Manual:Packet Flow: Difference between revisions
Jump to navigation
Jump to search
| Line 157: | Line 157: | ||
|Check if the ''actual input interface'' is a port for bridge OR checks if ''input interface'' is bridge | |Check if the ''actual input interface'' is a port for bridge OR checks if ''input interface'' is bridge | ||
|- | |- | ||
|[[Image: | |[[Image:HOTSPOT_in.png|Hotspot In|100px]] | ||
|Allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess | |Allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess | ||
|- | |- | ||
| Line 172: | Line 172: | ||
|This is a workaround that allows to set-up policy routing in mangle chain output | |This is a workaround that allows to set-up policy routing in mangle chain output | ||
|- | |- | ||
|[[Image:TTL | |[[Image:TTL.png|TTL Adjustment|100px]] | ||
|Indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded | |Indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded | ||
|- | |- | ||
|[[Image: | |[[Image:IPSEC_decryption.png|IPSec_Decryption|100px]] | ||
|Self explanatory | |Self explanatory | ||
|- | |- | ||
|[[Image: | |[[Image:IPSEC_encryption.png|IPSec_Encryption|100px]] | ||
|Self explanatory | |Self explanatory | ||
|- | |- | ||
| Line 184: | Line 184: | ||
|Check if the ''actual output interface'' is a port for bridge OR checks if ''output interface'' is bridge | |Check if the ''actual output interface'' is a port for bridge OR checks if ''output interface'' is bridge | ||
|- | |- | ||
|[[Image: | |[[Image:Hotspot_out2.png|Hotspot Out|100px]] | ||
|Undo all that was done by hotspot-in for the packets that is going back to client. | |Undo all that was done by hotspot-in for the packets that is going back to client. | ||
|} | |} | ||
==Examples== | ==Examples== | ||
Latest revision as of 12:30, 8 January 2019
Applies to RouterOS: v6.0+
Overview
MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or NATting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.
However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?
To address these questions we created a packet flow diagram.
Diagrams
For MikroTik RouterOS v6.0 was created detailed diagrams to ease understanding of packet flow.
Overall Packetflow Diagram
Bridging Diagram
 |
In this subsection you can inspect how packet are going through the bridge. For example, if you configure /interface bridge settings set use-ip-firewall=yes, then packet will go through the one of three predefined ip firewall chains: prerouting, forward, postrouting.
|
MPLS Diagram
| Packet-forwarding decisions are made solely on the contents of this label, without the need to examine the packet itself. Diagram describe MPLS label movement in RouterOS. |  |
Routing Diagram
 |
Each routing protocol (except BGP) has it's own internal tables. This is where per-protocol routing decisions are made. BGP does not have internal routing tables and stores complete routing information from all peers in the RIB. RIB contains routes grouped in separate routing tables based on their value of routing-mark. All routes without routing-mark are kept in the main routing table. These tables are used for best route selection. The main table is also used for nexthop lookup. |
Packet Flow Chains
This diagram explains in detail each section of the Overall Packetflow Diagram.
Diagram Analaysis
Basic Concepts
| Image | Explanation |
|---|---|
|
Starting point in packets way through the router facilities. Packet is received it will start its way from here. |
|
Last point in packets way through the router facilities. Just before the packet is actually sent out. |
|
Intermediate interface where packet continues to process through the device after decapsulation |
|
Intermediate interface where packet continue to process through the device before encapsulation |
|
Last point in packets way to router itself, after this packet is discarded |
|
Starting point for packets generated by router itself |
Configurable Facilities
Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly
| Image | RouterOS CLI |
|---|---|
|
/ip firewall connection tracking
|
|
/ip firewall filter
|
|
/ip firewall filter
|
|
/ip firewall filter
|
|
/ip firewall nat
|
|
/ip firewall nat
|
|
/ip firewall mangle
|
|
/ip firewall mangle
|
|
/ip firewall mangle
|
|
/ip firewall mangle
|
|
/ip firewall mangle
|
|
/queue simple and /queue tree
|
|
/queue simple and /queue tree
|
|
/queue simple and /queue tree
|
|
/ip ipsec policy
|
|
/ip accounting
|
|
/interface bridge settings
|
|
/interface bridge filter
|
|
/interface bridge filter
|
|
/interface bridge filter
|
|
/interface bridge nat
|
|
/interface bridge nat
|
Automated processes and decisions
| Image | Description |
|---|---|
|
Check if the actual input interface is a port for bridge OR checks if input interface is bridge |
|
Allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess |
|
Bridge goes through the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports |
|
This is a workaround, allows to use "out-bridge-port" before actual bridge decision. |
|
Router goes through the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded. |
|
This is a workaround that allows to set-up policy routing in mangle chain output |
|
Indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded |
|
Self explanatory |
|
Self explanatory |
|
Check if the actual output interface is a port for bridge OR checks if output interface is bridge |
|
Undo all that was done by hotspot-in for the packets that is going back to client. |
Examples
In this subsection you can overview different protocol packet processing in RouterOS.
Bridge port in with PPPoE-out
PPPoE-in with bridge port out
Vlan Untagging/Tagging in the bridge interface
EoIP with VPLS out
IPsec Encryption/Decryption
Internet Protocol Security (IPsec) is a set of protocols defined by the Internet Engineering Task Force (IETF) to secure packet exchange over unprotected IP/IPv6 networks such as Internet.
