powered on and plugged into the same switch as shown in the photo below.



By default all RouterBoard products come configured with the IP address of the ethernet port set to 192.168.88.1

Connecting for the First Time

There are several ways to get connected to the RouterBoard to start configuring it.

The first and simplest way is to connect using Winbox through the MacAddress connect feature. If you don’t have Winbox on your machine you can download WinBox from here.

With everything plugged into the same switch...open Winbox.

Admin should be in the Username field and the Password field should be blank.

Click the Elipsis button next to the “Connect To:" field. You should see both SXT’s in the dropdown list.



Before I continue, it’s worth mentioning you could add another IP address to your network adapter on the computer you're working on (e.g. 192.168.88.10). You could then put 192.168.88.1 in the “Connect to:” field and you would get connected. The reason I recommend the above way is because it’s not exactly necessary and you’re probably going to be changing the addresses on the SXT’s to match your network anyway.

Click on the MAC address of the first SXT listed (It’s important you click the MAC address - if you click the IP address....you won’t get connected unless you're on the same network.)

Once you login, you’ll see a “RouterOS Default Configuration” screen. Click OK.

With the new WinBox window open....go back and open the WinBox app again and connect to the other SXT - if you're not sure which is which, look at the MAC address at the top of WinBox that’s already open.

Now that you’re WinBox’d into both SXT’s the fun begins!


Getting organized with System Identities


The first configuration change you’ll want to make is to set the “System Identities” so you don’t get confused as to which radio you're working on. In the photo above I have an SXT on the left and one on the right.
  • Click on the System button on the left then Identity
  • Changed the name to something useful - In my case we’ll do SXT Left and SXT Right.
  • Make the change to both radios.

Upgrading RouterOS

At the top of the WinBox screen you’ll see the current version for RouterOS that’s being used. To get the best performance (and to match the instructions below) you really want the latest version. As of this writing that version is 5.1 and you can download it by visiting Mikrotik’s Download page or by clicking here.

Once the file has downloaded, open folder the file was downloaded to, right click on it and Select Copy.

Then do the following to each SXT:
  • Click the Files button on the left
  • Click the Clipboard icon at the top of the FileList window



The file will start to upload. If it doesn’t...go back to where the file download, right click and Copy the file to the system clipboard.



Once it’s done....Click the System button then Reboot.

You should hear a double beep in less than a minute. The double beep lets you know the board is are ready to go.

NOTE: Be sure not to disconnect the power while the boards are upgrading !


Upgrading the Firmware


Log back into both SXTs using WinBox then do the following to upgrade the system firmware.
  • Click the New Terminal button on the left.
  • (Tip: If you want to see what version you’re currently using type system routerboard print)
  • Type system routerboard upgrade
  • Enter Y to confirm you want to upgrade.
  • After upgrading reboot by using the buttons on the left (System > Reboot) or by typing sys reboot then Y to reboot.




Making the Wireless Connection


Now that your SXT’s have the latest and greatest OS and firmware its time to connect them wirelessly.

With a WinBox window open for each device:
  • Click the Wireless button on the top left
  • You’ll notice interface “wlan1” is greyed out or dimmed - this means it’s currently disabled.
  • Right Click on the “wlan1” interface and click Enable in the drop down menu or click the Blue check button on the menu bar. You should see the the interface change to enabled.

We’re going to make the left SXT our “AccessPoint” and the right SXT our “client”.

Note there are a couple settings that you may want to change to something different once you’ve got everything setup. For example you may want to change the SSID to “MyAwesomeBackhaul”....it’s not necessary to get things connected so if this is your first time....don’t change anything unless I mention it (you could boink your link and be frustrated and throw your coffee cup and that wouldn’t be cool).

Do the following on the SXT you’ve decided to be the Access Point. In our case it’s the Left SXT:

AccessPoint Configuration
  • Double click on Wlan1.
  • Click the Wireless tab at the top
  • Click the Mode dropdown menu and change it to “Bridge”
  • Click the Band dropdown menu and change it to “5Ghz-only-N”
  • Click the Wireless Protocol dropdown and change it to “NV2”
  • Click the HT tab at the top
  • Select all 4 HT chain options
  • Press the Apply button on the top right.

Client Configuration


You should already have WinBox open and connected to the client or “Right SXT”. (If you jumped ahead....the picture at the beginning shows an SXT on the left and one on the right.)

Now, without making any configuration changes, you should be able to see the AP when doing a scan. Lets go ahead an do that and use the connect button so that we’re sure the SSID’s match.
  • Double click on Wlan1
  • Click the Scan button on the right.
  • The AP should show up, if it doesn’t something isn’t right....Assuming it does, click on the SSID shown in the list and click the Connect Button then Close


By using the Scan and Connect method above, you’ve set the SSID on the client side to match the AP exactly. There are still several things to be changed before they actually connect though.

You should be back at the wireless tab:
  • Click the Mode dropdown menu and change it to “Station Bridge”
  • Click the Band dropdown menu and change it to “5Ghz-only-N”
  • Click the Wireless Protocol dropdown and change it to “Any"
  • Click the HT tab at the top
  • Select all 4 HT chain options


Press the Apply button on the top right.

You should see a “R” next to the wlan Interface in the Wireless Tables window now. This means the client is registered and connected!



If you’re not getting a registration between the two devices or you're having trouble with any of the above steps...head over to the forum and post your question - We’re there to help!

 Setting up the Bridge

To setup the SXT to bridge network traffic do the following to each SXT:

  • Click the Bridge button on the left
  • Click the Plus button on the menu bar

  • Click the STP tab at the top
  • Change the “Protocol Mode:” to RSTP
  • Click OK


Back at the Bridge window:
  • Click the Ports tab at the top
  • Click the Plus button on the menu bar
  • What defaults in the “New Bridge Port” window is what you want, so click OK. This adds Ether1 to the bridge
  • Click the Plus button on the menu bar again.
  • Click the “Interface” drop down menu and select Wlan1
  • Click Ok
Your Bridge window should look similar to this:



Note: As soon as you finish adding the last bridge your going to get disconnected from one of the SXTs. To get reconnected you’ll need to unplug it from the network switch. They’re still connected wirelessly - Just open WinBox and use the MAC address tool to connect.

Bandwidth Test Between Two Mikrotik SXT-5Ds

I’m not going to cover connecting networks between two SXTs - may be in another post - instead, we’ll make a few changes that will allow us to do a quick bandwidth test. These changes should get you on your way to connecting through the devices as well

First Change the IP address on our client bridge (right SXT) to something else besides 192.168.88.1.

  • Click the IP button on the left then Addresses
  • Double click on the default address - 192.168.88.1
  • Change it to 192.168.88.2 (make sure to leave the /24 in there)
  • Click OK


You should now be able to do a bandwidth test.
  • WinBox Into the Access Point SXT (Still using the MAC Address Tool)
  • Click the Tools button on the left then Bandwidth Test
  • Change the “Test To:” field to the address of the client - 192.168.88.2
  • Click the “User” field and enter admin for the username
  • Click the Start button


Now if you were to test TCP traffic at this point - The results wouldn't be as impressive. This is because you’re relying on the SXT’s to both process and create traffic. This causes a hit to the processor that slows everything down.



Testing through an SXT to a RouterBoard 800 is a different story. Note that you would probably see more...but the SXT only has a 100MB ethernet port.



Getting the most out of your SXT

Now if you really want to push the SXT’s to get the maximum throughput there are a few things to change.

If you haven’t already, you might get as much separation as possible from one SXT to another. In all of the tests below - the SXTs are about 30 feet (10 meters) from each other. This will help their performance.

The first thing we’re going to change is the TX power. With the radios still so close together the signals will to be too high and you’re not going to get the best results.

Do the following to both SXTs:

  • Double click on the Wlan1 in the Wireless Tables
  • Click the Advance Mode button at the bottom right (If you’re already in advance mode - you’ll see a Simple Mode button instead - don’t click it just go to the next step.)
  • Click the TX Power tab
  • Click the TX Power Mode list and select All rates fixed
  • Now here is where it gets tricky....if the radios are just a few feet away then you shouldn’t have any problems setting the TX Power to 0. The goal here is to lower the TX power until you get the signals to be somewhere between -45 and -60 dB on both sides.



IMPORTANT: Make sure that you change the TX Power settings back to defaults before you unplug your SXT’s and try to deploy them in the field. Otherwise...you’ll be sad.

Now for the additional changes to max everything out. There are a few changes here that have the potential to increase latency, AMPDU Priorities being one of them. I’m not suggesting that you leave these settings in the real world...I’m just showing what is possible.

If you have any questions about these settings, again, hop over to the forum and ask away!

Make the following changes on both sides *beginning with the client first*.

  • Double click on the Wlan1 interface in the Wireless Tables
  • Click the Advance Mode button at the bottom right (If you’re already in advance mode - you’ll see a Simple Mode button instead - don’t click it just go to the next step.)
  • Click the HT tab
  • Set “HT Guard Interval” to long
  • Click the “HT Extension Channel” list and select Above Control
  • Select all 7 Options under “HT AMPDU Priorities”



With the new settings our UDP Bandwidth test looks like this.



And testing Both ways

How to Setup Your Own Hotspot with MIKROTIK routers

1. First we need to define the first port for WAN connection so the router will connect to the internet via another router with DHCP.
In winbox click IP > DHCP Client and Add DHCP Client to port ether1
2. Let's add the hotspot service to wlan Click IP > HotSpot and the hotspot Setup box, choose wlan1 as hotspot interface. You can accept default values but choose none for certificate. Leave the IP as it is (10.5.50.x). If you change this IP, the LOGIN and LOGOUT links will not work on your splash page.

3. The router should be placed in ap bridge mode.
Click interface, double click wlan1, click Mode: and select ap bridge
And make sure the frequency is set to 2.4 b/G.
4. You need to add our radius server as authentication and accounting server.
In the hotspot profiles (IP > HotSpot > Profiles) choose your hotspot profile and click the radius tab, check allow radius. Then click the login tab and de-select cookie, allow http pap and chap.

5. You need to define our radius server. Click Radius and the + sign to add our radius server.
Click Services > Hotspot, enter radius address: Radius.hotspotsystem.com, Secret: hotsys123
Check the box next to hotspot

6. You need to add the secondary radius server. Click Radius and the + sign.
Click Services > Hotspot, enter radius Address: radius2.hotspotsystem.com, Secret: hotsys123
Check the box next to hotspot
7. We have to allow certain sites and servers for non authenticated users otherwise they can't buy access.
In the section IP > HotSpot > Walled Garden, click on + sign and add the following domains to Dst. Host one by one:
*.hotspotsystem.com
*.worldpay.com
*.paypal.com
*.paypalobjects.com
*.paypal-metrics.com
*.altfarm.mediaplex.com
*.akamaiedge.net
paypal.112.2O7.net
*.moneybookers.com
*.adyen.com *.directebanking.com
*.paysafecard.com
betalen.rabobank.nl
ideal.ing.nl
internetbankieren.frieslandbank.nl
ideal.abnamro.nl
ideal.snsreaal.nl
ideal.triodos-onlinebanking.nl

For Hotspot FREE SOCIAL locations: you must add 'www.apple.com' too!
Then in the section IP > HotSpot > Walled Garden > IP List add the following IPs to Dst. Address one by one (if your Mikrotik doesn't allow netmask values (.0/24) you can skip the netmask value):
194.149.46.0/24
198.241.128.0/17
66.211.128.0/17
216.113.128.0/17
70.42.128.0/17
128.242.125.0/24
216.52.17.0/24
62.249.232.74
155.136.68.77
66.4.128.0/17
66.211.128.0/17
66.235.128.0/17
88.221.136.146
195.228.254.149
195.228.254.152
203.211.140.157
203.211.150.204
82.199.90.136/29
82.199.90.160/27
91.212.42.0/24
8. You need to syncronize the router's time with our server.
Click on System > NTP Client. Enter primary and secondary NTP servers. To find NTP servers, go to http://www.pool.ntp.org/ and select the location's continent on the right side of the page. You'll find NTP servers there.
Be sure to leave TimeZoneName: manual, and TimeZone: 00:00 in System > Clock. (Don't set your own timezone, because the router has to show the GMT time!)

9. You need to change the router's NASID. The NASID setting in the Mikrotik is located under System > Identity. Default is 'MikroTik'.
Change this the following way: OPERATORUSERNAME_LOCATIONNUMBER
Example: Operator Username is 'globalhotspot', Location ID: '2', then NASID should be: 'globalhotspot_2'
NOTE: In case you are installing multiple routers in the same location, you should use different NAS IDs. For the second routers you need to add '_wds_1' to the NAS Id, for the third router '_wds_2', etc. So for example if you want to install the second router in location 3, the NASID should be set to 'globalhotspot_3_wds_1'.

10. You have to customize Mikrotik's built-in login page. On the side menu go to Files, and find the login.html file under the 'hotspot' directory. Double click on the file and choose Backup.
Open a simple text editor like notepad and copy and paste the following to the editor:

Save it as login.html to your Desktop.
Drag and drop this login.html to your "hotspot" directory in the Winbox program.
If you wish to use FTP you can FTP to your mikrotik router with the admin userid and password and replace the file there under the 'hotspot' directory.
If you don't wish to redirect users to our nice splash page you can continue to use the router's built-in login page but in this case it is important to add a link to the internal page where your users can buy access or activate their prepaid cards. Click here for more information.

10/b. In case you are using Hotspot FREE SOCIAL service, you also need to edit logout.html template. You need to use the same content as for the login.html (code above).

11. You have to set the Login/Logout URL IP addresses in the Control Center. Log in to the Control Center with your Operator Username and password and go to Manage > Locations. Click on the location, then click on Modify Hotspot Data & Settings. In Splash Page Settings modify the Internal Login/Logout URL Set to Mikrotik. Make sure that 'Display Login Box on Main Splash Page' option is CHECKED.

12. Extend the shared-users limit in your hotspot profile.
Sub-menu: /ip hotspot user profile
or go to IP > Hotspot > User Profiles > default > Shared-Users
Change shared-users to 5.

13. As the last step you have to add hourly checking for up status for the Router Alert feature.
Go to System > Scheduler and add a new task by pressing the plus sign.
Name: up
Interval: 01:00:00
On Event:


Policy: enable all
Press Apply and OK.
That's all. You can setup hotspot service even on a wired connection. In this case you have to choose an ethernet port instead of wlan or you can setup hotspot on both ports.
If you have successfully setup your mikrotik router you have to see a login window when connecting via wireless. You can log in with username admin, blank password.

How to set up OpenVPN on router: Mikrotik RouterOS

IMPORTANT: Don't setup your Mikrotik RouterOS remotely. You have to be connected via the LAN interface, otherwise you will cut the connection (access to the router) and you will not be able to access it remotely any more.
  1. Update Router OS on your Mikrotik router to latest version (at least version v5.8)
  2. Connect to your Mikrotik router via WinBox.
  3. Setup the DNS servers manually to Google DNS: IP -> DNS -> Settings -> Servers
    • 8.8.8.8
    • 8.8.4.4
  4. Write down the default gateway IP address of your Internet provider (ISP) and remove the default-route (Dst. Address = 0.0.0.0/0 routed via your ISP GW) from the routing table. If you don't use DHCP Client please follow the STEP 5.
  5. Go to IP -> DHCP Client and disable the "Add Default Route" option.
  6. Your routing table should not contain any default route now. See the screen bellow.
  7. Add new static route to your routing table. Dst. address is an IP address of the VPN server you want connect to. Gateway is the default gateway IP address of your Internet provider (ISP). You should have the IP written down since STEP 1.
  8. Setup the OVPN client according to the screens bellow. Status should appear as connected once you click Apply.
  9. Please check your interfaces and routing table again. The correct configuration should look similar to the screen bellow.
  10. Now you should be able to ping for example google.com. If all works well, then you can setup NAT masquerade of your LAN network so all devices behind the Mikrotik Router will use the VPN connection.

Basic MikroTik RouterOS Configuration using winbox

This article ex"plains' ho\"w to c\'onfigure a Mikrotik device straight out of the box. It goes through the Winbox configuratoin utility and some of the basic setup procedures to turn your MikroTik device into a home or office wireless and wired router. In this tutorial we will go through a step by step guide to make it as simple as possible to learn and implement these setting s on your own routers.

Completed
  • Downloading and running winbox
  • Winbox in more detail including configuration files
  • Setting an identity on the router
  • Setting an IP address on the router
  • Setting a password
Coming soon...
  • Setting up dhcp client
  • Setting up a dhcp server on a bridge
  • Setting up a nat (Network Address Translation)
  • Securing services on the router
  • Setting up the wireless Access Point
  • Implementing a basic firewall for security

Downloading and running Winbox


Winbox is the graphical configuration utility for MikroTik RouterOS. It is a small application that can be downloaded from the MikroTik website at htttp://www.mikrotik.com Once you download winbox it can be run straight away, as no installation is required. It does however when running, setup a number of folders in your application data folder in order to save login data and plugins. This is transparent to the user but worthwhile to be aware, in order to diagnose problems and also understand the security implications of saving sensitive login information in the utility.

Winbox in more detail - including configuration files

Setting an identy on the router

1. Go to http://www.mikrotik.com/download.html and download the latest Winbox Configuration Tool under the Tools and Utilities section to you desktop.
2. Double click on the Winbox icon on your desktop.

3. Click on System menu item then on the Identy sub menu as in the image below.


4. The Identity dialog will open as in image below. Remove the default "Mikrotik" value and replace it with something meaning full. Usually the location of the router combiened with its purpose acts as a suitable Identity for your router.

To configure your router
Click IP >> Addresses on the left menu in winbox as in diagram below.
Winbox IP address

This will open the Address list dialog window as seen below. Click on the red plus button to open the add IP address window.
winbox IP address List Dialog

When the New IP address dialog opens enter the address details select an interface to set the adress on and press apply and OK button.
Winbox new ip address dialog
For information on what IP settings to use please see a basic tutorial in IP Networking. But just to explain one or two points about this dialog...
It is best to delete an address entirely instead of editing it, as I found that it a cleaner way of editing an address as to modify network or broadcast options can sometimes not apply 100% properly.
You have an option of entering the network and broadcast address explicitly in the boxes provided or is you prefer you can use the short slash notation and press the apply button, this will populate the broadcast and network boxes with the correct settings.


This tutorial demonistrates how to set the password of the current Mikrotik Winbox user.
Click on the menu item as shown below
System >> Password
winbox change a password menu item

This will open the password dialog box as shown below.
Mikroitk winbox Set Password dialog box
Enter the old or current password followed by the new password that you wish to use.
If this is your first time logging into the router or the router is on factory settings the Old password box should be just left blank. As the default username and password is admin and no password.

Note:
This is how you set the password of the current Winbox user. To change other users you must go to system >> users menu item open that dialog and set the password for that particular user. You must have adequate user privileges to perform this action.


 

Twitter Delicious Facebook Digg Stumbleupon Favorites More

 
Design by Computer Tricks and Tips