Manual:Packet Flow: Difference between revisions

From MikroTik Wiki
Jump to navigation Jump to search
← Older editNewer edit →
No edit summary
Line 28: Line 28:
===Basic Concepts===
===Basic Concepts===


[[Image:Input_interface.jpg|Input Interface|100px]] - starting point in packets way thought the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.
[[Image:Input_interface.jpg|Input Interface|100px]] - starting point in packets way throught the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.


[[Image:output_interface.jpg|Output Interface|100px]] - last point in packets way thought the router facilities. Just before the packet is actually sent out.
[[Image:output_interface.jpg|Output Interface|100px]] - last point in packets way throught the router facilities. Just before the packet is actually sent out.


[[Image:local_process-_in.jpg|Local Process IN|100px]] - last point in packets way '''to''' router itself, after this packet is discarded
[[Image:local_process-_in.jpg|Local Process IN|100px]] - last point in packets way '''to''' router itself, after this packet is discarded
Line 64: Line 64:
[[Image:accounting.jpg|Accounting|100px]] - '''/ip accounting'''
[[Image:accounting.jpg|Accounting|100px]] - '''/ip accounting'''


[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]] - '''/interface bridge settings''' - available only for traffic that go '''thought''' the bridge. For all other traffic default value is '''Yes'''
[[Image:use_ip_firewall.jpg|Use IP Firewall|100px]] - '''/interface bridge settings''' - available only for traffic that go '''throught''' the bridge. For all other traffic default value is '''Yes'''


[[Image:bridge_input.jpg|Bridge Input|100px]]
[[Image:bridge_input.jpg|Bridge Input|100px]]
Line 79: Line 79:
[[Image:hotspot_in.jpg|Hotspot In|100px]] - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess
[[Image:hotspot_in.jpg|Hotspot In|100px]] - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess


[[Image:Bridge Desicion.jpg|Bridge Decision|100px]] - bridge goes thought the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports
[[Image:Bridge Desicion.jpg|Bridge Decision|100px]] - bridge goes throught the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports


[[Image:bridge_decision.jpg|Bridge Decision|100px]] - this is a workaround, allows to use "out-bridge-port" before actual bridge decision.
[[Image:bridge_decision.jpg|Bridge Decision|100px]] - this is a workaround, allows to use "out-bridge-port" before actual bridge decision.


[[Image:routing_decision.JPG|Routing Decision|100px]] - router goes thought the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.
[[Image:routing_decision.JPG|Routing Decision|100px]] - router goes throught the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.


[[Image:routing_adjustment.jpg|Routing Adjustment|100px]] - this is a workaround that allows to set-up policy routing in mangle chain output
[[Image:routing_adjustment.jpg|Routing Adjustment|100px]] - this is a workaround that allows to set-up policy routing in mangle chain output

Revision as of 14:04, 6 October 2009

MikroTik RouterOS is designed to be easy to operate in various aspects of network configuration. Therefore creating limitation for individual IP or natting internal clients to a public address or Hotspot configuration can be done without the knowledge about how the packets are processed in the router - you just go to corresponding menu and create necessary configuration.

However more complicated tasks, such as traffic prioritization, routing policies, where it is necessary to utilize more than one RouterOS facility, requires knowledge: How these facilities work together? What happens when and why?

To address these questions we created a packet flow diagram.

Diagram

As it was impossible to get everything in one diagram, Packet flow diagram for Mikrotik RouterOS v3.x was created in 2 parts:

  • Bridging or Layer-2 (MAC) where Routing part is simplified to one "Layer-3" box
  • Routing or Layer-3 (IP) where Bridging part is simplified to one "Bridging" box

The packet flow diagram is also available as a PDF.

Packet Flow in Layer-2



Packet Flow in Layer-3



Analysis

Basic Concepts

Input Interface - starting point in packets way throught the router facilities. It does not matter what interface (physical or virtual) packet is received it will start its way from here.

Output Interface - last point in packets way throught the router facilities. Just before the packet is actually sent out.

Local Process IN - last point in packets way to router itself, after this packet is discarded

Local Process OUT - starting point for packets generated by router itself

Configurable Facilities

Each and every facilities in this section corresponds with one particular menu in RouterOS. Users are able to access those menu and configure these facilities directly


Connection Tracking - /ip firewall connection tracking

Filter Input Filter Forward Filter Output - /ip firewall filter

Source NAT Destination NAT - /ip firewall nat

Mangle Prerouting Mangle Input Mangle Forward Mangle Output Mangle Postrouting - /ip firewall mangle

Global-in HTB Global-Out HTB Interface HTB - /queue simple and /queue tree

IPSec_Policy - /ip ipsec policy

Accounting - /ip accounting

Use IP Firewall - /interface bridge settings - available only for traffic that go throught the bridge. For all other traffic default value is Yes

Bridge Input Bridge Forward Bridge Output - /interface bridge filter

Bridge Destination NAT Bridge Source NAT - /interface bridge nat

Automated processes and decisions

In-interface Bridge - check if the actual input interface is a port for bridge OR checks if input interface is bridge

Hotspot In - allow to capture traffic witch otherwise would be discarded by connection tracking - this way our Hotspot feature are able to provide connectivity even if networks settings are in complete mess

Bridge Decision - bridge goes throught the MAC address table in order to find a match to destination MAC address of packet. When match is found - packet will be send out via corresponding bridge port. In case of no match - multiple copies of packet will be created and packet will be sent out via all bridge ports

Bridge Decision - this is a workaround, allows to use "out-bridge-port" before actual bridge decision.

Routing Decision - router goes throught the route n order to find a match to destination IP address of packet. When match is found - packet will be send out via corresponding port or to the router itself . In case of no match - packet will be discarded.

Routing Adjustment - this is a workaround that allows to set-up policy routing in mangle chain output

TTL Adjustment - indicates exact place where Time To Live (TTL) of the routed packet is reduced by 1. If it become 0 packet will be discarded

IPSec_Decryption IPSec_Encryption - self explainatory

Out-interface Bridge - check if the actual output interface is a port for bridge OR checks if output interface is bridge

Hotspot Out - undo all that was done by hotspot-in for the packets that is going back to client.

Examples

Bridging with use-ip-firewall=yes

Packet Flow Example 1


Routing - from Ethernet to Ethernet interface

Packet Flow Example 2

Routing from one Bridge interface to different Bridge interface

Packet Flow Example 3 Packet Flow Example 3

IPsec encryption

Packet Flow Example 4

IPsec decryption

Packet Flow Example 5

Retrieved from "https://wiki.mikrotik.com/index.php?title=Manual:Packet_Flow&oldid=13634"