Наложи ми се малко по различна конфигурация на Микротик от стандартната такава. За целта имам пет обекта, магазини в различни части на града свързани с обща преносна среда в сегмент 10.18.0.0/16, три от обектите са с Микротик RouterBOARD и два с Linksys DD-WRT. Между пете обекта трябва да се създаде независима вътрешна мрежа с тунели и едно от условията е да не е бриджинг защото е имало патила вече с някакъв вирус наречен Parite. Първата ми мисъл беше да направя EoIP тунели но на единия DD-WRT нещо му стана и “заби” та се наложи да ходя до него на другия край на града да го рестартирам и се отказах от тази идея. Така се спрях на най стария и изпитан тунел IPIP. Дълго гледах в терминала на Микротик и се чудех откъде да започна докато не си отворих един тесктов файл и ред по ред начертах топологията на виртуалната мрежа от тунели. Реших 10.18.9.66 да бъде централен рутер и всички четири тунела да се събират в него. Самият адрес 10.18.9.66 се вдига по DHCP с default gateway 10.18.9.254 откъдето си идва и Интернета към вътрешната мрежа на рутера 192.168.122.0/24. Така интернета няма нищо общо с тунелите и е ясно като бял ден, че мрежи 192.168.122.0/24, 192.168.123.0/24, 192.168.124.0/24, 192.168.125.0/24, 192.168.126.0/24 трябва да се виждат през 10.18.0.0/16 преносна среда посредством въпросните IPIP тунели.
________
/
dhcp-client 10.18.9.1 212.233.128.0/17
+-----------------------+--------------/
|ether1 |10.0.0.0/8 /
+------+----------+ +---Mikrotik-2-+ |
| 10.18.9.66/24 | | 10.18.6.162 | /
| | 192.168.123.0/24 |
+ MikroTik 1 + | | Internet
| | +---MikroTik-3-+ |
|192.168.122.0/24 | | 10.18.9.62 | \
+------+----------+ 192.168.126.0/24 |
|ether2 | \
_|_ +----DD-WRT-4--+ \________
__/ \_ | 10.18.5.103 |
_/ \__ 192.168.124.0/24
/ \ |
\ Local \ +----DD-WRT-5--+
\ __/ | 10.18.5.104 |
\__ __/ 192.168.125.0/24
\___/ |
________
/
dhcp-client 10.18.9.1 212.233.128.0/17
+-----------------------+--------------/
|ether1 |10.0.0.0/8 /
+------+----------+ +---Mikrotik-2-+ |
| 10.18.9.66/24 | | 10.18.6.162 | /
| | 192.168.123.0/24 |
+ MikroTik 1 + | | Internet
| | +---MikroTik-3-+ |
|192.168.122.0/24 | | 10.18.9.62 | \
+------+----------+ 192.168.126.0/24 |
|ether2 | \
_|_ +----DD-WRT-4--+ \________
__/ \_ | 10.18.5.103 |
_/ \__ 192.168.124.0/24
/ \ |
\ Local \ +----DD-WRT-5--+
\ __/ | 10.18.5.104 |
\__ __/ 192.168.125.0/24
\___/
Конфигурация на рутер Mikrotik 1 с адрес 10.18.9.66.
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.122.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.9.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.9.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.122.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
snmp set enabled=yes
system identity set name=shipka
interface ipip add local-address=10.18.9.66 remote-address=10.18.6.162 name=tun0 disabled=no
ip address add address=192.168.223.1/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.123.0/24 gateway=192.168.223.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.9.62 name=tun1 disabled=no
ip address add address=192.168.226.1/30 interface=tun1
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun1 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.126.0/24 gateway=192.168.226.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.5.103 name=tun2 disabled=no
ip address add address=192.168.224.1/30 interface=tun2
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun2 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.124.0/24 gateway=192.168.224.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.5.104 name=tun3 disabled=no
ip address add address=192.168.225.1/30 interface=tun3
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun3 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.125.0/24 gateway=192.168.225.2 |
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.122.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.9.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.9.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.122.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
snmp set enabled=yes
system identity set name=shipka
interface ipip add local-address=10.18.9.66 remote-address=10.18.6.162 name=tun0 disabled=no
ip address add address=192.168.223.1/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.123.0/24 gateway=192.168.223.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.9.62 name=tun1 disabled=no
ip address add address=192.168.226.1/30 interface=tun1
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun1 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.126.0/24 gateway=192.168.226.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.5.103 name=tun2 disabled=no
ip address add address=192.168.224.1/30 interface=tun2
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun2 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.124.0/24 gateway=192.168.224.2
interface ipip add local-address=10.18.9.66 remote-address=10.18.5.104 name=tun3 disabled=no
ip address add address=192.168.225.1/30 interface=tun3
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun3 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.125.0/24 gateway=192.168.225.2
Конфигурация на рутер Mikrotik 2 с адрес 10.18.6.162
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.123.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.6.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.6.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.123.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
interface ipip add local-address=10.18.6.162 remote-address=10.18.9.66 name=tun0 disabled=no
ip address add address=192.168.223.2/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.122.0/24 gateway=192.168.223.1 |
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.123.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.6.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.6.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.123.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
interface ipip add local-address=10.18.6.162 remote-address=10.18.9.66 name=tun0 disabled=no
ip address add address=192.168.223.2/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.122.0/24 gateway=192.168.223.1
Конфигурация на рутер Mikrotik 3 с адрес 10.18.6.162
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.126.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.9.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.9.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.126.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
interface ipip add local-address=10.18.9.62 remote-address=10.18.9.66 name=tun0 disabled=no
ip address add address=192.168.226.2/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.122.0/24 gateway=192.168.226.1 |
ip dhcp-client add interface=ether1 disabled=no
ip address add address=192.168.126.1/24 interface=ether2
ip route add dst-address=212.233.128.0/17 gateway=10.18.9.1
ip route add dst-address=10.0.0.0/8 gateway=10.18.9.1
ip firewall nat add chain=srcnat action=masquerade src-address=192.168.126.0/24 out-interface=ether1
system ntp client set enabled=yes primary-ntp=213.91.134.2
system ntp client set enabled=yes secondary-ntp=77.236.160.14
ip upnp set enabled=yes
ip upnp interfaces add interface=ether1 type=external disabled=no
ip upnp interfaces add interface=ether2 type=internal disabled=no
ip dns set allow-remote-requests=yes
interface ipip add local-address=10.18.9.62 remote-address=10.18.9.66 name=tun0 disabled=no
ip address add address=192.168.226.2/30 interface=tun0
ip firewall mangle add chain=postrouting protocol=tcp tcp-flags=syn out-interface=tun0 action=change-mss new-mss=clamp-to-pmtu
ip route add dst=192.168.122.0/24 gateway=192.168.226.1
Конфигурация на рутер DD-WRT 4 с адрес 10.18.5.103
sleep 10
route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.18.5.1
route add -net 212.233.128.0 netmask 255.255.128.0 gw 10.18.5.1
insmod ipip
ip tunnel add tun0 mode ipip remote 10.18.9.66 local 10.18.5.103 ttl 255
ifconfig tun0 192.168.224.2 netmask 255.255.255.252
route add -net 192.168.122.0 netmask 255.255.255.0 gw 192.168.224.1 dev tun0
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o tun0 -j TCPMSS --clamp-mss-to-pmtu |
sleep 10
route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.18.5.1
route add -net 212.233.128.0 netmask 255.255.128.0 gw 10.18.5.1
insmod ipip
ip tunnel add tun0 mode ipip remote 10.18.9.66 local 10.18.5.103 ttl 255
ifconfig tun0 192.168.224.2 netmask 255.255.255.252
route add -net 192.168.122.0 netmask 255.255.255.0 gw 192.168.224.1 dev tun0
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o tun0 -j TCPMSS --clamp-mss-to-pmtu
Конфигурация на рутер DD-WRT 5 с адрес 10.18.5.104
sleep 10
route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.18.5.1
route add -net 212.233.128.0 netmask 255.255.128.0 gw 10.18.5.1
insmod ipip
ip tunnel add tun0 mode ipip remote 10.18.9.66 local 10.18.5.104 ttl 255
ifconfig tun0 192.168.225.2 netmask 255.255.255.252
route add -net 192.168.122.0 netmask 255.255.255.0 gw 192.168.225.1 dev tun0
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o tun0 -j TCPMSS --clamp-mss-to-pmtu |
sleep 10
route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.18.5.1
route add -net 212.233.128.0 netmask 255.255.128.0 gw 10.18.5.1
insmod ipip
ip tunnel add tun0 mode ipip remote 10.18.9.66 local 10.18.5.104 ttl 255
ifconfig tun0 192.168.225.2 netmask 255.255.255.252
route add -net 192.168.122.0 netmask 255.255.255.0 gw 192.168.225.1 dev tun0
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o tun0 -j TCPMSS --clamp-mss-to-pmtu