Tag Archives: mikrotik

DrawIO

I used to draw my network using inkscape, or graphviz. But the last years i’ve been using DrawIO. A friend is drawing his. So i posted some tips.

When using inkscape, i liked the way that i could view more or less details using layers. But editing was hard.

Getting DrawIO:

There is a online version: https://app.diagrams.net/
You can download a AppImage
And .. install it in your nextcloud, which is the way i’m using it.
(Login as admin, click Apps and search for draw.io)

Some tips on using images ..
Below is a example of a Mikrotik switch with connector points.

Use a search engine to look for images, the ones with front facing connectors are easier to use.
I always look for images which have a transparent background.
Using google you can use below ‘trick’
google > images > tools > color > transparent
Just copy-paste into your DrawIO document, it is better to have a large picture which you can resize as the other way around.

Adding connection points:

Left click the image in DrawIO, right mouse and Edit connection points

Now you can place/remove edit connection points.

Due to security reasons i won’t be posting my complete network image ..

Another tip:

Network sheet a friend is working on

Device is not straight, so its harder to get the connections right. Besides that, the lines are below the device. Click line and select bring to front.

GNS3 Testing with Mikrotik

All my Mikrotiks are running production, so i need a virtual environment

sudo add-apt-repository ppa:gns3/ppa
sudo apt update                                
sudo apt install gns3-gui gns3-server

git clone https://github.com/GNS3/ubridge.git
cd ubridge
sudo apt-get install libpcap-dev
make 
sudo make install

reboot

nohup gns3server &
gns3

edit > preferences 
qemu 
qemu vms
New and select chr-6.48.6.img

New project > select vm

NOTES

ping not working? use even number interfaces (8)

garbled output? .. Answer (Y/N) with N when starting telnet. Or turn off and on again. 

How many vlan’s are enough?

Many years ago i started segmenting my network using vlans.

In 2022 i started to reconfigure my lab and using a lot more Mikrotik switches.
So how many … is to many, because i always overdo stuff.

Well .. is 9 to many for home environments?

  • default vlan – did’t bother to configure
  • old DMZ .. to be migrated
  • DMZ – my servers live here
  • Wifi personal workstations – Mobiles and laptops .. macaddress limited
  • IOT – only arduino’s, raspberries and other hardware live here
  • Personal workstations – UTP connected workstations with less networking limitations
  • LAB – My lab environment, Ovirt virtualisation for fun and manage access to servers in dmz
  • Storage – my SFP enabled all-flash storage
  • Management – really tight restricted access to management interfaces (switches/routers/storage/ILO)

Hard to manage? All those vlan’s? .. Sure, but i learn a lot!
(Not really .. when you got the basics down, more of the same.
Hardest part? .. not cutting-off connections/switchports you are using!)

Mikrotik Mqtt

Today Vincent mentioned a link about mqtt and mikrotiks, i knew about addons, but not mqtt .. lets try this.

When you want to use MQTT with Mikrotik you have to install the iot package from extra_packages.

  • Download correct package zip from ( https://mikrotik.com/download )
    • Download extra packages zip for your system
  • Extract and use file upload
  • Reboot your mikrotik

(i had to upgrade my firmware first, iot package was not build for my version)

Create a entry in IoT > Mqtt to your broker.

save below in a script ending with a .rsc extention, and upload in file manager

# Required packages: iot

################ Configuration #################
# Name of an existing MQTT broker that should be used for publishing, the one you just created
:local broker "10.1.0.17"

# MQTT topic where the message should be published
# i've got mine in a tree called mikrotik/switchtype/
:local topic "mikrotik/rb2011/topic"

############### System ###############
# You can create your own variables below
:put ("[*] Gathering system info...")
:local cpuLoad [/system resource get cpu-load]
:local freeMemory [/system resource get free-memory]
:local usedMemory ([/system resource get total-memory] - $freeMemory)
:local rosVersion [/system package get value-name=version \
    [/system package find where name ~ "^routeros"]]
:local model [/system routerboard get value-name=model]
:local serialNumber [/system routerboard get value-name=serial-number]
:local upTime [/system resource get uptime]

################## MQTT ###################
# create a message
:local message \
    "{\"model\":\"$model\",\
                \"sn\":\"$serialNumber\",\
                \"ros\":\"$rosVersion\",\
                \"cpu\":$cpuLoad,\
                \"umem\":$usedMemory,\
                \"fmem\":$freeMemory,\
                \"uptime\":\"$upTime\"}"

:log info "$message";
:put ("[*] Total message size: $[:len $message] bytes")
:put ("[*] Sending message to MQTT broker...")
/iot mqtt publish broker=$broker topic=$topic message=$message
:put ("[*] Done")

Import script using

import mikrotikmqtt.rsc

Todo’s:

Import is just @ import time, need to “cron” this?

Mikrotik

Switches and access-points

Today i got my RB4011 ! Wooot!

Total tally

  • MikroTik CRS305-1G-4S+IN – Lab
  • MikroTik RB2011UiAS-RM – Office
  • MikroTik hAP AC2 – Studio
  • MikroTik CRS109-8G-1S-2HnD-IN – Attic
  • MikroTik RB4011iGS+5HacQ2HnD-IN – Livingroom
  • NEW (2022-04-02) crs125-24g-1s-in (2022-04-02)

To replace .. 4 SLM2008 and a TPLink switch 🙂

How much fun is this! .. A display on a switch!

I’ll be posting something about connecting an arduino to the serial console using a tcp server later.

Mikrotiks are all you can eat .. And there is a lot of functionality. One of the main features (besides being switches and routers)

  • Openvpn server
  • DIY display connect
  • Proxy
  • Today Vincent mentioned Mqtt plugin (2022-apr-6)
  • https://help.mikrotik.com/docs/display/ROS/Packet+Sniffer sounds interesting also

Installing extra packages

  • Download correct package zip from ( https://mikrotik.com/download )
  • Extract and use file upload
  • Reboot your mikrotik

Mikrotik Guest Network

I’ve got several AccessPoints in my network.
Using a roaming setup, clients can connect to strongest AP.

For our Folkband i’ve setup same.
With the exception of those clients only being able to connect to the Internet, and not the rest of my Network

  • Virtual Access Point
  • Own subnet
  • dhcp server only for this access point
  • NAT and Firewall rules for access limitation
/interface bridge 
add name=bridgeguest
/interface wireless security-profiles 
add authentication-types=wpa2-psk eap-methods="" management-protection=allowed mode=dynamic-keys name=guest supplicant-identity=MikroTikHAP wpa2-pre-shared-key=guestkey
/interface wireless
add disabled=no mac-address=MACADDRESS master-interface=wlan1 name=guest security-profile=guest ssid=guest station-roaming=enabled wds-default-bridge=bridge wps-mode=disabled
/ip pool
add name=guest ranges=10.5.0.2-10.5.0.250
/ip dhcp-server
add address-pool=guest disabled=no interface=bridgeguest name=dhcpserverguest
/interface bridge port
add bridge=bridgenb interface=guest
/ip address
add address=10.1.0.5/24 comment=defconf interface=ether2 network=10.1.0.0
add address=10.5.0.1/24 interface=bridgeguest network=10.5.0.0
/ip dhcp-client
/ip dhcp-server network
add address=10.5.0.0/24 dns-server=1.1.1.1 gateway=10.5.0.1
/ip dns static
add address=10.1.0.5 name=router.lan type=A
/ip firewall filter
add action=drop chain=input dst-address=10.1.0.5 dst-port=22,80,443,8291,21,23 protocol=tcp src-address=10.5.0.1-10.5.0.254
add action=drop chain=input dst-address=MYNETWORKSHERE/16 src-address=10.5.0.2-10.5.0.250
add action=drop chain=forward dst-address=MYNETWORKSHERE/16 src-address=10.5.0.2-10.5.0.250
add action=drop chain=forward dst-address=MYNETWORKSHERE/16 src-address=10.5.0.2-10.5.0.250
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
add action=accept chain=srcnat src-address=10.5.0.0/24