MikroTik for Beginner

Random Order of Firewall Rule

2012-08-06T02:46:00.001+07:00

Have ever find this condition? Rules you set in firewall has changed its order in all tabs like rules, NAT, Mangle in /ip/fi. I ever face this situation, and my solution are below:

- In your winbox application please click sign "#" at very left column. This action will re-sort your rule based on its number as you created and arranged them.
- If you plan to close your winbox, please close every window of your winbox tasks, for instance: close window mikrotik firewall by clicking "X" sign in very top right window then you can close your winbox application.
That's all my private solution, if you find another please keep share with me

I use webproxy but why my connection becomes slower and not responsive?

2012-08-05T10:05:00.002+07:00

This often happens, we mean to use a web proxy to make browsing so much faster because of content that had previously accessed does not need to be taken again from the internet. But, in fact the connection is even be slower and not responsive. So often arise a question to myself "why even slow if I use webproxy". You know, where lies the fault?
The answer in my experience is a masquerade NAT is more than one. First check the topology of the web proxy in your network, if aligned with the client use a proxy address list. Configuration such as this

/ip fi address-list ad address=(ip-proxy-anda) list=proxy
/ip fi nat ad chain=dstnat in-interface=(ethernet-LAN) to-address=(ip-proxy-anda) to-port=3128 src-address-list=!proxy comment="redirect-proxy"

The next step will disable all NAT masquerade except to the public interface (internet) and NAT with the comment "redirect-proxy"
Then position the masquerade NAT public interface is at the top.
Then try browsing through the results with tests pc client. Hopefully success.

"Pake proxy malah lambat"

2012-08-05T09:58:00.002+07:00

Hal ini sering kali terjadi, maksud hati pakai web proxy supaya browsing lebih cepat karena content yang pernah diakses sebelumnya tidak perlu diambil lagi dari internet. Tapi, kenyataannya malah jadi lambat. sehingga seringkali muncul pertanyaan dalam hati "Pake proxy kok malah lambat". Tahukah Anda, di mana letak kesalahannya?

Jawabannya menurut pengalaman saya adalah NAT masquerade yang lebih dari satu. Cek dulu topologi web proxy yang ada dalam jaringan Anda, jika proxy sejajar dengan client pergunakan address list. Konfigurasinya seperti ini

/ip fi address-list ad address=(ip-proxy-anda) list=proxy
/ip fi nat ad chain=dstnat in-interface=(ethernet-LAN) to-address=(ip-proxy-anda) to-port=3128 src-address-list=!proxy comment="redirect-proxy"

Langkah selanjutnya disable semua NAT masquerade kecuali menuju interface publik (internet) dan NAT dengan comment "redirect-proxy"
Kemudian posisikan NAT masquerade interface publik berada pada posisi paling atas.
Lalu coba hasilnya dengan tes browsing lewat pc client. Mudah-mudahan sukses.

My Mistake #3: Forcing Hardware Capability

2012-08-05T04:51:00.002+07:00

As mentioned in my former article, forcing hardware capability can lead to improper performance of MikroTik router. Why? because the router forced to work in high task and router hardware could not answer the challenge. Sometimes I seemed "forget" about my router hardware when configure these aspect below:

1. Configuring so many filter rule in /ip/firewall/filter
2. Making so long list of mangle
3. Trying new internal web proxy configuration such as disk usage
4. Tracking every connection that flow in and out the router by ticking SyncCookie in /ip/con/tra
5. There are same name in making mangle like name of connection or packet
That's all my mistakes, what about you?

My Mistake #2: Using Inappropriate IP

2012-08-04T14:33:00.004+07:00

Sometimes occured in my hurry configuration. Using inappropriate IP I mean here is more related to bad subnetting. Never use any 255.0.0.0 subnet to your local because it will shorten IP broadcast and make your MikroTik router use high resources. Pay attention that different interface should be have different IP class.

My Mistake #1: Doing Double NAT

2012-08-04T14:32:00.004+07:00

Doing Double NAT. Please don't do this in your MikroTik router. It will make your internet connection more slower, because your router do same job twice for every connection.
Solutions are:

- Please do NAT only in your public or local interface. Don't masquerade both of them. the command is:

/ip firewall nat add chain=src-nat out-interface=(your-public-ethernet) action=masquerade

- Remove any automatic masquerade generated by hotspot configuration
- Only 1 NAT with masquerade action in firewall
- If you have more than one public interface to internet, do NAT for every output interface, do not NAT your local interface again or your IP class.

Some mistakes in my MikroTik configuration

2012-08-04T14:32:00.001+07:00

This post seemed like a confession, but I plan it for my future. Maybe readers can take benefit from my experience. Since December 2006 I used MikroTik as router for my cybercafe.
Learn everything from forum and then apply them and customize base on my need. I'm not an IT specialist, and never join any computer/network formal course. I intended to use MikroTik to administer my cybercafe. During my experience with MikroTik, there were so many mistakes I have done in my configuration. Here they are:

1. Doing double NAT (Network Address Translation)

2. Using inappropriate IP (Internet Protocol)
3. Forcing hardware capability
4. Refer to someone's configuration without fully understood about setting function
5. etc

Ok, dude. I will share my experience on next post :)