Manual:Packet Flow: Difference between revisions
| Line 76: | Line 76: | ||
[[Image:hotspot_in.jpg|Hotspot In|100px]] - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess | [[Image:hotspot_in.jpg|Hotspot In|100px]] - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess | ||
[[Image:Bridge Desicion.jpg|Bridge Decision|100px]] | |||
| Line 94: | Line 98: | ||
[[Image:out_interface_bridge.jpg|Out-interface Bridge|100px]] - check if the ''actual output interface'' is a port for bridge OR checks if ''output interface'' is bridge | [[Image:out_interface_bridge.jpg|Out-interface Bridge|100px]] - check if the ''actual output interface'' is a port for bridge OR checks if ''output interface'' is bridge | ||
[[Image:Hotspot_out.jpg|Hotspot Out|100px]] | [[Image:Hotspot_out.jpg|Hotspot Out|100px]] - undo all that was done by hotspot-in for the packets that is going back to client. | ||
==Examples== | ==Examples== | ||
Revision as of 16:31, 27 November 2008
MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or natting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.
However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?
To address these questions we created a packet flow diagram.
Diagram
As it was impossible to get everything in one diagram, Packet flow diagram for Mikrotik RouterOS v3.x was created in 2 parts:
- Bridging or Layer-2 (MAC) where Routing part is simplified to one "Layer-3" box
- Routing or Layer-3 (IP) where Bridging part is simplified to one "Bridging" box
Analysis
Basic Concepts
- starting point in packets way thought the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.
- last point in packets way thought the router facilities. Just before the packet is actually sent out.
- last point in packets way to router itself, after this packet is discarded
- starting point for packets generated by router itself
Configurable Facilities
Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly
- /ip firewall connection tracking
- /ip firewall filter
- /ip firewall nat
- /ip firewall mangle
- /queue simple and /queue tree
- /ip ipsec policy
- /interface bridge settings
- /interface bridge filter
- /interface bridge nat
Automated processes and desicions
- check if the actual input interface is a port for bridge OR checks if input interface is bridge
- allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess
- check if the actual output interface is a port for bridge OR checks if output interface is bridge
- undo all that was done by hotspot-in for the packets that is going back to client.