View source for PBR PTP IPIP

''' Policy Base Routing on IPIP tunnel with PTP Addressing.'''
<br>
<br>
In this article you can know how to configure IPIP tunnel, PTP addressing at the end using Policy base Routing ([http://wiki.mikrotik.com/wiki/Policy_Base_Routing PBR])  on Tunnel [http://wiki.mikrotik.com/wiki/Manual:Interface/IPIP IPIP]).
<br>
<br>
'''Theory about ([http://wiki.mikrotik.com/wiki/Policy_Base_Routing PBR])
'''<br>
<br>
In computer networking, policy-based routing (PBR) is a technique used to make routing decisions based on policies set by the network administrator.<br>
When a router receives a packet it normally decides where to forward it based on the destination address in thepacket, which is then used to look up an entry in a routing table. However, in some cases, there may be a need to forward the packet based on other criteria. For example, a network administrator might want to forward a packet based on the source address, not the destination address. This should not be confused with source routing.<br>
Policy-based routing may also be based on the size of the packet, the protocol of the payload, or other information available in a packet header or payload. This permits routing of packets originating from different sources to different networks even when the destinations are the same and can be useful when interconnecting several private networks.<br>
In this Example I Want Shown how to configure '''IPIP Tunnel''' with '''PTP addressing''' and at the end using''' PBR''' to bypass filtered Sites form DCI.<br>
In my country some website are filtered by DCI so I used PBR to forward my Client's request to another MikroTik in other country.(for example USA)<br>
For This Reason I Want When Request Was For Facebook And YouTube Website an so,The Packets Goes through 
IPIP Tunnel And Other Normal Connection Goes through Country Internet Connection.
<br>
'''Diagram''':<br>
[[File:IPIP-PBR-PTP-Moghadam-Asghari.jpg]]
<br>
For this Scenario we need configure both side ip addresses, configure IPIP tunnel and at the end mark client's request to forward through IPIP Tunnel.<br>
'''Step one addressing'''
<br>
On the MikroTik 540G(filtered):
<br>
add ip address Code
<pre>
ip address add address=192.168.20.1/24 interface="Ether 2 LAN" disabled=no
ip address add address=46.1.1.1 interface="Ether 1 Public" disable=no
</pre>
<br>
On the MikroTik 540G Free Internet'''(no Filtered)''':
<br>
add ip address code:
<pre>
ip address add address=10.10.10.2/32 interface="Ether 1 Public" disable=no
</pre>
<br>
'''Step two Configure IPIP tunnel:'''
<br>
On the MikroTik 540G(filtered):
<br>
add IPIP Tunnel Code :
<pre>
interface ipip add name=IPIP local-address=46.1.1.1 remote-address=109.200.5.181 disabled=no
</pre>
<br>
On the MikroTik 540G Free Internet'''(no filtered):'''<br>
<br>
add IPIP Tunnel Code :
<pre>
interface ipip add name=IPIP local-address=109.200.5.181 remote-address=46.1.1.1 disabled=no
</pre>
<br>
[[File:IPIP-interface.jpg]]
<br>
'''Step three adds IP address for IPIP interfaces(PTP addressing):'''
<br>
On the MikroTik 540G(filtered):
<br>
add ip address Code:
<br>
<pre>
ip address add address=10.10.10.1 network=10.10.10.2 interface=ipip1 disabled=no
</pre>
<br>
On the MikroTik 540G Free Internet(no filtered):
<br>
add ip address code
<pre>
ip address add address=10.10.10.2 network=10.10.10.1 interface=ipip1 disabled=no
</pre>
<br>
[[File:P2P-addressing.jpg]]
<br>
'''Step four mark Client's Packet with firewall mangle mark Routing.'''
<br>
I have 2 clients so for best working I create one address list with name HASAN then put  clients IP address there.
<br>
add address list code :
<br>
<pre>
ip firewall address-list add address=192.168.20.55 list=HASAN
ip firewall address-list add address=192.168.20.54 list=HASAN
</pre>
<br>
I should select my Network for Using PBR to Visit Facebook and YouTube Websites. we can use Content Field (Facebook or YouTube String), Or Use Destination Address of Facebook of YouTube Website (Nslookup), Or You Route Every Connection Trough This Connection.
<br>
In this example I use destination address to mark packet so I create another address list then put destination address there.
<br>
add address list code
<br>
<pre>
ip firewall address-list add address=31.13.64.23 list=Sites
ip firewall address-list add address=74.125.143.136 list=Sites
</pre>
<br>
Then mark connection and set name IPIP PACKET we must select prerouting as chain.
<br>
[[File:Prerouting.jpg]]
<br>
then in the advanced menu select src , dst address list.(src address is client address and dst address is visited sites).
<br>
[[File:Prerouting-2.jpg]]
<br>
At the end select action then set name(mark routing)
<br>
[[File:Prerouting-3.jpg]]
<br>
mangle code :
<br>
<pre>
ip firewall mangle add chain=prerouting src-address-list=HASAN dst-address-list=Sites action=mark-routing new-routing-mark="IPIP PACKET"
</pre>
<br>
'''Step five – Static Route'''
<br>
In this Step we need add a static route for That Packets They Are Matched and Marked by Mangle and We Want Route Them to IPIP Connection.
<br>
[[File:Static-route-ipip.jpg]]
<br>
static route command:
<br>
<pre>
ip route add dst-address=0.0.0.0/0 gateway=ipip routing-mark="IPIP PACKET"
</pre>
<br>
<br>
'''Step six – Nat For Our Users""
<br>
In this step we use nat for our Users.
<br>
[[File:IPIP-NAT.jpg]]
<br>
in the advanced menu select src address list (HASAN)
<br>
[[File:SRC-nat-ipip.jpg]]
<br>
Then action msaquerade
<br>
[[File:SRC-nat-ipip2.jpg]]
<br>
IP firewall SRC NAT code :
<br>
<pre>
ip firewall nat add chain=srcnat out-interface=ipip src-address-list=HASAN action=masquerade
</pre>
<br>
'''Step Seven – Nat For IPIP Tunnel on another side (MikroTik 450G free internet)'''
<br>
[[File:SRC-NAT-IPIP_c2.jpg]]
<br>
Then action msaquerade
<br>
[[File:SRC-nat-ipip_c3.jpg]]
<br>
IP firewall SRC NAT code :
<br>
<pre>
ip firewall nat add src-address=10.10.10.2 action=masquerade
</pre>
<br>
'''Summary Exploration :'''
I Marked my packets Their Destination Is IP Or name of Facebook Website ( Filtered ) And Marked For Routing Decision , Then I Setup A IPIP Connection with P2P addressing To use Free Internet ( Without Filter ) And Then Add a New Route For All Packets They Want Use For Free Internet ( Without Filter ) , Then I Nat All Connections Want Goes To IPIP  Connection .
Notice: You Can Setup This Scenario With Many Way , But This Is A Simple Example .
You Can Change Configuration To Advanced Configurations For PBR! (Mangle, Nat, Route)
<br>
Helpful Links:
<br>Policy base Routing wrote by Reza Moghdam<br>
http://wiki.mikrotik.com/wiki/Policy_Base_Routing<br>
Mikrotik Wiki IPIP<br>
http://wiki.mikrotik.com/wiki/Manual:Interface/IPIP

<br>
Hasan Asghari
<br>
Mikrotik Trainer
<br>
https://mikrotikuniversity.net