I had a customer ask for a very odd configuration.
\n![\"cust1\"](\"http:\/\/gregsowell.com\/wp-content\/uploads\/2016\/03\/cust1.png\")
\nOff of the ServerAP, Ether 2 must always hand out 192.168.88.10. The routers need to be a generic config so they can use them no matter what MAC address the server has.
\nThey also want the ClientAP to just bridge everything together so the remote special devices will pull DHCP from the server AP. Oh yeah…and they all have to be in the same “subnet” and accessible to each other. What to do, what to do…<\/p>\n
Well, this is what I did:
\n![\"cust2\"](\"http:\/\/gregsowell.com\/wp-content\/uploads\/2016\/03\/cust2.png\")
\nThe ServerAP has proxy-arp enabled for both Ether2 and WLAN1.
\nI then set Ether2 to IP 192.168.88.1\/28 and configured a DHCP server on it to only hand out 192.168.88.10. If you don’t add an interface with an IP, the DHCP won’t enable. I first thought about bridging Ether2 and WLAN1, but if you do this, you can only run a single DHCP server…which means we can’t set aside a special IP for the server. So by breaking the subnet up we can run multiple servers.<\/p>\n
Ether2 is configured for 192.168.88.19\/24 with a DHCP handing out 192.168.88.100-254.<\/p>\n
The ClientAPs then run in station bridge to allow them to connect wirelessly and bridge their ether interfaces over. Now wired clients can pull DHCP from the ServerAP.<\/p>\n
Here’s the configs:
\nServerAP:<\/p>\n
\/interface ethernet\r\nset [ find default-name=ether2 ] arp=proxy-arp\r\n\/interface wireless security-profiles\r\nset [ find default=yes ] supplicant-identity=MikroTik\r\nadd authentication-types=wpa2-psk eap-methods="" management-protection=\\\r\n allowed mode=dynamic-keys name=profile1 supplicant-identity="" \\\r\n wpa2-pre-shared-key=popcorn\r\n\/interface wireless\r\nset [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \\\r\n arp=proxy-arp band=2ghz-b\/g\/n disabled=no mode=ap-bridge \\\r\n security-profile=profile1 ssid=p48923\r\n\/ip pool\r\nadd name=dhcp_pool1 ranges=192.168.88.10\r\nadd name=dhcp_pool2 ranges=192.168.88.100-192.168.88.254\r\n\/ip dhcp-server\r\nadd address-pool=dhcp_pool1 disabled=no interface=ether2 lease-time=30s name=\\\r\n dhcp1\r\nadd address-pool=dhcp_pool2 disabled=no interface=wlan1 lease-time=10m30s \\\r\n name=dhcp2\r\n\/ip address\r\nadd address=192.168.88.1\/28 interface=ether2 network=192.168.88.0\r\nadd address=192.168.88.19\/24 interface=wlan1 network=192.168.88.0\r\n\/ip dhcp-client\r\nadd default-route-distance=0 dhcp-options=hostname,clientid disabled=no \\\r\n interface=ether1\r\n\/ip dhcp-server network\r\nadd address=192.168.88.0\/28 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.88.1\r\nadd address=192.168.88.0\/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.88.19\r\n\/ip firewall nat\r\nadd action=masquerade chain=srcnat out-interface=ether1\r\n\/ip service\r\nset telnet disabled=yes\r\nset ftp disabled=yes\r\nset www address=192.168.88.0\/24\r\nset ssh disabled=yes\r\nset api disabled=yes\r\nset api-ssl disabled=yes\r\n\/system identity\r\nset name=ServerAP<\/code><\/pre>\nClientAP:<\/p>\n
\/interface bridge\r\nadd name=bridge1\r\n\/interface wireless security-profiles\r\nset [ find default=yes ] supplicant-identity=MikroTik\r\nadd authentication-types=wpa2-psk eap-methods="" management-protection=\\\r\n allowed mode=dynamic-keys name=profile1 supplicant-identity="" \\\r\n wpa2-pre-shared-key=popcorn\r\n\/interface wireless\r\nset [ find default-name=wlan1 ] adaptive-noise-immunity=ap-and-client-mode \\\r\n band=2ghz-b\/g\/n disabled=no mode=station-bridge security-profile=profile1 \\\r\n ssid=p48923\r\n\/interface bridge port\r\nadd bridge=bridge1 interface=ether1\r\nadd bridge=bridge1 interface=ether2\r\nadd bridge=bridge1 interface=wlan1\r\n\/ip dhcp-client\r\nadd default-route-distance=0 dhcp-options=hostname,clientid interface=bridge1\r\n\/system identity\r\nset name=ClientAP<\/code><\/pre>\nAs odd as this config seems, it worked a treat. The real secret is that proxy-arp allows the devices on different subnets to communicate even though it seems as though they shouldn’t be able to.<\/p>\n
This is a weird one for sure. How would you guys have approached this? What would you have done different?<\/p>\n","protected":false},"excerpt":{"rendered":"
I had a customer ask for a very odd configuration. Off of the ServerAP, Ether 2 must always hand out 192.168.88.10. The routers need\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-5236","post","type-post","status-publish","format-standard","hentry","category-mikrotik"],"_links":{"self":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5236"}],"version-history":[{"count":3,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5236\/revisions"}],"predecessor-version":[{"id":5241,"href":"https:\/\/gregsowell.com\/index.php?rest_route=\/wp\/v2\/posts\/5236\/revisions\/5241"}],"wp:attachment":[{"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gregsowell.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}