Mikrotik How To

The purpose of this script is to provide a solution for loss of service from ISP providers. The idea is for a topology where there are two different ISP providers, one of them provides a static IP and the other provides a dynamic IP address.

It is important to clarify that DNS should be usable from either ISP connection. This is because each ISP has its own DNS service. If a connection is lost it is likely that ISP 2 will not be able to connect to the DNS at ISP 1 and DNS requests will not be allowed to be resolved. The solution to this is to use a public DNS service such as OpenDNS.

/tool netwatch
add comment=Test1 disabled=no down-script="/tool netwatch set [find comment=\"Test2\"] disabl\
ed=no\r\
\n/tool netwatch set [find comment=\"Test1\"] disabled=yes" host=74.125.47.104 interval=\
30s timeout=2s up-script=""
add comment=Test2 disabled=yes down-script=":global GA\r\
\n:global GA [/ip dhcp-client get \"ether2 Fibertel\" gateway ]\r\
\n/ip route set [find comment=\"Fibertel\"] gateway=\$GA\r\
\n/ip route set [find comment=\"Telefonica\"] disabled=yes\r\
\n/ip route set [find comment=\"Fibertel\"] disabled=no\r\
\n/tool e-mail send to=\"EMAIL ADDRESS\" body=\"Connection with Telefonica Lost\
, Switched to Fibertel\" subject=\"Lost connection with Telefonica\"\r\
\n/tool netwatch set [find comment=\"Test3\"] disabled=no\r\
\n/tool netwatch set [find comment=\"Test2\"] disabled=yes" host=209.191.93.52 interval=\
30s timeout=2s up-script=":delay 10ms\r\
\n:log warning \"Started Test2\"\r\
\n/tool netwatch set [find comment=\"Test1\"] disabled=no\r\
\n/tool netwatch set [find comment=\"Test2\"] disabled=yes"
add comment=Test3 disabled=yes down-script="/tool netwatch set [find comment=\"Test4\"] disab\
led=no\r\
\n/tool netwatch set [find comment=\"Test3\"] disabled=yes" host=64.233.169.104 \
interval=30s timeout=2s up-script=""
add comment=Test4 disabled=yes down-script="/ip route set [find comment=\"Fibertel\"] disable\
d=yes\r\
\n/ip route set [find comment=\"Telefonica\"] disabled=no\r\
\n/tool e-mail send to=\"EMAIL ADDRESS\" body=\"Telefonica Connection Lost and Fi\
bertel took over, Trying to restore Telefonica\" subject=\"Loss of service type 2\"\r\
\n/tool netwatch set [find comment=\"Test1\"] disabled=no\r\
\n/tool netwatch set [find comment=\"Test4\"] disabled=yes" host=209.191.93.55 interval=\
30s timeout=2s up-script=":delay 10ms\r\
\n:log warning \"Started Test4\"\r\
\n/tool netwatch set [find comment=\"Test3\"] disabled=no\r\
\n/tool netwatch set [find comment=\"Test4\"] disabled=yes"

How it works:
The solution is composed of 4 netwatch tests.

The first (test 1) checks www.google.com, if for some reason this address stops responding to pings then it enables test2 and test1 disables itself.

Test2 pings www.yahoo.com, if the result is UP it enables test1 and test2 disables itself. If the result is "DOWN", test2 looks for the address of the gateway of the ISP on a dynamic IP and configures that address as a static route, followed by disabling the static route of the ISP on a static IP and enabling the dynamic IP route previously mentioned. It then sends an alert e-mail and enables test3 (for the new dynamic ISP) and test2 disables itself.

Test 3 and test4 do the same thing as test1 and test2 respectively. Only in this case, test4 would release the dynamic ISP and re-enable the static ISP.

(http://wiki.mikrotik.com/wiki/Failover_via_Netwatch_III_%28English%29).

Mikrotik Layer 7 Firewall Setup - Layer 7 is the application layer of the OSi system model and allows the Mikrotik router to analyze each and every packet that enters your network, and decide what to do with it.


The first step is to get a script file with the list of the most common Layer 7 protocols. This can be obtained from the Mikrotik Wiki via the following link :

http://www.mikrotik.com/download/l7-protos.rsc

We can now copy this script file into the Mikrotik 'Files' list.

Once you have the script file copied into the 'Files' window we can now proceed to import it via the terminal.
To make sure the script file imported properly, head to the 'IP' -> 'Firewall' menu and go to the 'Layer 7 Protocol' tab. You should now have a list ofthe most common types of traffic found within a network.

We can now create a firewall rule to block any type of Layer 7 traffic we choose. Go to the 'Filter' tab and add a new Firewall rule. Leave the chain set to 'forward'.

In the ' Advanced' tab you may now choose the Layer 7 traffic type you would like to block/allow.

Once the Layer 7 traffic type has been selected, proceed to the 'Action' tab and define the action of your choice. Drop is the most common action to stop a certain type off traffic flowing through your network.

The RB493 has nine ethernet ports and three miniPCI slots, it also has a switch chip, so the ethernet ports 2-9 can be grouped together to make it act as a switch.

RB493 includes RouterOS - the operating system, which will turn this powerful system into a highly sophisticated router, firewall or bandwidth manager.

With nine Ethernet ports, and three miniPCI slots, this is our most versatile RouterBOARD model.

The RB493AH model includes the higher speed Atheros 680MHz CPU, more memory, and a Level5 license for more simultaneous tunnel interfaces and hotspot users.

Product specifications

Details
Product code	RB493AH
CPU speed	680MHz
RAM	128MB
Architecture	MIPS-BE
LAN ports	9
MiniPCI	3
Integrated Wireless	0
USB	0
Memory Cards	0
Power Jack	10-28V
802.3af support	No
PoE	10-28V
Voltage Monitor	No
Temperature range	-30C to +60C
RouterOS License	Level5

 (http://routerboard.com/RB493AH).