Manual:Packet Flow: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
← Older edit
No edit summary
 
(11 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{Versions|v3, v4, v5+}}
{{Versions| v6.0+}}


==Overview==
==Overview==


MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or natting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.
MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or NATting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.


However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?  
However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?  
Line 9: Line 9:
To address these questions we created a packet flow diagram.
To address these questions we created a packet flow diagram.


==Diagram==
==Diagrams==


As it was impossible to get everything in one diagram, '''Packet flow diagram''' for Mikrotik RouterOS v3.x was created in 2 parts:  
For MikroTik RouterOS v6.0 was created detailed diagrams to ease understanding of packet flow.
* '''Bridging or Layer-2 (MAC)''' where Routing part is simplified to one "Layer-3" box
===Overall Packetflow Diagram===
* '''Routing or Layer-3 (IP)''' where Bridging part is simplified to one  "Bridging" box
[[Image:PacketFlowDiagram_v6_a.svg|Packet Flow Diagram|center]]
===Bridging Diagram===
{| class="wikitable"
|-
|[[Image:Bridging-Diagram.jpg|450px|Bridging Diagram|center]]
|In this subsection you can inspect how packet are going through the bridge. For example, if you configure <code>/interface bridge settings set use-ip-firewall=yes</code>, then packet will go through the one of three predefined ip firewall chains: prerouting, forward, postrouting.
|}
===MPLS Diagram===
{| class="wikitable"
|-
|Packet-forwarding decisions are made solely on the contents of this label, without the need to examine the packet itself. Diagram describe [https://wiki.mikrotik.com/wiki/Manual:MPLS MPLS] label movement in RouterOS.
|[[Image:Mpls Diagram.jpg|600px|MPLS Diagram|center]]
|}
===Routing Diagram===
{| class="wikitable"
|-
|[[Image:Routing Diagram.jpg|450px|Routing Diagram|center]]
|Each routing protocol (except BGP) has it's own internal tables. This is where per-protocol routing decisions are made. BGP does not have internal routing tables and stores complete routing information from all peers in the [https://wiki.mikrotik.com/wiki/Manual:IP/Route#Routing_Information_Base RIB]. RIB contains routes grouped in separate routing tables based on their value of routing-mark. All routes without routing-mark are kept in the main routing table. These tables are used for best route selection. The main table is also used for nexthop lookup.
|}


The packet flow diagram is also available [http://wiki.mikrotik.com/images/1/1b/Traffic_Flow_Diagram_RouterOS_3.x.pdf as a PDF].  
====Packet Flow Chains====
 
This diagram explains in detail each section of the Overall Packetflow Diagram.
[[Image:Bridge_final.png|Packet Flow in Layer-2|700px]]
 
[[Image:Pfd.png|Packet Flow Chains|840px|center]]
 
==Diagram Analaysis==
 
 
[[Image:IP_final.png|Packet Flow in Layer-3|700px]]


===Basic Concepts===


{| class="wikitable"
|-
! Image
! Explanation


|-
|[[Image:Physical_in_interface.png|Input Interface|100px]]
|Starting point in packets way through the router facilities. Packet is received it will start its way from here.


|-
|[[Image:Physical_out_interface.png|Output Interface|100px]]
|Last point in packets way through the router facilities. Just before the packet is actually sent out.


==Analysis==
|-
|[[Image:Logical_in_interface.png|Input Interface|100px]]
|Intermediate interface where packet continues to process through the device after decapsulation


===Basic Concepts===
|-
|[[Image:Logical_out_interface.png |Output Interface|100px]]
|Intermediate interface where packet continue to process through the device before encapsulation


[[Image:Input_interface.jpg|Input Interface|100px]] - starting point in packets way through the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.
|-
|[[Image:local_process-_in.jpg|Local Process IN|100px]]
|Last point in packets way <b>to</b> router itself, after this packet is discarded


[[Image:output_interface.jpg|Output Interface|100px]] - last point in packets way through the router facilities. Just before the packet is actually sent out.
|-
 
|[[Image:local_process-_out.jpg|Local Process OUT|100px]]
[[Image:local_process-_in.jpg|Local Process IN|100px]] - last point in packets way '''to''' router itself, after this packet is discarded
|Starting point for packets generated by router itself
 
|}
[[Image:local_process-_out.jpg|Local Process OUT|100px]] - starting point for packets generated by router itself


===Configurable Facilities===
===Configurable Facilities===
Line 44: Line 75:
Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly
Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly


 
{| class="wikitable"
[[Image:connection_tracking.jpg|Connection Tracking|100px]] - '''/ip firewall connection tracking'''
|-
 
! Image
[[Image:Filter_input.jpg|Filter Input|100px]]
! RouterOS CLI
[[Image:Filter_forward.jpg|Filter Forward|100px]]
|-
[[Image:Filter_output.jpg|Filter Output|100px]] - '''/ip firewall filter'''
| [[Image:connection_tracking.jpg|Connection Tracking|100px]]
 
| <code>/ip firewall connection tracking</code>               
[[Image:src_nat.jpg|Source NAT|100px]]
|-
[[Image:dst_nat.jpg|Destination NAT|100px]] - '''/ip firewall nat'''
| [[Image:Filter_input.jpg|Filter Input|100px]]
 
| <code>/ip firewall filter</code>
[[Image:mangle_prerouting.jpg|Mangle Prerouting|100px]]
|-
[[Image:mangle_input.jpg|Mangle Input|100px]]
| [[Image:Filter_forward.jpg|Filter Forward|100px]]
[[Image:mangle_forward.jpg|Mangle Forward|100px]]
| <code>/ip firewall filter</code>
[[Image:mangle_output.jpg|Mangle Output|100px]]
|-
[[Image:mangle_postrouting.jpg|Mangle Postrouting|100px]] - '''/ip firewall mangle'''
| [[Image:Filter_output.jpg|Filter Output|100px]]
 
| <code>/ip firewall filter</code>
[[Image:global_in.jpg|Global-in HTB|100px]]
|-
[[Image:global_out.jpg|Global-Out HTB|100px]]
| [[Image:src_nat.jpg|Source NAT|100px]]
[[Image:Interface HTB.jpg|Interface HTB|100px]]  - '''/queue simple''' and '''/queue tree'''
| <code>/ip firewall nat</code>
 
|-
[[Image:IPsec_policy.jpg|IPSec_Policy|100px]] - '''/ip ipsec policy'''
| [[Image:dst_nat.jpg|Destination NAT|100px]]
 
| <code>/ip firewall nat</code>
[[Image:accounting.jpg|Accounting|100px]] - '''/ip accounting'''
|-
 
|[[Image:mangle_prerouting.jpg|Mangle Prerouting|100px]]
[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]] - '''/interface bridge settings''' - available only for traffic that go '''through''' the bridge. For all other traffic default value is '''Yes'''
|<code>/ip firewall mangle</code>
 
|-
[[Image:bridge_input.jpg|Bridge Input|100px]]
|[[Image:mangle_input.jpg|Mangle Input|100px]]
[[Image:Bridge_forward.jpg|Bridge Forward|100px]]
|<code>/ip firewall mangle</code>
[[Image:Bridge_output.jpg|Bridge Output|100px]] - '''/interface bridge filter'''
|-
 
|[[Image:mangle_forward.jpg|Mangle Forward|100px]]
[[Image:Bridge_dst_nat.jpg|Bridge Destination NAT|100px]]
|<code>/ip firewall mangle</code>
[[Image:Bridge_src_nat.jpg|Bridge Source NAT|100px]] - '''/interface bridge nat'''
|-
|[[Image:mangle_output.jpg|Mangle Output|100px]]
|<code>/ip firewall mangle</code>
|-
|[[Image:mangle_postrouting.jpg|Mangle Postrouting|100px]]
|<code>/ip firewall mangle</code>
|-
|[[Image:global_in.jpg|Global-in HTB|100px]]
|  <code>/queue simple</code> and <code>/queue tree</code>
|-
| [[Image:global_out.jpg|Global-Out HTB|100px]]
|  <code>/queue simple</code> and <code>/queue tree</code>
|-
| [[Image:Interface HTB.jpg|Interface HTB|100px]]
| <code>/queue simple</code> and <code>/queue tree</code>
|-
| [[Image:IPsec_policy.jpg|IPSec_Policy|100px]]
| <code>/ip ipsec policy</code>
|-
| [[Image:accounting.jpg|Accounting|100px]]
| <code>/ip accounting</code>
|-
|[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]]
|<code>/interface bridge settings</code>
|-
|[[Image:bridge_input.jpg|Bridge Input|100px]]
|<code>/interface bridge filter</code>
|-
|[[Image:Bridge_forward.jpg|Bridge Forward|100px]]
|<code>/interface bridge filter</code>
|-
|[[Image:Bridge_output.jpg|Bridge Output|100px]]
|<code>/interface bridge filter</code>
|-
|[[Image:Bridge_dst_nat.jpg|Bridge Destination NAT|100px]]
|<code>/interface bridge nat</code>
|-
|[[Image:Bridge_src_nat.jpg|Bridge Source NAT|100px]]
|<code>/interface bridge nat</code>
|}


===Automated processes and decisions ===
===Automated processes and decisions ===


[[Image:In-interface-bridge.jpg|In-interface Bridge|100px]] - check if the ''actual input interface'' is a port for bridge OR  checks if ''input interface'' is bridge
{| class="wikitable"
 
|-
[[Image:hotspot_in.jpg|Hotspot In|100px]] - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess
!Image
 
!Description
[[Image:Bridge Desicion.jpg|Bridge Decision|100px]] - bridge goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports
|-
 
|[[Image:In-interface-bridge.jpg|In-interface Bridge|100px]]
[[Image:bridge_decision.jpg|Bridge Decision|100px]] - this is a workaround, allows to use "out-bridge-port" before actual bridge decision.
|Check if the ''actual input interface'' is a port for bridge OR  checks if ''input interface'' is bridge
 
|-
[[Image:routing_decision.JPG|Routing Decision|100px]] - router goes through the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.
|[[Image:HOTSPOT_in.png|Hotspot In|100px]]
 
|Allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess
[[Image:routing_adjustment.jpg|Routing Adjustment|100px]] - this is a workaround that allows to set-up policy routing in mangle chain output
|-
 
|[[Image:Bridge Desicion.jpg|Bridge Decision|100px]]
[[Image:TTL=TTL-1.jpg|TTL Adjustment|100px]] - indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded
|Bridge goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports
 
|-
[[Image:IPSec_Decryption.jpg|IPSec_Decryption|100px]] [[Image:IPSec_Encryption.jpg|IPSec_Encryption|100px]] - self explainatory
|[[Image:bridge_decision.jpg|Bridge Decision|100px]]
 
|This is a workaround, allows to use "out-bridge-port" before actual bridge decision.
[[Image:out_interface_bridge.jpg|Out-interface Bridge|100px]] - check if the ''actual output interface'' is a port for bridge OR  checks if ''output interface'' is bridge
|-
 
|[[Image:routing_decision.JPG|Routing Decision|100px]]
[[Image:Hotspot_out.jpg|Hotspot Out|100px]] - undo all that was done by hotspot-in for the packets that is going back to client.
|Router goes through the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.
|-
|[[Image:routing_adjustment.jpg|Routing Adjustment|100px]]
|This is a workaround that allows to set-up policy routing in mangle chain output
|-
|[[Image:TTL.png|TTL Adjustment|100px]]
|Indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded
|-
|[[Image:IPSEC_decryption.png|IPSec_Decryption|100px]]
|Self explanatory
|-
|[[Image:IPSEC_encryption.png|IPSec_Encryption|100px]]
|Self explanatory
|-
|[[Image:out_interface_bridge.jpg|Out-interface Bridge|100px]]
|Check if the ''actual output interface'' is a port for bridge OR  checks if ''output interface'' is bridge
|-
|[[Image:Hotspot_out2.png|Hotspot Out|100px]]
|Undo all that was done by hotspot-in for the packets that is going back to client.
|}


==Examples==
==Examples==


===Bridging with use-ip-firewall=yes===
In this subsection you can overview different protocol packet processing in RouterOS.
 
[[Image:Packet_Flow_Example_1.png|Packet Flow Example 1|700px]]
 
 
===Routing - from Ethernet to Ethernet interface===
 
[[Image:Packet_Flow_Example_2c.png|Packet Flow Example 2|700px]]
 
===Routing from one Bridge interface to different Bridge interface===
 
[[Image:Packet_Flow_Example_3_1.png|Packet Flow Example 3|700px]]
[[Image:Packet_Flow_Example_3_2c.png|Packet Flow Example 3|700px]]
 
===IPsec encryption===
 
[[Image:Packet_Flow_Example_4c.png|Packet Flow Example 4|700px]]
 
===IPsec decryption===
 
[[Image:Packet_Flow_Example_5c.png|Packet Flow Example 5|700px]]
 


[[Category:Manual|P]]
===Bridge port in with PPPoE-out===
[[Category:IP|P]]
[[File:Packetflow6-a.png|Example 1|800px|center]]
[[Category:QoS|P]]
===PPPoE-in with bridge port out===
[[Category:Case Studies|P]]
[[File:Packetflow6-b.png|Example 2|800px|center]]
===Vlan Untagging/Tagging in the bridge interface===
[[File:Packetflow6-c.png|Example 3|800px|center]]
===EoIP with VPLS out===
[[File:Packetflow6-d.png|Example 4|800px|center]]
===IPsec Encryption/Decryption===
[https://wiki.mikrotik.com/wiki/Manual:IP/IPsec Internet Protocol Security (IPsec)] is a set of protocols defined by the Internet Engineering Task Force (IETF) to secure packet exchange over unprotected IP/IPv6 networks such as Internet.
[[Image:IpsecFlow.png|Example 5|center]]

Latest revision as of 12:30, 8 January 2019

Applies to RouterOS: v6.0+

Overview

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or NATting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?

To address these questions we created a packet flow diagram.

Diagrams

For MikroTik RouterOS v6.0 was created detailed diagrams to ease understanding of packet flow.

Overall Packetflow Diagram

Packet Flow Diagram
Packet Flow Diagram

Bridging Diagram

Bridging Diagram
Bridging Diagram
 In this subsection you can inspect how packet are going through the bridge. For example, if you configure /interface bridge settings set use-ip-firewall=yes, then packet will go through the one of three predefined ip firewall chains: prerouting, forward, postrouting.

MPLS Diagram

Packet-forwarding decisions are made solely on the contents of this label, without the need to examine the packet itself. Diagram describe MPLS label movement in RouterOS.
MPLS Diagram
MPLS Diagram

Routing Diagram

Routing Diagram
Routing Diagram
 Each routing protocol (except BGP) has it's own internal tables. This is where per-protocol routing decisions are made. BGP does not have internal routing tables and stores complete routing information from all peers in the RIB. RIB contains routes grouped in separate routing tables based on their value of routing-mark. All routes without routing-mark are kept in the main routing table. These tables are used for best route selection. The main table is also used for nexthop lookup.

Packet Flow Chains

This diagram explains in detail each section of the Overall Packetflow Diagram.

Packet Flow Chains
Packet Flow Chains

Diagram Analaysis

Basic Concepts

Image Explanation
Input Interface Starting point in packets way through the router facilities. Packet is received it will start its way from here.
Output Interface Last point in packets way through the router facilities. Just before the packet is actually sent out.
Input Interface Intermediate interface where packet continues to process through the device after decapsulation
Output Interface Intermediate interface where packet continue to process through the device before encapsulation
Local Process IN Last point in packets way to router itself, after this packet is discarded
Local Process OUT Starting point for packets generated by router itself

Configurable Facilities

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly

Image RouterOS CLI
Connection Tracking /ip firewall connection tracking
Filter Input /ip firewall filter
Filter Forward /ip firewall filter
Filter Output /ip firewall filter
Source NAT /ip firewall nat
Destination NAT /ip firewall nat
Mangle Prerouting /ip firewall mangle
Mangle Input /ip firewall mangle
Mangle Forward /ip firewall mangle
Mangle Output /ip firewall mangle
Mangle Postrouting /ip firewall mangle
Global-in HTB /queue simple and /queue tree
Global-Out HTB /queue simple and /queue tree
Interface HTB /queue simple and /queue tree
IPSec_Policy /ip ipsec policy
Accounting /ip accounting
Use IP Firewall /interface bridge settings
Bridge Input /interface bridge filter
Bridge Forward /interface bridge filter
Bridge Output /interface bridge filter
Bridge Destination NAT /interface bridge nat
Bridge Source NAT /interface bridge nat

Automated processes and decisions

Image Description
In-interface Bridge Check if the actual input interface is a port for bridge OR checks if input interface is bridge
Hotspot In Allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess
Bridge Decision Bridge goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports
Bridge Decision This is a workaround, allows to use "out-bridge-port" before actual bridge decision.
Routing Decision Router goes through the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.
Routing Adjustment This is a workaround that allows to set-up policy routing in mangle chain output
TTL Adjustment Indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded
IPSec_Decryption Self explanatory
IPSec_Encryption Self explanatory
Out-interface Bridge Check if the actual output interface is a port for bridge OR checks if output interface is bridge
Hotspot Out Undo all that was done by hotspot-in for the packets that is going back to client.

Examples

In this subsection you can overview different protocol packet processing in RouterOS.

Bridge port in with PPPoE-out

Example 1
Example 1

PPPoE-in with bridge port out

Example 2
Example 2

Vlan Untagging/Tagging in the bridge interface

Example 3
Example 3

EoIP with VPLS out

Example 4
Example 4

IPsec Encryption/Decryption

Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to secure packet exchange over unprotected IP/IPv6 networks such as Internet.

Example 5
Example 5
Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:Packet_Flow&oldid=32623"